Make the remaining pre-commit hooks pass, except markdownlint by NormB · Pull Request #363 · NormB/devstack-core

NormB · 2026-10-15T14:31:01Z

Rebased onto main after #362 and #364 merged (#364 changed the two exception_handlers.py files and test_exception_handlers_unit.py; this branch keeps #364's code, already ruff-formatted). The per-hook table below was measured on b4d4eda before the rebase.

This PR fixes the other failing pre-commit hooks, except markdownlint (see "Not done" below).

Per-hook results, main → this branch (with #362)

Hook	main (`b4d4eda`)	this branch
shellcheck	771 findings in 77 files	pass (#362)
shfmt	cannot parse `configs/redis/scripts/init.sh` (`&>` under `#!/bin/sh`)	pass (#362)
check-shebang-scripts-are-executable	9 files	pass
detect-private-key	1 (`wiki/TLS-Configuration.md`)	pass
trailing-whitespace	4 files rewritten	pass
end-of-file-fixer	22 files rewritten	pass
ruff-format	65 files rewritten (62 after the rebase onto #364)	pass
yamlfmt	10 files rewritten	pass
detect-secrets	108 findings (107 lines) not in the empty baseline	pass when run alone; in a full run it fails only because markdownlint `--fix` shifts Markdown lines first
markdownlint	10,286 findings; `--fix` rewrites 159 files and leaves 3,298	unchanged: 3,298 after `--fix`
all other hooks	pass	pass

Commits

Mark the nine scripts with a shebang as executable: the reference-app init.sh/start.sh entrypoints (the Dockerfiles already chmod +x them), tests/test-vault-function.sh, scripts/add-profile-labels.py, and scripts/lib/service-init-common.sh. The last one is a sourced library. It keeps its shebang because the "Check for bash shebangs" step in test.yml requires one on every .sh file; executing it only defines functions and exits 0.
State 2-space shell indentation in the contributing guide: names the shfmt hook as the source of truth. The same change goes into the wiki copy.
Describe the issued private key without a PEM header in the wiki: an example comment in wiki/TLS-Configuration.md contained -----BEGIN RSA PRIVATE KEY-----... with no key after it.
Strip trailing whitespace and fix file endings: hook output only. git diff -w --ignore-blank-lines is empty, and the wiki mirror check still passes.
Format Python files with the repository's ruff-format hook: the AST is identical for every file, except 4 docstrings on helper (non-route) functions that lose a trailing space. The FastAPI unit tests that CI runs give 193 passed, 52 skipped, 44 deselected before and after, and the API-first app's tests give 12 passed (after the rebase onto Return no exception text or traceback from the FastAPI error handlers #364).
Keep merge keys and folded scalars intact in the yamlfmt hook: changes the hook arguments. It adds drop_merge_tag=true and scan_folded_as_literal=true. Without them yamlfmt rewrites every <<: merge key in docker-compose.yml as !!merge <<: and joins the vault entrypoint onto one line. Both rewrites parse to the same data, but !!merge is unusual YAML that other readers of docker-compose.yml, such as Dependabot, are not known to accept. Nothing is excluded. Drop this commit if you prefer the default output.
Format YAML files with the repository's yamlfmt hook: every changed file loads to the same data with PyYAML, and docker compose config output is identical. yamllint with the lint.yml configuration reports 0 errors before and after (29 warnings before, 28 after).
Record the audited detect-secrets findings in the baseline: generated with detect-secrets scan --baseline .secrets.baseline (1.4.0) and audited with detect-secrets audit; all 108 are marked as not secrets. Audit cannot display the two workflow findings ("Secret not found on line 5"), so those two were marked "is_secret": false by hand. No finding was a real secret.

Not done: markdownlint

markdownlint (v0.38.0 with default rules, --fix) reports 10,286 findings on main. Its --fix rewrites 159 Markdown files and still leaves 3,298: MD013 line-length 2,061, MD040 380, MD036 311, MD029 237, MD024 215, MD051 74, MD050 16, MD033 3, MD041 1. Some of the automatic fixes also change meaning: MD026 removes trailing punctuation from headings, which changes their anchors, and MD010 replaces the tabs in the Makefile example in reference-apps/API_PATTERNS.md, where make requires tabs. The markdown-lint job in lint.yml already says this needs a rule policy (a markdownlint config) and one pass over the corpus before it can be a gate. That is a decision for the maintainer, so this PR leaves the hook as it is.

Until then, a full pre-commit run --all-files also reports detect-secrets as failed: markdownlint --fix runs first and inserts lines in Markdown files, and detect-secrets then updates the recorded line numbers in .secrets.baseline. pre-commit run detect-secrets --all-files on its own passes.

Verification

The offline checks (tests/test-documentation-accuracy.sh, scripts/wiki-mirror.sh --check, scripts/validate-cicd.sh, ./devstack --help and every subcommand's --help, scripts/check-markdown-links.sh, scripts/audit-capabilities.sh, scripts/docs-to-wiki.sh --dry-run, bash -n over all scripts) give the same output on main and on this branch. The one exception is the CI permissions step, which no longer lists non-executable scripts. scripts/validate-cicd.sh reports 1 failed test on both: it runs ShellCheck at default severity on configs/pgbouncer/scripts/init.sh, which has an SC2002 style finding (useless cat) at line 209.
After the rebase: test-documentation-accuracy.sh 12/12, wiki-mirror.sh --check current (16 files), ./devstack --help exit 0, bash -n on 104 scripts with no failures, docker compose config identical to main, and every changed YAML file loads identically to main except .pre-commit-config.yaml (the intended hook arguments). detect-secrets scan --baseline (1.4.0) reproduces the same 108 findings in 70 files at the same line numbers, so the baseline commit is unchanged.
Nothing here needs a live stack beyond what Fix the ShellCheck warnings the pre-commit hook reports #362 lists. The executable-bit change does not affect the images, because each Dockerfile already runs chmod +x on those files.

Pre-commit summary

uvx pre-commit run --all-files on main (b4d4eda, detached):

trim trailing whitespace.................................................Failed
fix end of files.........................................................Failed
check yaml...............................................................Passed
check json...............................................................Passed
check for added large files..............................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check that executables have shebangs.....................................Passed
check that scripts with shebangs are executable..........................Failed
mixed line ending........................................................Passed
detect private key.......................................................Failed
don't commit to branch...................................................Passed
shellcheck...............................................................Failed
shfmt....................................................................Failed
ruff.....................................................................Passed
ruff-format..............................................................Failed
yamlfmt..................................................................Failed
markdownlint.............................................................Failed
docker-compose-check.....................................................Passed
check-env-example........................................................Passed
Detect secrets...........................................................Failed

On this branch:

trim trailing whitespace.................................................Passed
fix end of files.........................................................Passed
check yaml...............................................................Passed
check json...............................................................Passed
check for added large files..............................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check that executables have shebangs.....................................Passed
check that scripts with shebangs are executable..........................Passed
mixed line ending........................................................Passed
detect private key.......................................................Passed
don't commit to branch...................................................Passed
shellcheck...............................................................Passed
shfmt....................................................................Passed
ruff.....................................................................Passed
ruff-format..............................................................Passed
yamlfmt..................................................................Passed
markdownlint.............................................................Failed
docker-compose-check.....................................................Passed
check-env-example........................................................Passed
Detect secrets...........................................................Failed

uvx pre-commit run detect-secrets --all-files on this branch: Detect secrets....Passed.

detect-secrets findings (108)

None is a secret. The reason for each:

Location	Type	Why it is not a secret
`.github/workflows/lint.yml:307`	Secret Keyword	Block of weak-password regex patterns that the workflow searches .env.example for
`.github/workflows/security.yml:275`	Secret Keyword	Block of weak-password regex patterns that the workflow searches .env.example for
`configs/exporters/redis/init.sh:254`	Secret Keyword	Shell check that a password fetched from Vault is not empty or "null"
`configs/forgejo/scripts/forgejo-bootstrap.sh:135`	Secret Keyword	Shell check that a password fetched from Vault is not empty or "null"
`configs/forgejo/scripts/init-approle.sh:229`	Secret Keyword	Shell check that a password fetched from Vault is not empty or "null"
`configs/forgejo/scripts/init.sh:92`	Secret Keyword	Shell check that a password fetched from Vault is not empty or "null"
`configs/mysql/scripts/init-approle.sh:72`	Secret Keyword	Shell check that a password fetched from Vault is not empty or "null"
`configs/mysql/scripts/init.sh:248`	Secret Keyword	Shell check that a password fetched from Vault is not empty or "null"
`configs/pgbouncer/scripts/init.sh:149`	Secret Keyword	Shell check that a password fetched from Vault is not empty or "null"
`configs/profiles/full.env:104`	Secret Keyword	Grafana's documented default admin password for the local stack, not a credential
`configs/profiles/full.env:383`	Secret Keyword	Boolean setting whose name contains "PASSWORD"
`configs/profiles/minimal.env:256`	Secret Keyword	Boolean setting whose name contains "PASSWORD"
`configs/profiles/standard.env:394`	Secret Keyword	Boolean setting whose name contains "PASSWORD"
`configs/redis/scripts/init-approle.sh:67`	Secret Keyword	Shell check that a password fetched from Vault is not empty or "null"
`configs/redis/scripts/init.sh:244`	Secret Keyword	Shell check that a password fetched from Vault is not empty or "null"
`configs/vector/redis-metrics.sh:46`	Secret Keyword	Usage comment with a placeholder password
`docs/CLI_REFERENCE.md:504`	Basic Auth Credentials	Made-up example password in sample output (alphabet run "sTuVwXyZ12345")
`docs/OBSERVABILITY.md:380`	Basic Auth Credentials	Placeholder credential in a documentation example
`docs/QUICK_REFERENCE.md:166`	Basic Auth Credentials	Placeholder credential in a documentation example
`docs/SERVICES.md:662`	Basic Auth Credentials	Placeholder credential in a documentation example
`docs/SERVICES.md:932`	Secret Keyword	Placeholder credential in a documentation example
`docs/SERVICES.md:1040`	Secret Keyword	Placeholder credential in a documentation example
`docs/TLS_CERTIFICATE_MANAGEMENT.md:369`	Basic Auth Credentials	Placeholder credential in a documentation example
`docs/USE_CASES.md:73`	Base64 High Entropy String	Made-up example password in sample output (alphabet run "sTuVwXyZ12345")
`docs/USE_CASES.md:73`	Secret Keyword	Made-up example password in sample output (alphabet run "sTuVwXyZ12345")
`docs/USE_CASES.md:86`	Basic Auth Credentials	Made-up example password in sample output (alphabet run "sTuVwXyZ12345")
`docs/USE_CASES.md:172`	Secret Keyword	Placeholder credential in a documentation example
`docs/USE_CASES.md:254`	Secret Keyword	Placeholder credential in a documentation example
`docs/USE_CASES.md:345`	Secret Keyword	Placeholder credential in a documentation example
`docs/USE_CASES.md:355`	Basic Auth Credentials	Placeholder credential in a documentation example
`docs/USE_CASES.md:367`	Basic Auth Credentials	Placeholder credential in a documentation example
`docs/USE_CASES.md:692`	Basic Auth Credentials	Placeholder credential in a documentation example
`docs/voip/ANSIBLE_DYNAMIC_INVENTORY_POSTGRESQL.md:638`	Secret Keyword	Placeholder credential in a documentation example
`docs/voip/VOIP_INFRASTRUCTURE_ANALYSIS.md:1137`	Secret Keyword	Placeholder credential in a documentation example
`reference-apps/fastapi-api-first/app/services/vault.py:82`	Secret Keyword	Vault secret path or name, not a secret value
`reference-apps/fastapi-api-first/app/utils/logging.py:37`	Secret Keyword	Doctest example input for the redaction helper
`reference-apps/fastapi-api-first/app/utils/logging.py:109`	Basic Auth Credentials	Doctest example input for the redaction helper
`reference-apps/fastapi/README.md:702`	Secret Keyword	Vault secret path or name, not a secret value
`reference-apps/fastapi/app/services/vault.py:82`	Secret Keyword	Vault secret path or name, not a secret value
`reference-apps/fastapi/app/utils/logging.py:37`	Secret Keyword	Doctest example input for the redaction helper
`reference-apps/fastapi/app/utils/logging.py:109`	Basic Auth Credentials	Doctest example input for the redaction helper
`reference-apps/fastapi/tests/conftest.py:49`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_cache_demo_unit.py:193`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_caching.py:224`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_caching.py:259`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_caching.py:260`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_database_demo.py:37`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_database_demo.py:261`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_exception_handlers.py:43`	Secret Keyword	Vault secret path or name, not a secret value
`reference-apps/fastapi/tests/test_exception_handlers.py:114`	Secret Keyword	Vault secret path or name, not a secret value
`reference-apps/fastapi/tests/test_exceptions.py:90`	Secret Keyword	Vault secret path or name, not a secret value
`reference-apps/fastapi/tests/test_exceptions.py:309`	Secret Keyword	Vault secret path or name, not a secret value
`reference-apps/fastapi/tests/test_health_routers.py:151`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_health_routers.py:172`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_redis_cluster.py:34`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_request_validation.py:33`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_routers_unit.py:85`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_routers_unit.py:343`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_routers_unit.py:347`	Secret Keyword	Vault secret path or name, not a secret value
`reference-apps/fastapi/tests/test_routers_unit.py:358`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_vault_service.py:28`	Secret Keyword	Test fixture or mock value
`reference-apps/fastapi/tests/test_vault_service.py:297`	Secret Keyword	Test fixture or mock value
`reference-apps/golang/README.md:164`	Secret Keyword	Placeholder credential in a documentation example
`reference-apps/golang/internal/handlers/cache.go:42`	Secret Keyword	Go code that passes or formats a variable; no literal value
`reference-apps/golang/internal/handlers/database.go:53`	Basic Auth Credentials	Go code that passes or formats a variable; no literal value
`reference-apps/golang/internal/handlers/health.go:87`	Basic Auth Credentials	Go code that passes or formats a variable; no literal value
`reference-apps/golang/internal/handlers/health.go:230`	Secret Keyword	Go code that passes or formats a variable; no literal value
`reference-apps/golang/internal/handlers/messaging.go:40`	Basic Auth Credentials	Go code that passes or formats a variable; no literal value
`reference-apps/golang/internal/handlers/redis_cluster.go:41`	Secret Keyword	Go code that passes or formats a variable; no literal value
`reference-apps/golang/internal/handlers/vault.go:41`	Secret Keyword	Go code that passes or formats a variable; no literal value
`reference-apps/golang/internal/services/vault.go:76`	Secret Keyword	Go code that passes or formats a variable; no literal value
`reference-apps/golang/internal/services/vault.go:90`	Secret Keyword	Go code that passes or formats a variable; no literal value
`reference-apps/nodejs/tests/health.test.js:116`	Secret Keyword	Test fixture or mock value
`reference-apps/nodejs/tests/vault-service.test.js:111`	Secret Keyword	Test fixture or mock value
`reference-apps/typescript-api-first/tests/health.test.ts:137`	Secret Keyword	Test fixture or mock value
`scripts/manage_devstack.py:3009`	Secret Keyword	Python check that a fetched password is not empty or "null"
`tests/test-approle.sh:297`	Secret Keyword	Vault secret path or name, not a secret value
`tests/test-negative.sh:167`	Secret Keyword	Test fixture or mock value
`tests/test-pgbouncer.sh:60`	Secret Keyword	Shell check that a password fetched from Vault is not empty or "null"
`tests/test-postgres-extended.sh:64`	Secret Keyword	Shell check that a password fetched from Vault is not empty or "null"
`tests/test-rollback-complete.sh:310`	Secret Keyword	Test fixture or mock value
`tests/test-rollback-complete.sh:328`	Secret Keyword	Test fixture or mock value
`tests/test-rollback-simple.sh:135`	Secret Keyword	Shell check that a password fetched from Vault is not empty or "null"
`tests/test-rollback.sh:290`	Secret Keyword	Vault secret path or name, not a secret value
`tests/test-rollback.sh:296`	Secret Keyword	Vault secret path or name, not a secret value
`tests/test-vault-extended.sh:114`	Secret Keyword	Vault secret path or name, not a secret value
`wiki/API-Development-Guide.md:424`	Basic Auth Credentials	Placeholder credential in a documentation example
`wiki/Ansible-Dynamic-Inventory-PostgreSQL.md:638`	Secret Keyword	Placeholder credential in a documentation example
`wiki/Backup-and-Restore.md:1137`	Secret Keyword	Placeholder credential in a documentation example
`wiki/CI-CD-Integration.md:293`	Basic Auth Credentials	Placeholder credential in a documentation example
`wiki/CI-CD-Integration.md:531`	Secret Keyword	Placeholder credential in a documentation example
`wiki/CI-CD-Integration.md:533`	Secret Keyword	Placeholder credential in a documentation example
`wiki/Forgejo-Setup.md:33`	Secret Keyword	Placeholder credential in a documentation example
`wiki/Health-Monitoring.md:378`	Basic Auth Credentials	Placeholder credential in a documentation example
`wiki/MongoDB-Operations.md:157`	Basic Auth Credentials	Placeholder credential in a documentation example
`wiki/MongoDB-Operations.md:379`	Secret Keyword	Placeholder credential in a documentation example
`wiki/MongoDB-Operations.md:396`	Secret Keyword	Placeholder credential in a documentation example
`wiki/MongoDB-Operations.md:407`	Secret Keyword	Placeholder credential in a documentation example
`wiki/MongoDB-Operations.md:467`	Secret Keyword	Placeholder credential in a documentation example
`wiki/MongoDB-Operations.md:477`	Secret Keyword	Placeholder credential in a documentation example
`wiki/MongoDB-Operations.md:539`	Secret Keyword	Placeholder credential in a documentation example
`wiki/MySQL-Operations.md:1815`	Secret Keyword	Placeholder credential in a documentation example
`wiki/PgBouncer-Usage.md:483`	Secret Keyword	Placeholder credential in a documentation example
`wiki/PgBouncer-Usage.md:498`	Basic Auth Credentials	Placeholder credential in a documentation example
`wiki/Port-Reference.md:62`	Basic Auth Credentials	Placeholder credential in a documentation example
`wiki/Service-Overview.md:661`	Basic Auth Credentials	Placeholder credential in a documentation example
`wiki/Service-Overview.md:931`	Secret Keyword	Placeholder credential in a documentation example
`wiki/Service-Overview.md:1039`	Secret Keyword	Placeholder credential in a documentation example

