From cfc92dbb197450ad4a50e4df47bb825b88253d9e Mon Sep 17 00:00:00 2001
From: Nathan Nutter <nnutter@duck.com>
Date: Tue, 3 Nov 2026 11:43:39 -0600
Subject: [PATCH] Add the timber Change-Id hook and the staged secret scan

This repository had no hooks section, so no commit-msg hook ran: a
commit got no Change-Id, unlike every other repository here. It also
inherited gitleaks from the implicit hook, which scans the working
tree and not the bytes that are staged, so a binary file could carry a
secret past the commit.

The pre-commit hook now scans staged bytes, including files whose
diff is binary, and the commit-msg hook runs the timber builtin.
---
 hk.pkl | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/hk.pkl b/hk.pkl
index 68c10f6..8da856c 100644
--- a/hk.pkl
+++ b/hk.pkl
@@ -31,3 +31,28 @@ steps {
   ["trailing_whitespace"] = Hk.trailing_whitespace
   ["yamlfmt"] = Hk.yamlfmt
 }
+
+hooks {
+  ["commit-msg"] {
+    fix = true
+    steps {
+      ["change-id"] = Extra.timber_commit_msg
+    }
+  }
+  ["pre-commit"] {
+    fix = true
+    stage = true
+    stash = "git"
+    steps {
+      // No file filter: scan every staged change, including arbitrary types,
+      // binary files, deletions, and commits without Go or Markdown changes.
+      // The git-mode scan only sees text diffs, so staged binary bytes are
+      // checked out to a temporary directory and scanned explicitly.
+      ["gitleaks"] = (Hk.gitleaks) {
+        scan = "staged"
+        check =
+          "gitleaks git --redact --pre-commit --staged --verbose --no-banner && tmp=$(mktemp -d) || exit $?; trap 'rm -rf \"$tmp\"' EXIT INT TERM; git diff --cached --name-only -z --diff-filter=ACMRT > \"$tmp/list\" || exit $?; git checkout-index -z --stdin --prefix=\"$tmp/tree/\" < \"$tmp/list\" || exit $?; mkdir -p \"$tmp/tree\" || exit $?; gitleaks dir --redact --verbose --no-banner \"$tmp/tree\" || exit $?"
+      }
+    }
+  }
+}