feat(gitleaks): add gitleaks config to hk builtin config by hituzi-no-sippo · Pull Request #749 · jdx/hk

hituzi-no-sippo · 2026-03-18T14:39:46Z

Add gitleaks as a new builtin secret scanner.

gemini-code-assist · 2026-03-18T14:40:01Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces Gitleaks as a new built-in secret scanner, enhancing the system's capability to automatically detect and prevent the accidental exposure of sensitive information within Git repositories. This integration provides a standardized and automated way to perform security checks for secrets.

Highlights

Gitleaks Integration: Integrated Gitleaks as a new built-in secret scanner, enabling automated detection of sensitive information in Git repositories.
Configuration Definition: Defined the Gitleaks scanning step in pkl/builtins/gitleaks.pkl, including its metadata, check command, and example tests for AWS keys and clean files.
Tool Stub Creation: Created a tool stub for Gitleaks in test/builtin_tool_stubs/gitleaks to specify its version and source for the mise tool.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds gitleaks as a new builtin secret scanner. The implementation has a significant issue where it only scans staged files, which makes it unreliable in many contexts. I've suggested changing the command to scan the entire directory for a more robust implementation. I also noted a minor version inconsistency in source code comments.

gemini-code-assist · 2026-03-18T14:41:29Z

+  // Source: https://github.com/gitleaks/gitleaks/blob/v8.30.0/.pre-commit-hooks.yaml#L4
+  check = "gitleaks git --pre-commit --redact --staged --verbose --no-banner"


There are a couple of issues with the current check command implementation:

Limited Scope: The use of gitleaks git --pre-commit ... --staged restricts scanning to staged files only. This will cause gitleaks to miss secrets in unstaged files or when hk is run in contexts other than a pre-commit hook (e.g., pre-push or hk run).

Deprecated Command: The gitleaks git command is deprecated in favor of gitleaks detect and gitleaks protect.

To make this builtin robust and reliable across all hk use cases, I recommend using gitleaks detect to scan the current directory. While gitleaks doesn't support scanning a specific list of files, scanning the whole directory is a more correct and safer default.

With this change, the source comment on line 14 will no longer be relevant and can be removed.

check = "gitleaks detect --source . --redact --verbose --no-banner"

gemini-code-assist · 2026-03-18T14:41:29Z

+  check = "gitleaks git --pre-commit --redact --staged --verbose --no-banner"
+  tests {
+    local const testMaker = new helpers.TestMaker { filename = "foo.txt" }
+    // Source: https://github.com/gitleaks/gitleaks/blob/v8.30.0/testdata/repos/nogit/api.go#L20


The version v8.30.0 is referenced in this source URL, but the tool version specified in the test stub (test/builtin_tool_stubs/gitleaks) is 8.30.1. For consistency and easier maintenance, please update the version in the URL to match the tool version.

// Source: https://github.com/gitleaks/gitleaks/blob/v8.30.1/testdata/repos/nogit/api.go#L20

Add [gitleaks](https://github.com/gitleaks/gitleaks) as a new builtin secret scanner for detecting hardcoded secrets like API keys and credentials in source code. - Category: Secrets - Detects project via `.gitleaks.toml` - Runs as a pre-commit check with `--staged --redact --verbose` - Includes tests for AWS key detection and clean file validation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

greptile-apps · 2026-04-01T10:57:04Z

Greptile Summary

This PR adds gitleaks as a new built-in secret scanner to hk, following the established pattern for other builtins (PKL config + test helper + tool stub). The implementation is clean and consistent with the rest of the codebase.

Changes:

pkl/builtins/gitleaks.pkl — new builtin step that runs gitleaks dir --redact --verbose --no-banner {{ files }} on text files, auto-detected when .gitleaks.toml is present, with tests using a known AWS-key pattern from gitleaks' own test data.
test/builtin_tool_stubs/gitleaks — standard mise tool-stub stub pinning to gitleaks v8.30.1 via aqua.

