feat(betterleaks): add betterleaks config to hk builtin config by hituzi-no-sippo · Pull Request #750 · jdx/hk

hituzi-no-sippo · 2026-03-18T14:40:26Z

Add betterleaks as a new builtin secret scanner.

gemini-code-assist · 2026-03-18T14:48:50Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces the 'betterleaks' secret scanner into the system's built-in configurations. The change provides a new, configurable, and fast option for identifying secrets within projects, thereby strengthening security posture by expanding the range of available scanning tools.

Highlights

New Secret Scanner Integration: Integrated 'betterleaks' as a new builtin secret scanner, enhancing the system's capability to detect sensitive information.
Pkl Configuration Added: A new Pkl configuration file (pkl/builtins/betterleaks.pkl) was added, defining the metadata, check command, and tests for the betterleaks scanner.
Tool Stub Created: A tool stub (test/builtin_tool_stubs/betterleaks) was added to define the version and tool source for betterleaks, facilitating its execution.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces betterleaks as a new built-in secret scanner. The configuration is well-structured, including appropriate project indicators and tests. However, I've identified a potential issue in the check command which uses a flag specific to the pre-commit framework. This could lead to incorrect behavior when run via hk. My review includes a suggestion to rectify this for robust integration.

gemini-code-assist · 2026-03-18T14:50:53Z

+betterleaks = new Config.Step {
+  types = List("text")
+  // Source: https://github.com/betterleaks/betterleaks/blob/v1.1.1/.pre-commit-hooks.yaml#L4
+  check = "betterleaks git --pre-commit --redact --staged --verbose --no-banner"


The --pre-commit flag is designed for use with the pre-commit framework, as it relies on environment variables (e.g., PRE_COMMIT_FROM_REF, PRE_COMMIT_TO_REF) that the framework sets to determine the range of commits to scan.

Since hk is a separate tool and does not set these variables, using this flag can cause betterleaks to default to a different scanning behavior (like scanning all of HEAD), which is not the intention. The --staged flag is sufficient to correctly scan only the staged files, which is the desired behavior in a pre-commit context with hk.

check = "betterleaks git --redact --staged --verbose --no-banner"

Add [betterleaks](https://github.com/betterleaks/betterleaks) as a new builtin secret scanner for detecting hardcoded secrets like API keys and credentials in source code. - Category: Secrets - Detects project via `.gitleaks.toml` or `.betterleaks.toml` - Runs as a pre-commit check with `--staged --redact --verbose` - Includes tests for AWS key detection and clean file validation Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

greptile-apps · 2026-04-01T10:54:30Z

Greptile Summary

This PR adds betterleaks as a new builtin secrets scanner configuration for hk, following the same conventions as other builtins (PKL config + tool stub). The implementation is clean and well-structured — it includes a proper Secrets category, two tests derived from betterleaks' own testdata, and a pinned tool stub at v1.1.1.

Key changes:

pkl/builtins/betterleaks.pkl — new builtin using betterleaks dir --redact --verbose --no-banner {{ files }} as the check command, scoped to types = List(\"text\") files
test/builtin_tool_stubs/betterleaks — test stub pinning betterleaks v1.1.1 via aqua:betterleaks/betterleaks

Issue found:

The project_indicators list includes .gitleaks.toml alongside .betterleaks.toml. Since .gitleaks.toml is the native config file for gitleaks (a distinct, widely-used secrets scanner), this will cause hk to suggest/activate betterleaks in any project that is already using gitleaks — likely the opposite of what users expect. Only .betterleaks.toml should be used as the project indicator.

Confidence Score: 4/5

Safe to merge after resolving the .gitleaks.toml project indicator issue, which would cause betterleaks to be incorrectly activated in gitleaks-based projects.

The PR is well-structured and follows all established patterns. The single P1 finding — including .gitleaks.toml as a project indicator — would lead to a confusing user experience by activating betterleaks in projects that use gitleaks but not betterleaks. All other aspects (command, tests, stub, category) are correct and consistent with existing builtins.

pkl/builtins/betterleaks.pkl — specifically the project_indicators block at line 9.

