diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml index 11e64059..0ad7103d 100644 --- a/.github/workflows/gitleaks.yml +++ b/.github/workflows/gitleaks.yml @@ -39,4 +39,4 @@ jobs: GITLEAKS_ENABLE_COMMENTS: false GITLEAKS_ENABLE_SUMMARY: true GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false - GITLEAKS_CONFIG: .github/gitleaks-rules.toml + GITLEAKS_CONFIG: ./dev_scripts_helpers/git/gitleaks/gitleaks-rules.toml diff --git a/dev_scripts_helpers/git/git_hooks/utils.py b/dev_scripts_helpers/git/git_hooks/utils.py index dade2412..75661517 100644 --- a/dev_scripts_helpers/git/git_hooks/utils.py +++ b/dev_scripts_helpers/git/git_hooks/utils.py @@ -4,7 +4,6 @@ import dev_scripts_helpers.git.git_hooks.utils as dshgghout """ -# NOTE: This file should depend only on Python standard libraries. import compileall import inspect import logging @@ -15,6 +14,8 @@ import sys from typing import Any, List, Optional, Tuple +import helpers.hgit as hgit + _LOG = logging.getLogger(__name__) # TODO(gp): Check these hooks @@ -468,29 +469,22 @@ def check_python_compile( # ############################################################################# -def get_git_root_dir() -> str: - """ - Return the absolute path to the outermost Git repository root. - - If inside a Git submodule, this returns the parent (superproject) - root. Otherwise, it returns the current repository's root. - - :return: absolute path to the outermost Git repository root - """ - cmd = "git rev-parse --show-superproject-working-tree --show-toplevel | head -n1" - _, git_root_dir = _system_to_string(cmd) - git_root_dir = git_root_dir.strip() - return git_root_dir - - def check_gitleaks(abort_on_error: bool = True) -> None: """ Check that the code does not contain any leaked secrets. """ func_name = _report() - git_root_dir = get_git_root_dir() + # Find relative path from the git root to the helpers root. + git_root_dir = hgit.find_git_root() + helpers_root_dir = hgit.find_helpers_root() + rel_path = os.path.relpath(helpers_root_dir, git_root_dir) + # Find the gitleaks config file. + config_path = os.path.join( + "/app", rel_path, "dev_scripts_helpers/git/gitleaks" + ) + config_path = os.path.normpath(config_path) cmd = f""" - docker run -v {git_root_dir}:/app zricethezav/gitleaks:latest -c /app/.github/gitleaks-rules.toml git /app --pre-commit --staged --verbose + docker run -v {git_root_dir}:/app zricethezav/gitleaks:latest -c {config_path}/gitleaks-rules.toml git /app --pre-commit --staged --verbose """ _LOG.debug("cmd='%s'", cmd) rc, txt = _system_to_string(cmd, abort_on_error=False) diff --git a/.github/gitleaks-rules.toml b/dev_scripts_helpers/git/gitleaks/gitleaks-rules.toml similarity index 100% rename from .github/gitleaks-rules.toml rename to dev_scripts_helpers/git/gitleaks/gitleaks-rules.toml