Observations:

project_indicators only covers .gitleaks.toml; gitleaks also supports .gitleaks.yaml, .gitleaks.yml, and un-dotted variants, so auto-detection will miss projects using those config names.
The check command uses gitleaks dir, which scans working-tree file content. The current official gitleaks pre-commit hook has migrated to gitleaks git --pre-commit --staged (reading directly from the git index). Using dir in a partial-staging scenario can produce false positives or negatives, though this is consistent with how most other hk builtins work.

Confidence Score: 5/5

Safe to merge; both open issues are P2 style/design concerns that do not block correct basic operation.

The implementation correctly follows hk's builtin pattern, has a working test (using gitleaks' own reference test data), and pins to a specific version. All remaining findings are P2: the partial-staging caveat with gitleaks dir is a design trade-off shared by most hk builtins, and the missing config-file variants in project_indicators are a convenience improvement, not a correctness issue.

pkl/builtins/gitleaks.pkl — minor project_indicators completeness and command-choice notes.

Important Files Changed

Filename	Overview
pkl/builtins/gitleaks.pkl	New gitleaks builtin config using `gitleaks dir` to scan staged text files for secrets; project indicator limited to `.gitleaks.toml` only
test/builtin_tool_stubs/gitleaks	Standard tool stub pinning gitleaks to v8.30.1 via aqua, consistent with other stub files

Sequence Diagram

sequenceDiagram
    participant Dev as Developer
    participant hk as hk (pre-commit)
    participant GL as gitleaks (v8.30.1)

    Dev->>hk: git commit
    hk->>hk: collect staged text files (types=text)
    hk->>GL: gitleaks dir --redact --verbose --no-banner [files]
    alt secret found
        GL-->>hk: exit code 1 + finding details
        hk-->>Dev: commit blocked, secrets reported
    else no secrets
        GL-->>hk: exit code 0
        hk-->>Dev: commit proceeds
    end

_{Reviews (1): Last reviewed commit: "feat(gitleaks): add gitleaks config to h..." | Re-trigger Greptile}

greptile-apps · 2026-04-01T10:57:07Z

+  project_indicators {
+    new { file = ".gitleaks.toml" }
+  }


Missing gitleaks config file variants in project_indicators

Gitleaks v8 supports multiple configuration file formats: .gitleaks.toml, .gitleaks.yaml, .gitleaks.yml, gitleaks.toml, gitleaks.yaml, and gitleaks.yml. Currently only .gitleaks.toml is listed as a project_indicators entry, so the builtin won't be auto-detected for users who configure gitleaks with any of the other supported formats.

Consider adding the other variants:

project_indicators { new { file = ".gitleaks.toml" } new { file = ".gitleaks.yaml" } new { file = ".gitleaks.yml" } new { file = "gitleaks.toml" } }

greptile-apps · 2026-04-01T10:57:08Z

+}
+gitleaks = new Config.Step {
+  types = List("text")
+  // Reference: https://github.com/gitleaks/gitleaks/blob/v8.30.1/.pre-commit-hooks.yaml#L4


gitleaks dir vs gitleaks git --pre-commit --staged

The referenced URL points to gitleaks' .pre-commit-hooks.yaml at v8.30.1 (line 4). However, gitleaks' current official pre-commit hook (on master) uses gitleaks git --pre-commit --redact --staged --verbose with pass_filenames: false — not gitleaks dir. The key semantic difference is:

gitleaks dir {{ files }} scans the working-tree content of the staged file paths.

gitleaks git --pre-commit --staged reads directly from the git index, so it catches exactly what is being committed.

In a partial-staging scenario (e.g., git add -p), gitleaks dir will scan the working-tree version of the file, which may contain additional unstaged changes. This can produce false positives (blocking a commit because of a secret that isn't actually staged) or false negatives (if the secret is only in the staged diff but the working-tree copy differs).