Important Files Changed

Filename	Overview
pkl/builtins/betterleaks.pkl	Adds betterleaks builtin config with Secrets category, text-file scoping, and two tests; includes `.gitleaks.toml` as a project indicator alongside `.betterleaks.toml`, which may inadvertently activate betterleaks in gitleaks-based projects.
test/builtin_tool_stubs/betterleaks	Adds a test stub pinning betterleaks to v1.1.1 via aqua; follows the same format as all other stubs in the directory.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[hk pre-commit hook triggered] --> B{betterleaks step\nproject_indicators match?}
    B -- ".gitleaks.toml present\nOR .betterleaks.toml present" --> C[Step activated]
    B -- Neither file found --> D[Step skipped]
    C --> E{Staged files\nmatching types=text?}
    E -- None --> F[Step skipped: no files to process]
    E -- Files found --> G["betterleaks dir --redact --verbose --no-banner {{ files }}"]
    G --> H{Exit code}
    H -- 0 --> I[✅ Check passed — no secrets found]
    H -- non-zero --> J[❌ Check failed — secrets detected]

_{Reviews (1): Last reviewed commit: "feat(betterleaks): add betterleaks confi..." | Re-trigger Greptile}

greptile-apps · 2026-04-01T10:54:34Z

+  category = "Secrets"
+  description = "A Better Secrets Scanner built for configurability and speed"
+  project_indicators {
+    new { file = ".gitleaks.toml" }


.gitleaks.toml as a project indicator for betterleaks is misleading

.gitleaks.toml is the native configuration file for gitleaks, a separate (and more widely deployed) secrets scanner. Listing it as a project_indicator for betterleaks means hk will suggest/activate betterleaks in any repo that is already using gitleaks, which is likely the opposite of the intended behavior. Users who have .gitleaks.toml are typically running gitleaks, not betterleaks, and would be surprised to see betterleaks activated.

Even though betterleaks is advertised as compatible with the gitleaks config format, the mere presence of .gitleaks.toml is a stronger signal that gitleaks is in use rather than betterleaks.

Consider removing .gitleaks.toml from project_indicators and keeping only .betterleaks.toml:

