You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
HyperFleet uses a **centralized hook registry** at [`hyperfleet-hooks`](https://github.com/openshift-hyperfleet/hyperfleet-hooks) to enforce consistent commit message format and code quality across all repositories. The [pre-commit](https://pre-commit.com/) framework automatically downloads, builds, and caches hook binaries — no manual installation of individual tools is required.
27
+
HyperFleet uses a **centralized hook registry** at [`hyperfleet-hooks`](https://github.com/openshift-hyperfleet/hyperfleet-hooks) to enforce consistent commit message format and code quality across all repositories. Additionally, **LeakTK** provides secret scanning to prevent credentials and API keys from being committed. The [pre-commit](https://pre-commit.com/) framework automatically downloads, builds, and caches hook binaries — no manual installation of individual tools is required.
28
28
29
29
### How It Works
30
30
@@ -53,13 +53,34 @@ When a developer runs `git commit`, the pre-commit framework intercepts the oper
53
53
pip install pre-commit
54
54
```
55
55
56
-
- Go 1.25+ (for the `commitlint` hook — built automatically by pre-commit on first run)
56
+
- Go 1.25+ (for the `commitlint` hook and LeakTK secret scanning — both built automatically by pre-commit on first run)
57
57
-`make` targets (`lint`, `gofmt`, `go-vet`) in the consuming repo (for Go tooling hooks)
58
58
59
+
**LeakTK builds with `CGO_ENABLED=0` by default** — no system dependencies required. This works on all platforms (Linux, macOS, Windows).
60
+
61
+
<details>
62
+
<summary>Optional: Building LeakTK with CGO enabled</summary>
63
+
64
+
If you need CGO support, install the following system dependencies before running `make install-hooks`:
65
+
66
+
```bash
67
+
# Fedora/RHEL
68
+
sudo dnf install btrfs-progs-devel
69
+
70
+
# Ubuntu/Debian
71
+
sudo apt install libbtrfs-dev
72
+
```
73
+
74
+
Then set `CGO_ENABLED=1` in your environment.
75
+
76
+
</details>
77
+
59
78
---
60
79
61
80
## Available Hooks
62
81
82
+
### HyperFleet Hooks
83
+
63
84
All hooks are defined in the [`hyperfleet-hooks`](https://github.com/openshift-hyperfleet/hyperfleet-hooks) repository:
64
85
65
86
| Hook ID | Stage | Language | Description |
@@ -71,6 +92,22 @@ All hooks are defined in the [`hyperfleet-hooks`](https://github.com/openshift-h
71
92
72
93
The Go tooling hooks use `language: system` and delegate to existing Make targets rather than reimplementing tool resolution. This leverages each repo's [bingo](https://github.com/bwplotka/bingo)-managed tool versions (see [dependency pinning standard](https://github.com/openshift-hyperfleet/architecture/blob/main/hyperfleet/standards/dependency-pinning.md)).
73
94
95
+
### Secret Scanning Hook
96
+
97
+
**LeakTK** provides secret scanning to prevent credentials, API keys, and other secrets from being committed:
98
+
99
+
| Hook ID | Stage | Language | Description |
100
+
|---------|-------|----------|-------------|
101
+
|`leaktk.git.pre-commit`|`pre-commit`|`golang`| LeakTK: Scans staged files for secrets using Gitleaks engine with Red Hat-specific patterns |
102
+
103
+
**Key features**:
104
+
- ✅ **Open-source** — no VPN requirement, works for all contributors
105
+
- ✅ **Developed by Red Hat InfoSec** — same team that created rh-pre-commit
> **Note:** `default_install_hook_types: [pre-commit, commit-msg]` means a single `pre-commit install` command installs hooks for **both** the `pre-commit` and `commit-msg` stages. Without this setting, you would need to run `pre-commit install --hook-type commit-msg` separately to enable commit message validation.
107
151
152
+
> **Important:** On the **first commit** after running `make install-hooks`, LeakTK will compile from source (3-5 minutes). Subsequent commits use the cached binary and run instantly.