It's worth confirming whether the v8.30.1 tag still recommended gitleaks dir for this use case, or whether gitleaks git --pre-commit --staged would be more appropriate here.

@hituzi-no-sippo

### 🚀 Features - **(betterleaks)** add betterleaks config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#750](#750) - **(builtins)** add google-java-format to builtins by [@timothysparg](https://github.com/timothysparg) in [#777](#777) - **(builtins)** add dclint to builtins by [@timothysparg](https://github.com/timothysparg) in [#779](#779) - **(config)** set default value for exclude to List() by [@timothysparg](https://github.com/timothysparg) in [#781](#781) - **(core)** add required field to prevent unconfigured steps from running by [@timothysparg](https://github.com/timothysparg) in [#785](#785) - **(gitleaks)** add gitleaks config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#749](#749) - **(mdschema)** add mdschema config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#748](#748) - **(pkl)** add pklr as opt-in pkl backend by [@jdx](https://github.com/jdx) in [#769](#769) - add pklr as opt-in pkl backend by [@jdx](https://github.com/jdx) in [#768](#768) ### 🐛 Bug Fixes - **(docs)** replace invalid /latest/ pkl package URIs with versioned format by [@jdx](https://github.com/jdx) in [#770](#770) - **(stage)** do not stage pre-existing untracked files by [@jdx](https://github.com/jdx) in [#788](#788) ### 📚 Documentation - add benchmarks page and reproducible benchmark suite by [@jdx](https://github.com/jdx) in [#766](#766) - add recommended setup section to mise integration by [@timothysparg](https://github.com/timothysparg) in [#780](#780) ### 📦️ Dependency Updates - lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#762](#762) - update rust crate pklr to 0.4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#776](#776) - update apple-actions/import-codesign-certs digest to fe74d46 by [@renovate[bot]](https://github.com/renovate[bot]) in [#774](#774) - update anthropics/claude-code-action digest to 094bd24 by [@renovate[bot]](https://github.com/renovate[bot]) in [#773](#773) - update taiki-e/upload-rust-binary-action digest to 0e34102 by [@renovate[bot]](https://github.com/renovate[bot]) in [#775](#775) - bump usage to 3.2.0 and pkl to 0.31.1, add windows platforms by [@jdx](https://github.com/jdx) in [#787](#787) - lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#786](#786) ### New Contributors - @timothysparg made their first contribution in [#781](#781)  --- > [!NOTE] > **Medium Risk** > Primarily a version/documentation bump, but it also updates the Rust dependency lockfile (e.g., `hyper` and `windows-sys`), which could introduce build/runtime regressions. > > **Overview** > Bumps hk to **v1.40.0** and publishes the corresponding release notes in `CHANGELOG.md`. > > Updates generated CLI/docs and all Pkl package URL references in docs/examples to point at `v1.40.0`, and refreshes `Cargo.lock` with dependency updates/removals consistent with the new release. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit da00ab8. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  Co-authored-by: mise-en-dev <123107610+mise-en-dev@users.noreply.github.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [hk](https://github.com/jdx/hk) | minor | `1.39.0` → `1.40.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>jdx/hk (hk)</summary> ### [`v1.40.0`](https://github.com/jdx/hk/blob/HEAD/CHANGELOG.md#1400---2026-04-01) [Compare Source](jdx/hk@v1.39.0...v1.40.0) ##### 🚀 Features - **(betterleaks)** add betterleaks config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#750](jdx/hk#750) - **(builtins)** add google-java-format to builtins by [@timothysparg](https://github.com/timothysparg) in [#777](jdx/hk#777) - **(builtins)** add dclint to builtins by [@timothysparg](https://github.com/timothysparg) in [#779](jdx/hk#779) - **(config)** set default value for exclude to List() by [@timothysparg](https://github.com/timothysparg) in [#781](jdx/hk#781) - **(core)** add required field to prevent unconfigured steps from running by [@timothysparg](https://github.com/timothysparg) in [#785](jdx/hk#785) - **(gitleaks)** add gitleaks config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#749](jdx/hk#749) - **(mdschema)** add mdschema config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#748](jdx/hk#748) - **(pkl)** add pklr as opt-in pkl backend by [@jdx](https://github.com/jdx) in [#769](jdx/hk#769) - add pklr as opt-in pkl backend by [@jdx](https://github.com/jdx) in [#768](jdx/hk#768) ##### 🐛 Bug Fixes - **(docs)** replace invalid /latest/ pkl package URIs with versioned format by [@jdx](https://github.com/jdx) in [#770](jdx/hk#770) - **(stage)** do not stage pre-existing untracked files by [@jdx](https://github.com/jdx) in [#788](jdx/hk#788) ##### 📚 Documentation - add benchmarks page and reproducible benchmark suite by [@jdx](https://github.com/jdx) in [#766](jdx/hk#766) - add recommended setup section to mise integration by [@timothysparg](https://github.com/timothysparg) in [#780](jdx/hk#780) ##### 📦️ Dependency Updates - lock file maintenance by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#762](jdx/hk#762) - update rust crate pklr to 0.4 by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#776](jdx/hk#776) - update apple-actions/import-codesign-certs digest to [`fe74d46`](jdx/hk@fe74d46) by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#774](jdx/hk#774) - update anthropics/claude-code-action digest to [`094bd24`](jdx/hk@094bd24) by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#773](jdx/hk#773) - update taiki-e/upload-rust-binary-action digest to [`0e34102`](jdx/hk@0e34102) by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#775](jdx/hk#775) - bump usage to 3.2.0 and pkl to 0.31.1, add windows platforms by [@jdx](https://github.com/jdx) in [#787](jdx/hk#787) - lock file maintenance by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#786](jdx/hk#786) ##### New Contributors - [@timothysparg](https://github.com/timothysparg) made their first contribution in [#781](jdx/hk#781) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

