OpenMRS-Brain

Security — Secret Scanning

This repo uses gitleaks to prevent secrets from being committed. It runs at two levels:

Layer	When	How
Pre-commit hook	Every local git commit	gitleaks detect --staged via pre-commit
CI (GitHub Actions)	Every push & PR	gitleaks/gitleaks-action@v2

Local Setup (one-time)

# 1. Install gitleaks
brew install gitleaks

# 2. Install the pre-commit framework
pip install pre-commit

# 3. Activate the hook for this repo
pre-commit install

After this, gitleaks will automatically scan staged changes before every commit. To run a manual scan of all files:

pre-commit run gitleaks --all-files

Configuration

• .gitleaks.toml — allowlist for false positives (e.g. .env.example placeholder tokens)
• .pre-commit-config.yaml — pre-commit hook definition
• .github/workflows/gitleaks.yml — CI workflow