From 058ad4e6ce59881d4c5b175dc73b28808a51cbde Mon Sep 17 00:00:00 2001 From: homin Date: Mon, 14 Sep 2026 14:11:24 -0400 Subject: [PATCH] fix: Use POSIX redirect in pre-commit gitleaks guard `&> /dev/null` is a bashism. Husky runs hooks under `/bin/sh`, so on systems where that is dash the guard parsed as a backgrounded `command -v gitleaks &` followed by a bare `> /dev/null` redirection, whose exit status is always 0. That made the `if` always true, so `gitleaks protect` ran even when gitleaks was not installed and the warning branch was unreachable. This was failing on CI with Linux runners. --- .husky/pre-commit | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.husky/pre-commit b/.husky/pre-commit index 92a3d33ff..072b1d5ed 100644 --- a/.husky/pre-commit +++ b/.husky/pre-commit @@ -1,5 +1,5 @@ # Check for secrets in staged files before committing -if command -v gitleaks &> /dev/null; then +if command -v gitleaks >/dev/null 2>&1; then gitleaks protect --staged --redact --no-banner else echo "WARNING: gitleaks not installed — skipping secret scan. Install via: brew install gitleaks"