Module guards

Expand description

Guards: named checks over any file in the repository and over commit messages, such as the gate that keeps internal names out of a public package.

Re-exports§

range: What a guard looks at: the index, the commits about to be pushed, or the whole tree.
secrets: Built-in secret patterns. Deliberately narrow: each one is a format with a fixed prefix or header, so a hit is almost always real. Two shapes need a second look: a connection string (scheme://user:password@host) is skipped when its host is an example or loopback host or its password is a placeholder, and a JWT is skipped when it is the well-known jwt.io sample.
terms: Denied terms: gathered from the guard, a file outside the repository, or an environment variable, and matched case-insensitively. Terms are never printed in full.

builtin_secrets: The built-in secret patterns over blobs, with no guard configured: the check spec export always runs. Hits are errors named secrets; matched values are never in the message.
reads_content: Guards that read content for secrets or denied text, the ones an upload must pass.
run: Runs the named guards (all of them when names is empty). A guard without an explicit range uses its own default; a guard with a baseline reports only hits the baseline does not hold.
scan_blobs: Runs the guards pick selects over (label, bytes) about to leave the repository, each with its own settings whatever its paths; deny_files and path patterns read the label. Baselines do not apply, a known hit is still leaving. Each finding names the guard that raised it.
write_baselines: Measures each named guard over the whole tree and writes its baseline file. With write false, only measures: what --write-baseline would record, for its preview.