From 479f0548493bbdbb81c53e596abe0faf4ca89092 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Igor=20Hr=C4=8Dek?= <igor@hrcek.rs>
Date: Thu, 17 Sep 2026 13:20:47 +0200
Subject: [PATCH] feat: Added gitleaks hook

---
 flake.nix    | 1 +
 lefthook.yml | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/flake.nix b/flake.nix
index 49eddf5..838e267 100644
--- a/flake.nix
+++ b/flake.nix
@@ -15,6 +15,7 @@
         devShells.default = pkgs.mkShell {
           buildInputs = [
             pkgs.go-task
+            pkgs.gitleaks
           ];
 
           packages = [ pkgs.lefthook pkgs.terraform ];
diff --git a/lefthook.yml b/lefthook.yml
index f32c417..fb035ab 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -11,3 +11,6 @@ pre-commit:
     ruff:
       glob: "*.py"
       run: ruff format .
+    gitleaks:
+      run: gitleaks git --pre-commit --redact --staged --verbose --no-banner
+      fail_text: Staged changes contain a secret. Remove it; never commit and revert.