gemini-code-assist Bot reviewed Mar 18, 2026

View reviewed changes

hituzi-no-sippo force-pushed the feat/add-gitleaks-builtin branch from 5941bfe to a845037 Compare March 19, 2026 03:46

hituzi-no-sippo force-pushed the feat/add-gitleaks-builtin branch from a845037 to d2697b3 Compare March 31, 2026 19:32

hituzi-no-sippo force-pushed the feat/add-gitleaks-builtin branch from d2697b3 to aaf35d3 Compare April 1, 2026 00:49

hituzi-no-sippo marked this pull request as ready for review April 1, 2026 10:51

greptile-apps Bot reviewed Apr 1, 2026

View reviewed changes

jdx merged commit 6092d31 into jdx:main Apr 1, 2026
21 checks passed

jdx mentioned this pull request Apr 1, 2026

chore: release v1.40.0 #763

Merged

hituzi-no-sippo deleted the feat/add-gitleaks-builtin branch May 7, 2026 21:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(gitleaks): add gitleaks config to hk builtin config#749

feat(gitleaks): add gitleaks config to hk builtin config#749
jdx merged 1 commit intojdx:mainfrom
hituzi-no-sippo:feat/add-gitleaks-builtin

hituzi-no-sippo commented Mar 18, 2026

Uh oh!

gemini-code-assist Bot commented Mar 18, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Mar 18, 2026

Uh oh!

gemini-code-assist Bot Mar 18, 2026

Uh oh!

greptile-apps Bot commented Apr 1, 2026

Uh oh!

greptile-apps Bot Apr 1, 2026

Uh oh!

greptile-apps Bot Apr 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		// Source: https://github.com/gitleaks/gitleaks/blob/v8.30.0/.pre-commit-hooks.yaml#L4
		check = "gitleaks git --pre-commit --redact --staged --verbose --no-banner"

Uh oh!

Conversation

hituzi-no-sippo commented Mar 18, 2026

Uh oh!

gemini-code-assist Bot commented Mar 18, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Apr 1, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

greptile-apps Bot Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants