The repo had no secret-scanning gate of any kind: prek.toml carried no
detect-private-key/detect-secrets hook, CI had none, and bandit only
scans hate_crack/ so it never inspected config files, docs, or fixtures
for committed key material.
Adds the detect-private-key hook from the pre-commit-hooks remote repo
at the pre-commit stage, and records v2.14.3 in the changelog alongside
the removal of the published agent tooling.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
CLAUDE.md, the .claude/ directory, and the agent-generated planning docs
under docs/plans/ and docs/superpowers/ are local development aids, not
part of the shipped project. Untrack them and add them to .gitignore so
they stay local.
Drops the post-commit audit-docs hook from prek.toml, since the script it
invoked (.claude/audit-docs.sh) is no longer part of the repo.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds the gates the hashview repo runs, adapted to hate_crack's uv toolchain:
- ruff format --check as a CI step + a ruff-format prek pre-push hook
(the package was reformatted in the preceding commit).
- Bandit SAST vs a committed baseline (.bandit-baseline.json, 114 reviewed
low-severity subprocess/shlex findings); [tool.bandit] config in
pyproject.toml; CI job + prek pre-push hook. Only NEW findings fail.
- pip-audit dependency-CVE gate (CI job). PYSEC-2026-2447 (diskcache 5.6.3,
transitive via instructor -> atomic-agents) is ignored — no upstream fix.
- Hygiene pre-commit hooks (trailing-whitespace, end-of-file-fixer, check-yaml,
check-merge-conflict, check-added-large-files) via the pre-commit-hooks repo.
- CLAUDE.md updated: lint/security commands, prek install (+pre-commit hook
type), and the active-hooks list.
Co-Authored-By: Claude <noreply@anthropic.com>
The hook was forcing Lima VM tests on every push, causing 5-minute timeouts
when limactl has to download the Ubuntu cloud image. The test already has a
skip guard - remove the env var from the hook entry so it stays opt-in.
The old commands = [...] format was a custom schema prek no longer
supports. Rewrite as local-repo hooks (language: system, always_run:
true) matching the pre-commit config schema prek 0.3.3 expects.
Hooks are identical: ruff, ty, pytest, pytest-lima (pre-push) and
audit-docs (post-commit).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add Ubuntu 24.04 Lima VM test track that runs hate_crack installation
end-to-end in a real VM, giving higher confidence than Docker-based tests.
- Add lima/hate-crack-test.yaml: Ubuntu 24.04 VM config with hashcat and
build deps pre-installed via apt; uv installed via official installer
- Add tests/test_lima_vm_install.py: mirrors Docker E2E test structure;
uses rsync with targeted excludes (wordlists, compiled host binaries)
and builds wheel directly to avoid setuptools-scm sdist file filtering
- Fix Makefile: add princeprocessor build step with aarch64-compatible
CFLAGS (drops -m64); copy binary to submodule root for vendor-assets
- Add Lima tests to prek.toml pre-push hook
- Document Lima VM tests in TESTING.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove 6 duplicate per-version pytest workflows (matrix build covers all)
- Pin GitHub Actions to SHA hashes with version comments
- Add persist-credentials: false to checkout steps
- Replace mypy with ty for type checking (faster, stricter)
- Pin dev deps to exact versions (ty==0.0.17, ruff==0.15.1, pytest==9.0.2, pytest-cov==7.0.0)
- Remove types-* stub packages (ty doesn't need them)
- Remove stale [dependency-groups] section from pyproject.toml
- Update shell scripts to use set -euo pipefail
- Add prek.toml for git hook management (pre-push, post-commit)
- Add lint-infra.yml workflow (shellcheck + actionlint)
- Fix actionlint warning: pass github.head_ref through env var
- Track CLAUDE.md and .claude/ scripts in git
- Update README.md and Makefile references from mypy to ty
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
