feat(ci): sensitive data pre-commit check with Accounts.xlsx detection - #137
Merged
Conversation
…nd Get-AccountsLast4 closes #87
…pre-commit hook Adds Invoke-SensitiveDataCheck.ps1 with two pure, unit-testable functions: - Invoke-SensitiveDataCheck: scans staged file content against configurable patterns; suppresses matches on lines ending with '# nocheck' or containing an allowlist entry; filters by file extension - Get-AccountsLast4: reads Last4 identifiers from Accounts.xlsx via ZIP/XML (no COM) so real account numbers are available as dynamic patterns at hook runtime Invoke-PreCommitCheck.ps1 is updated to load SensitivePatterns.json (falling back to the template), build dynamic Last4 patterns from Accounts.xlsx, and run the sensitive data check on every staged file alongside ASCII and lint. closes #87
Adds the committed template with three default patterns (account numbers in payment method context, credential assignments, and email addresses). Users copy this to Config\SensitivePatterns.json to customise patterns and allowlists without modifying the template. Config\SensitivePatterns.json is gitignored alongside the other personal config files. refs #87
Updates the hook table to include the sensitive data scan, and adds a new 'Sensitive Data Patterns' section explaining the three default checks, the Accounts.xlsx Last4 detection, how to customise patterns via Config\SensitivePatterns.json, and how to suppress false positives with allowlist entries or '# nocheck'. refs #87
github-actions
Bot
added
documentation
Provides a placeholder pattern entry that users duplicate and customise to flag institution names, personal identifiers, or any project-specific term with a simple word-boundary regex. fileTypes excludes .json by default so the template does not self-match when staged; users can add .json in their local SensitivePatterns.json. refs #87
… setup Initialize-SyncReceipts.ps1 now copies SensitivePatterns.template.json to Config\SensitivePatterns.json on first run (skipped if already present), consistent with the pattern used for Accounts.xlsx, Categories.json, and Methods.json. Updates CONTRIBUTING.md to reflect that the file is created by setup rather than copied manually. refs #87
Documents the non-obvious design decisions: separate pure script for testability, ZIP/XML over COM for Accounts.xlsx reading, dynamic Last4 patterns, and '# nocheck' suppression token. Also updates CLAUDE.md and README.md architecture diagrams to include SensitivePatterns.json, SensitivePatterns.template.json, and Invoke-SensitiveDataCheck.ps1, and corrects the pre-commit description. Redacts example account numbers in README.md filename examples to 'xxxx' so the pre-commit hook does not flag documentation. refs #87
Replaces 'xxxx' placeholders with realistic fake numbers (3621, 7890) so examples illustrate the full filename format. Checking and Savings examples share the same number to show one account across methods. Adds 3621 and 7890 to the account-number-in-context allowlist in the template so the README does not self-trigger the pre-commit hook. The dynamic Accounts.xlsx check still catches these numbers if they happen to match a real Last4. refs #87
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a sensitive data check to the pre-commit hook that scans staged files for personal or financial data before it reaches the remote. Motivated by ADR-009 being committed with real institution names and account numbers.
Closes #87
Changes
Scripts/hooks/Invoke-SensitiveDataCheck.ps1— two pure, unit-testable functions:Invoke-SensitiveDataCheck(pattern scan with# nochecksuppression and per-pattern allowlists) andGet-AccountsLast4(reads Last4 values fromAccounts.xlsxvia ZIP/XML, no COM)Scripts/hooks/Invoke-PreCommitCheck.ps1— loads static patterns fromConfig\SensitivePatterns.json(falls back to template), builds dynamic Last4 patterns fromAccounts.xlsxat hook runtime, runs sensitive check on every staged file alongside ASCII and lintConfig/Templates/SensitivePatterns.template.json— three default patterns (account numbers in payment context, credential assignments, email addresses) plus akeyword-searchplaceholder entry for institution names and personal identifiersScripts/Initialize-SyncReceipts.ps1— copies template toConfig\SensitivePatterns.jsonon first run, consistent with other config filesDocs/ADRs/ADR-012-sensitive-data-pre-commit-hook.md— documents the four key design decisionsCHANGELOG.md,CONTRIBUTING.md,README.md,CLAUDE.mdupdatedChecklist
Invoke-Pester Tests/ -Output Detailedpasses with no failures (177/177).ps1files.ps1filesCHANGELOG.mdupdated