From d91dc0dc5985c865d19a831d567683595dc7a55d Mon Sep 17 00:00:00 2001 From: Justin Bollinger Date: Sat, 25 Jul 2026 17:41:14 -0400 Subject: [PATCH] chore(ci): add detect-private-key pre-commit gate The repo had no secret-scanning gate of any kind: prek.toml carried no detect-private-key/detect-secrets hook, CI had none, and bandit only scans hate_crack/ so it never inspected config files, docs, or fixtures for committed key material. Adds the detect-private-key hook from the pre-commit-hooks remote repo at the pre-commit stage, and records v2.14.3 in the changelog alongside the removal of the published agent tooling. Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 18 ++++++++++++++++++ prek.toml | 5 +++++ 2 files changed, 23 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e64b6b3..f244fe1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 Dates are omitted for releases predating this file; see the git tags for exact timing. +## [2.14.3] - 2026-07-25 + +### Added + +- **Private-key commit gate.** `prek.toml` now runs the `detect-private-key` + hook at the pre-commit stage. The repo previously had no secret-scanning gate + of any kind — bandit only covers `hate_crack/`, so nothing inspected config + files, docs, or test fixtures for committed key material. + +### Removed + +- **Local agent tooling is no longer published.** `CLAUDE.md`, `.claude/`, + `docs/plans/`, and `docs/superpowers/` were development aids rather than part + of the shipped project. They are now gitignored and were removed from the + repository, including from its history. +- **`audit-docs` post-commit hook.** Dropped from `prek.toml` along with the + `.claude/audit-docs.sh` script it invoked. + ## [2.14.2] - 2026-07-25 ### Fixed diff --git a/prek.toml b/prek.toml index 8e163e8..9ce02d2 100644 --- a/prek.toml +++ b/prek.toml @@ -77,3 +77,8 @@ id = "check-merge-conflict" [[repos.hooks]] id = "check-added-large-files" args = ["--maxkb=1024"] + +# Blocks committing PEM/OpenSSH private keys. The repo had no secret-scanning +# gate at all before this; bandit only covers hate_crack/. +[[repos.hooks]] +id = "detect-private-key"