ci(hooks): manage gitleaks in Python environment

[ooooo-create]

What

Run Gitleaks as a local Python hook with nogoo9-gitleaks==8.30.1, moving the scanner from upstream 8.24.2 to the packaged 8.30.1 binary.

Why

The previous Go hook invokes a Python wrapper but does not provide its interpreter. On systems with python3 but no python on PATH, the hook fails before scanning. A managed Python environment provides both the interpreter and the Gitleaks CLI without a local Go build.

Fixes #306

How

Define the hook under repo: local with language: python, language_version: python3, and a pinned additional_dependencies package. The package supplies the Gitleaks command; supported platform wheels include the binary, while fallback wheels download it on first use.

Keep the existing tracked-file snapshot wrapper, always_run: true, and pass_filenames: false, preserving scanning scope and redacted output.

Testing

pre-commit run --all-files --show-diff-on-failure and prek run gitleaks --all-files passed.

pytest tests/ was not run for this hook-only change. Multi-node GPU integration tests were skipped because they require multi-node GPU hardware. New tests and documentation updates are not applicable.

• pre-commit run --all-files passes
• Tests pass (pytest tests/)
• New tests added (if applicable)
• Documentation updated (if applicable)

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Performance improvement
• CI/CD or build changes

Screenshots / Logs

[Copilot]

🟡 Changes recommended

The pinned dependency version nogoo9-gitleaks==8.30.1 appears to be invalid and would break hook environment installation in CI and locally.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the repository’s secret-scanning pre-commit hook to run Gitleaks from a managed Python hook environment (local repo: local hook with language: python), aiming to avoid failures on systems that lack a python executable on PATH while preserving the existing tracked-file snapshot wrapper behavior.

Changes:

• Replace the upstream gitleaks/gitleaks Go-based hook definition with a local Python hook that runs .pre-commit-hooks/gitleaks_tracked.py.
• Configure the hook to install a pinned nogoo9-gitleaks dependency inside the hook environment so gitleaks is available on PATH during execution.

File summaries

File	Description
.pre-commit-config.yaml	Moves Gitleaks to a local Python pre-commit hook and installs the scanner via additional_dependencies to make execution environment self-contained.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rai-studio-bot]

未发现需要阻塞合入的问题。已核查完整 diff、现有扫描封装与依赖包入口，并在隔离环境中运行 pre-commit run gitleaks --all-files，结果通过。CI 的 pre-commit 检查已通过，单元测试仍在运行。

^{Powered by Nyanpasu with gpt-6-astra medium, please check the suggestions carefully.}

[SigureMo]

LGTMeow

[SigureMo]

@rai-studio-bot 帮看看与之前的 hook 是否能保持一致性？

[rai-studio-bot]

针对 @SigureMo 的一致性问题，已对照确认：hook 的调用方式和已验证行为保持一致，但检测结果不能保证完全相同，因为同时升级了扫描器版本。

• 旧配置已覆盖上游入口，前后都运行同一个 gitleaks_tracked.py，通过 gitleaks dir --redact --verbose 扫描 tracked-file 快照；always_run、pass_filenames: false、仓库配置及退出码透传均未改变，并非从 staged-only 改为全仓扫描。
• 用旧版 8.24.2 二进制与新版 Python 包入口进行了 13 组对照，文件选择、规则命中、白名单、脱敏和退出码结果一致。新环境提供 python 和 gitleaks，安装来源则改为第三方 PyPI 包，部分平台首次运行需下载二进制。
• 一致性的边界在版本升级：上游内置规则由 8.24.2 的 206 条变为 8.30.1 的 222 条，并有既有规则调整；仓库启用了 useDefault = true，因此某些输入可能产生不同检测结果。上述样例通过不代表两版规则完全等价。

未发现此次环境迁移引入的阻塞问题；当前 CI 全部通过。

^{Powered by Nyanpasu with gpt-6-astra medium, please check the suggestions carefully.}