a7a1595cbf
- make quick/check/mutation from cj/security-baseline (Makefile unchanged, settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint security rules, Forgejo workflow - tests/security: generic baseline tests plus app config and role tests against createApp() with an in-memory database - extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests - fix gaps found by the tests: reject unknown fields on project create, answer malformed JSON with 400 instead of 500, set nosniff on the API - npm audit fix (next 16.4.1 and others, no high/critical left) - clear ESLint errors, safeFileName without control-character regex - per-project ownership stays an open, documented gap (idorGap -> TODO) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
31 lines
1,005 B
YAML
31 lines
1,005 B
YAML
# Pre-Commit der Baseline: Secrets und offensichtlicher Mist kommen gar nicht erst ins Repo.
|
|
# Einrichten: make setup (installiert den Hook). Manuell über alles: .venv-tools/bin/pre-commit run -a
|
|
|
|
repos:
|
|
- repo: https://github.com/gitleaks/gitleaks
|
|
rev: v8.30.1
|
|
hooks:
|
|
- id: gitleaks
|
|
|
|
- repo: https://github.com/pre-commit/pre-commit-hooks
|
|
rev: v6.0.0
|
|
hooks:
|
|
- id: check-added-large-files
|
|
args: ["--maxkb=1024"]
|
|
- id: check-merge-conflict
|
|
- id: check-yaml
|
|
- id: check-toml
|
|
- id: check-json
|
|
exclude: (^|/)tsconfig.*\.json$
|
|
- id: detect-private-key
|
|
- id: end-of-file-fixer
|
|
- id: trailing-whitespace
|
|
|
|
- repo: local
|
|
hooks:
|
|
- id: no-env-files
|
|
name: keine .env-Dateien committen (nur .env.example)
|
|
entry: ".env-Dateien gehören nicht ins Repo. Secrets in den Secret-Store, Vorlage als .env.example"
|
|
language: fail
|
|
files: (^|/)\.env(\.[^/]*)?$
|
|
exclude: \.env\.example$
|