153
+
108
154
---
109
155
110
156
## Migration Guide
111
157
158
+
This section covers two migration scenarios:
159
+
1. **Adding Pre-commit Hooks** — adding hooks to an existing HyperFleet repository
160
+
2. **Secret Scanning Migration** — migrating from rh-pre-commit to LeakTK
161
+
162
+
---
163
+
164
+
### Adding Pre-commit Hooks to a Repository
165
+
112
166
Follow these steps to add pre-commit hooks to an existing HyperFleet repository.
113
167
114
-
### Step 1: Add `.pre-commit-config.yaml`
168
+
#### Step 1: Add `.pre-commit-config.yaml`
115
169
116
170
Copy the [Standard Configuration](#standard-configuration) into a `.pre-commit-config.yaml` file in the repo root.
117
171
118
-
### Step 2: Add `install-hooks` Makefile target
172
+
#### Step 2: Add `install-hooks` Makefile target
119
173
120
174
Add the target to your Makefile (see [Makefile Conventions — Optional Targets](https://github.com/openshift-hyperfleet/architecture/blob/main/hyperfleet/standards/makefile-conventions.md#optional-targets)):
### Step 3: Add Make aliases for Go tooling hooks (Go repos only)
182
+
#### Step 3: Add Make aliases for Go tooling hooks (Go repos only)
129
183
130
184
The Go tooling hooks expect `make gofmt` and `make go-vet` targets. If your repo uses different names (e.g., `fmt` and `vet`), add aliases:
131
185
@@ -137,7 +191,7 @@ gofmt: fmt ## Alias for fmt
137
191
go-vet: vet ## Alias for vet
138
192
```
139
193
140
-
### Step 4: Update documentation
194
+
#### Step 4: Update documentation
141
195
142
196
Add `pre-commit` to the prerequisites section in your `README.md`:
143
197
@@ -161,7 +215,7 @@ Add the hook installation step to your getting started section or `CONTRIBUTING.
161
215
make install-hooks
162
216
```
163
217
164
-
### Step 5: Install and verify
218
+
#### Step 5: Install and verify
165
219
166
220
```bash
167
221
make install-hooks
@@ -180,7 +234,7 @@ Test with an invalid commit (should fail):
180
234
git commit --allow-empty -m "bad commit message"
181
235
```
182
236
183
-
### Step 6: Fix existing violations
237
+
#### Step 6: Fix existing violations
184
238
185
239
Run hooks against the entire codebase to fix any pre-existing violations (trailing whitespace, missing EOF newlines, etc.). Without this step, the first contributor who touches an unrelated file with a trailing whitespace or missing newline gets a hook failure they didn't cause.
[**LeakTK**](https://github.com/leaktk/leaktk) is an open-source secret scanning toolkit developed by Red Hat's Information Security team — the same team that created rh-pre-commit.
266
+
267
+
**Key benefits over rh-pre-commit**:
268
+
- ✅ **No VPN requirement** — works for Red Hat associates and external contributors
269
+
- ✅ **Open-source** — MIT licensed, publicly accessible on GitHub
270
+
- ✅ **Can be committed to repos** — configuration lives in repository files
271
+
- ✅ **Enforces on all developers** — configuration in repo ensures everyone uses it
272
+
- ✅ **Same detection engine** — both use Gitleaks with Red Hat-specific patterns (verified by InfoSec team)
273
+
274
+
#### Comparison: rh-pre-commit vs LeakTK
275
+
276
+
Both tools perform secret scanning using Gitleaks as the underlying engine. Here are the key differences:
rev: v0.3.2 # Check https://github.com/leaktk/leaktk/releases for latest
334
+
hooks:
335
+
- id: leaktk.git.pre-commit
336
+
```
337
+
338
+
**Step 3: Notify team**
339
+
340
+
Inform all developers that:
341
+
1. System requirements must be met (Go 1.25+ only — no other dependencies needed)
342
+
2. They should reinstall hooks: `make install-hooks`
343
+
3. The **first commit** will take 3-5 minutes (one-time compilation)
344
+
4. Subsequent commits will run instantly (cached binary)
345
+
346
+
**Step 4: Commit the migration**
347
+
348
+
```bash
349
+
git add .pre-commit-config.yaml
350
+
git commit -m "HYPERFLEET-XXX - chore: migrate from rh-pre-commit to LeakTK"
351
+
```
352
+
353
+
**Step 5: Update CI/CD pipelines**
354
+
355
+
If your repository enforces hooks in CI, update your pipeline configuration to use LeakTK instead of rh-pre-commit. The following steps apply regardless of CI platform (Prow, GitHub Actions, GitLab CI, etc.):
356
+
357
+
1. **Ensure Go 1.25+ is available** in your CI environment
358
+
- Verify with `go version` or install if needed
359
+
360
+
2. **Install pre-commit framework**:
361
+
```bash
362
+
pip install pre-commit
363
+
```
364
+
365
+
3. **Run the repository's hook installation target** to ensure consistent setup:
366
+
```bash
367
+
make install-hooks
368
+
```
369
+
This mirrors the developer workflow and ensures pre-commit hooks are registered. The first run compiles LeakTK (3-5 minutes) — cache to avoid recompilation on subsequent runs.