The check-shebang-scripts-are-executable hook reported nine files that start with `#!` but were committed without the executable bit: - reference-apps/{fastapi,fastapi-api-first,golang}/{init,start}.sh: container entrypoints. Each Dockerfile copies them and runs `chmod +x` before using them as CMD, so the image is unchanged; the repository now matches. - tests/test-vault-function.sh: a standalone diagnostic that runs Vault credential lookups when executed. - scripts/add-profile-labels.py: a command-line script with a python3 shebang and a main entry point. - scripts/lib/service-init-common.sh: a library the init-approle.sh scripts source. Its shebang stays because the "Check for bash shebangs" step in .github/workflows/test.yml requires one on every .sh file, and it marks the dialect for editors and ShellCheck. Executing it directly only defines variables and functions and exits 0.

.github/CONTRIBUTING.md asked for 4-space indentation in shell scripts, but the shfmt hook in .pre-commit-config.yaml runs `shfmt -i 2 -ci -sr` and every script is formatted with it. The guide now states 2 spaces and names the hook as the source of truth, with the command that applies it. wiki/Contributing-Guide.md, the wiki copy that scripts/docs-to-wiki.sh makes of this file, gets the same change.

wiki/TLS-Configuration.md showed the output of `vault write pki_int/issue/...` as comment lines, one of them `# private_key: -----BEGIN RSA PRIVATE KEY-----...`. No key follows the header, but the detect-private-key hook matches the header text and fails. That line now reads `# private_key: <PEM-encoded RSA private key>`.

Output of the trailing-whitespace and end-of-file-fixer hooks, run with the repository's configuration: - trailing-whitespace removed trailing spaces in docs/OBSERVABILITY.md and in three wiki pages (API-Development-Guide, CI-CD-Integration, Health-Monitoring). Markdown line breaks (two trailing spaces) are kept by the hook's --markdown-linebreak-ext=md setting. - end-of-file-fixer gave 22 files exactly one final newline: 15 Markdown pages under docs/ and wiki/, six Grafana dashboards under configs/grafana/dashboards/ and reference-apps/shared/openapi.json. `git diff -w --ignore-blank-lines` is empty for this commit, and scripts/wiki-mirror.sh --check still reports the mirror as current.