Suggested change

new { file = ".gitleaks.toml" }

new { file = ".betterleaks.toml" }

@hituzi-no-sippo

### 🚀 Features - **(betterleaks)** add betterleaks config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#750](#750) - **(builtins)** add google-java-format to builtins by [@timothysparg](https://github.com/timothysparg) in [#777](#777) - **(builtins)** add dclint to builtins by [@timothysparg](https://github.com/timothysparg) in [#779](#779) - **(config)** set default value for exclude to List() by [@timothysparg](https://github.com/timothysparg) in [#781](#781) - **(core)** add required field to prevent unconfigured steps from running by [@timothysparg](https://github.com/timothysparg) in [#785](#785) - **(gitleaks)** add gitleaks config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#749](#749) - **(mdschema)** add mdschema config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#748](#748) - **(pkl)** add pklr as opt-in pkl backend by [@jdx](https://github.com/jdx) in [#769](#769) - add pklr as opt-in pkl backend by [@jdx](https://github.com/jdx) in [#768](#768) ### 🐛 Bug Fixes - **(docs)** replace invalid /latest/ pkl package URIs with versioned format by [@jdx](https://github.com/jdx) in [#770](#770) - **(stage)** do not stage pre-existing untracked files by [@jdx](https://github.com/jdx) in [#788](#788) ### 📚 Documentation - add benchmarks page and reproducible benchmark suite by [@jdx](https://github.com/jdx) in [#766](#766) - add recommended setup section to mise integration by [@timothysparg](https://github.com/timothysparg) in [#780](#780) ### 📦️ Dependency Updates - lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#762](#762) - update rust crate pklr to 0.4 by [@renovate[bot]](https://github.com/renovate[bot]) in [#776](#776) - update apple-actions/import-codesign-certs digest to fe74d46 by [@renovate[bot]](https://github.com/renovate[bot]) in [#774](#774) - update anthropics/claude-code-action digest to 094bd24 by [@renovate[bot]](https://github.com/renovate[bot]) in [#773](#773) - update taiki-e/upload-rust-binary-action digest to 0e34102 by [@renovate[bot]](https://github.com/renovate[bot]) in [#775](#775) - bump usage to 3.2.0 and pkl to 0.31.1, add windows platforms by [@jdx](https://github.com/jdx) in [#787](#787) - lock file maintenance by [@renovate[bot]](https://github.com/renovate[bot]) in [#786](#786) ### New Contributors - @timothysparg made their first contribution in [#781](#781)  --- > [!NOTE] > **Medium Risk** > Primarily a version/documentation bump, but it also updates the Rust dependency lockfile (e.g., `hyper` and `windows-sys`), which could introduce build/runtime regressions. > > **Overview** > Bumps hk to **v1.40.0** and publishes the corresponding release notes in `CHANGELOG.md`. > > Updates generated CLI/docs and all Pkl package URL references in docs/examples to point at `v1.40.0`, and refreshes `Cargo.lock` with dependency updates/removals consistent with the new release. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit da00ab8. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  Co-authored-by: mise-en-dev <123107610+mise-en-dev@users.noreply.github.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [hk](https://github.com/jdx/hk) | minor | `1.39.0` → `1.40.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>jdx/hk (hk)</summary> ### [`v1.40.0`](https://github.com/jdx/hk/blob/HEAD/CHANGELOG.md#1400---2026-04-01) [Compare Source](jdx/hk@v1.39.0...v1.40.0) ##### 🚀 Features - **(betterleaks)** add betterleaks config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#750](jdx/hk#750) - **(builtins)** add google-java-format to builtins by [@timothysparg](https://github.com/timothysparg) in [#777](jdx/hk#777) - **(builtins)** add dclint to builtins by [@timothysparg](https://github.com/timothysparg) in [#779](jdx/hk#779) - **(config)** set default value for exclude to List() by [@timothysparg](https://github.com/timothysparg) in [#781](jdx/hk#781) - **(core)** add required field to prevent unconfigured steps from running by [@timothysparg](https://github.com/timothysparg) in [#785](jdx/hk#785) - **(gitleaks)** add gitleaks config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#749](jdx/hk#749) - **(mdschema)** add mdschema config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#748](jdx/hk#748) - **(pkl)** add pklr as opt-in pkl backend by [@jdx](https://github.com/jdx) in [#769](jdx/hk#769) - add pklr as opt-in pkl backend by [@jdx](https://github.com/jdx) in [#768](jdx/hk#768) ##### 🐛 Bug Fixes - **(docs)** replace invalid /latest/ pkl package URIs with versioned format by [@jdx](https://github.com/jdx) in [#770](jdx/hk#770) - **(stage)** do not stage pre-existing untracked files by [@jdx](https://github.com/jdx) in [#788](jdx/hk#788) ##### 📚 Documentation - add benchmarks page and reproducible benchmark suite by [@jdx](https://github.com/jdx) in [#766](jdx/hk#766) - add recommended setup section to mise integration by [@timothysparg](https://github.com/timothysparg) in [#780](jdx/hk#780) ##### 📦️ Dependency Updates - lock file maintenance by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#762](jdx/hk#762) - update rust crate pklr to 0.4 by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#776](jdx/hk#776) - update apple-actions/import-codesign-certs digest to [`fe74d46`](jdx/hk@fe74d46) by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#774](jdx/hk#774) - update anthropics/claude-code-action digest to [`094bd24`](jdx/hk@094bd24) by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#773](jdx/hk#773) - update taiki-e/upload-rust-binary-action digest to [`0e34102`](jdx/hk@0e34102) by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#775](jdx/hk#775) - bump usage to 3.2.0 and pkl to 0.31.1, add windows platforms by [@jdx](https://github.com/jdx) in [#787](jdx/hk#787) - lock file maintenance by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#786](jdx/hk#786) ##### New Contributors - [@timothysparg](https://github.com/timothysparg) made their first contribution in [#781](jdx/hk#781) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

gemini-code-assist Bot reviewed Mar 18, 2026

View reviewed changes

hituzi-no-sippo force-pushed the feat/add-betterleaks-builtin branch from f8fa050 to e5c35a7 Compare April 1, 2026 00:50

hituzi-no-sippo marked this pull request as ready for review April 1, 2026 10:51

greptile-apps Bot reviewed Apr 1, 2026

View reviewed changes

jdx merged commit b3054a6 into jdx:main Apr 1, 2026
20 checks passed

jdx mentioned this pull request Apr 1, 2026

chore: release v1.40.0 #763

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(betterleaks): add betterleaks config to hk builtin config#750

feat(betterleaks): add betterleaks config to hk builtin config#750
jdx merged 1 commit intojdx:mainfrom
hituzi-no-sippo:feat/add-betterleaks-builtin

hituzi-no-sippo commented Mar 18, 2026

Uh oh!

gemini-code-assist Bot commented Mar 18, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Mar 18, 2026

Uh oh!

greptile-apps Bot commented Apr 1, 2026

Uh oh!

greptile-apps Bot Apr 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	new { file = ".gitleaks.toml" }
	new { file = ".betterleaks.toml" }

Uh oh!

Conversation

hituzi-no-sippo commented Mar 18, 2026

Uh oh!

gemini-code-assist Bot commented Mar 18, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Apr 1, 2026

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Flowchart

Uh oh!

greptile-apps Bot Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants