[bradclawsie]

Description

After running uds run dev-docs, there is a directory uds-docs left behind (that is in .gitignore) that will be scanned by gitleaks via the pre-commit hook invoked by hk. Commits cannot take place since gitleaks will find objectionable matter in uds-docs.

This change causes gitleaks to skip the generated (and .gitignore'd) uds-docs path.
...

Related Issue

Fixes #CLI-321

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps followed

This was tested by running uds run dev-docs and then trying to commit this PR change itself.

[greptile-apps]

Greptile Summary

This PR prevents the local secret-scanning hook from scanning the generated uds-docs workspace.

• Adds a narrowly root-anchored Gitleaks path allowlist for uds-docs/.
• Aligns secret-scanner behavior with the repository’s existing ignore treatment for generated documentation.

Confidence Score: 5/5

The PR appears safe to merge because the exclusion is limited to the generated, gitignored root-level documentation workspace.

The configured path matches the exact workspace created by the documentation tasks, while the anchored expression avoids excluding similarly named paths elsewhere.

Important Files Changed

Filename	Overview
.gitleaks.toml	Adds a root-scoped allowlist for the ignored documentation workspace without affecting other repository paths.

_{Reviews (1): Last reviewed commit: "fix: gitleaks shall ignore uds-docs" | Re-trigger Greptile}

[joelmccoy]

The more clean fix would be to have the hk gitleaks take in files: https://github.com/defenseunicorns/uds-cli/blob/main/hk.pkl#L21

something like this?

check = "gitleaks dir --redact --no-banner --exit-code 1 {{files}}"

[bradclawsie]

The more clean fix would be to have the hk gitleaks take in files: https://github.com/defenseunicorns/uds-cli/blob/main/hk.pkl#L21

something like this?

check = "gitleaks dir --redact --no-banner --exit-code 1 {{files}}"

I'm leaning on Codex here, this is my first contact with gitleaks. It responds:

gitleaks dir accepts a single path. With multiple arguments, Gitleaks 8.30.1 scans
  the first and silently ignores the rest, so:

  gitleaks dir ... {{files}}

  could miss secrets in every changed file after the first.

Suggested alternative in e3e1072 . Let me know what you think.