Output of the ruff-format hook (ruff v0.1.9, as pinned in .pre-commit-config.yaml) over all Python files: 62 files reformatted, 17 already formatted. No other change. Checks: - The AST of every Python file is identical before and after, except four docstrings in reference-apps/fastapi/app/routers/health.py that lose a trailing space ("Check MySQL connectivity " and the MongoDB, Redis cluster and RabbitMQ equivalents). These belong to helper functions, not routes, so the OpenAPI output is unchanged. - The ruff lint hook still passes. - The FastAPI unit tests that CI runs (pytest tests/ --ignore=tests/test_integration.py -k "not integration") give 193 passed, 52 skipped, 44 deselected, and the API-first app's tests give 12 passed, both before and after.

With only retain_line_breaks=true, yamlfmt v0.10.0 rewrote every `<<: *anchor` merge key in docker-compose.yml as `!!merge <<: *anchor` and joined the lines of folded (`>`) scalars, turning the multi-line vault entrypoint into one line. Both rewrites parse to the same data, but the explicit merge tag is unusual YAML that other readers of docker-compose.yml, such as Dependabot, are not known to accept. Two formatter options turn these rewrites off: - drop_merge_tag=true keeps merge keys as `<<:`. - scan_folded_as_literal=true keeps the line breaks inside folded scalars. The `>` indicator stays, so the value is unchanged. The hook still runs on every YAML file; nothing is excluded.

Output of the yamlfmt hook over all YAML files, plus one hand edit: - yamlfmt pads end-of-line comments with one space (`key: value # c` instead of aligned columns), drops the `---` document start in configs/prometheus/rules/devstack-alerts.yml and writes the x-init-library anchor in docker-compose.yml on one line. - configs/prometheus/prometheus.yml had two comment lines after the reference-api job's static_configs that yamlfmt re-indented under the targets list. They now sit above the job they describe. Checks: every changed file loads to the same data with PyYAML before and after; `docker compose config` prints the same output; yamllint with the configuration from .github/workflows/lint.yml reports no errors before or after (29 warnings before, 28 after).

.secrets.baseline had no results, so the detect-secrets hook (v1.4.0) failed on every file it flagged. Each of the 108 findings in 70 files was read; none is a credential: - 56 are code or tests: shell checks such as `[ "$REDIS_PASSWORD" = "null" ]`, Go and Python code that formats a connection string from variables or reads a `secret_path`, and mock values in unit tests (test_pass, secret123, testpass, pw). - 46 are documentation examples: placeholder connection strings and passwords (password, PASSWORD, USER:PASS, CHANGE_ME, your_password, SecurePass123!, the obviously made-up Hx7kL9mNpQr2sTuVwXyZ12345 in docs/USE_CASES.md and docs/CLI_REFERENCE.md) and the Python doctest examples in app/utils/logging.py. - 4 are configuration keywords: ALLOW_WEAK_PASSWORDS=true in the three profile files and GRAFANA_ADMIN_PASSWORD=admin in configs/profiles/full.env, Grafana's documented default for the local stack. - 2 are the `run: |` blocks in .github/workflows/lint.yml and security.yml that list weak-password patterns ("password=password") to search .env.example for. The baseline was regenerated with `detect-secrets scan --baseline .secrets.baseline` (1.4.0) and audited with `detect-secrets audit`, marking 106 findings as not secrets. Audit cannot display the two workflow findings ("Secret not found on line 5"), so those two were marked `"is_secret": false` by hand. A rescan reproduces the same results.

NormB added 8 commits October 15, 2026 10:56

NormB force-pushed the fix/pre-commit-hooks branch from 5dc0c5e to dc46857 Compare October 15, 2026 14:59

NormB merged commit 40d8b32 into main Oct 15, 2026
32 checks passed

NormB deleted the fix/pre-commit-hooks branch October 15, 2026 15:07

Navigation Menu

Repository navigation

Make the remaining pre-commit hooks pass, except markdownlint - #363

Make the remaining pre-commit hooks pass, except markdownlint#363
NormB merged 8 commits into
mainfrom
fix/pre-commit-hooks

NormB commented Oct 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

NormB commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Per-hook results, main → this branch (with #362)

Commits

Not done: markdownlint

Verification

Pre-commit summary

detect-secrets findings (108)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

NormB commented Oct 15, 2026 •

edited

Loading