370
+
371
+
4. **Cache the pre-commit environment** to avoid recompiling LeakTK on every run
372
+
- Cache directory: `~/.cache/pre-commit/`
373
+
- Cache key: tie to `.pre-commit-config.yaml` content (e.g., hash of the file)
374
+
- This reduces subsequent runs from minutes to seconds
375
+
376
+
5. **Replace rh-pre-commit invocations** with pre-commit:
377
+
```bash
378
+
# Before (rh-pre-commit)
379
+
rh-pre-commit run --all-files
380
+
381
+
# After (pre-commit with LeakTK)
382
+
pre-commit run --all-files
383
+
```
384
+
385
+
**Note:** If your repo uses the `make install-hooks` wrapper, you can also run hooks via `make` targets that delegate to pre-commit.
386
+
387
+
**Notes:**
388
+
- The **first pipeline run** after migration compiles LeakTK (3-5 minutes). Subsequent runs use the cached binary.
389
+
- **LeakTK builds with `CGO_ENABLED=0` by default** — no btrfs-progs-devel or other system dependencies required.
390
+
- Search for `rh-pre-commit`, `LeakTK`, `make install-hooks`, and `pre-commit` in your CI configuration to locate and update all relevant pipeline steps.
The commit will be blocked until secrets are removed.
418
+
419
+
---
420
+
421
+
207
422
## Troubleshooting
208
423
209
424
### `pre-commit: command not found`
@@ -229,6 +444,48 @@ Your Makefile needs the `gofmt` alias. Add it pointing to your existing formatti
229
444
gofmt: fmt ## Alias for fmt
230
445
```
231
446
447
+
### LeakTK compilation fails with "Go version too old"
448
+
449
+
LeakTK requires Go 1.25+:
450
+
451
+
```bash
452
+
# Check version
453
+
go version
454
+
455
+
# Update (Fedora/RHEL)
456
+
sudo dnf update golang
457
+
458
+
# Or download from https://go.dev/dl/
459
+
```
460
+
461
+
### LeakTK compilation fails with "btrfs/ioctl.h: No such file or directory"
462
+
463
+
This error occurs when LeakTK tries to build with CGO enabled but the btrfs development headers are missing.
464
+
465
+
**Solution 1 (Recommended):** Build without CGO — no system dependencies required:
466
+
467
+
```bash
468
+
# Clear cached build and rebuild
469
+
pre-commit clean
470
+
CGO_ENABLED=0 pre-commit install
471
+
```
472
+
473
+
**Solution 2:** Install btrfs development headers (Linux only):
474
+
475
+
```bash
476
+
# Fedora/RHEL
477
+
sudo dnf install btrfs-progs-devel
478
+
479
+
# Ubuntu/Debian
480
+
sudo apt install libbtrfs-dev
481
+
```
482
+
483
+
**Note:** macOS users should use Solution 1 — btrfs is Linux-only and not available on macOS.
484
+
485
+
### First commit takes 3-5 minutes
486
+
487
+
This is **expected behavior** on the first commit after installing LeakTK. The pre-commit framework is compiling LeakTK from source. Subsequent commits will use the cached binary and run instantly.
488
+
232
489
### Hook runs but uses wrong tool version
233
490
234
491
Pre-commit caches hook environments. Clear the cache and reinstall:
@@ -274,3 +531,6 @@ This updates the `rev` field in `.pre-commit-config.yaml` to the latest tag.
![openshift-merge-bot[bot]](https://avatars.githubusercontent.com/in/412865?v=4&size=40){kind=avatar}
0 commit comments