feat(ENG-13667): adding betterleaks checks to pre-commit hooks and CI

.github/workflows/betterleaks.yaml

@@ -0,0 +1,28 @@
+name: Betterleaks Scan
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - "**"
+jobs:
+  betterleaks:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: dortort/betterleaks-action@v0.1.0
+        id: betterleaks
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: betterleaks-report
+          path: ${{ steps.betterleaks.outputs.report-path }}

.pre-commit-config.yaml

@@ -1,71 +1,76 @@
 # Pre-Commit hooks
 # See: https://pre-commit.com/hooks.html
 repos:
-- repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v5.0.0
-  hooks:
-  - id: check-added-large-files
-  - id: check-ast
-  - id: check-builtin-literals
-  - id: check-byte-order-marker
-  - id: check-json
-  - id: check-merge-conflict
-  - id: check-symlinks
-  - id: check-yaml
-  - id: debug-statements
-  - id: detect-aws-credentials
-    args: ['--allow-missing-credentials']
-  - id: detect-private-key
-    exclude: >
-      (?x)^(
-        .bumpversion.cfg
-      )$
-  - id: end-of-file-fixer
-    exclude: >
-      (?x)^(
-        \.bumpversion\.cfg
-      )$
-  - id: forbid-new-submodules
-  - id: name-tests-test
-    args: ['--django']
-    exclude: >
-      (?x)^(
-        cloudsmith/.*/tests/apps\.py|
-        cloudsmith/.*/tests/enums\.py|
-        cloudsmith/.*/tests/factories\.py|
-        cloudsmith/.*/tests/forms\.py|
-        cloudsmith/.*/tests/models\.py|
-        cloudsmith/.*/tests/mixins\.py|
-        cloudsmith_cli/.*/tests/utils\.py|
-        cloudsmith/.*/tests/views\.py
-      )$
-  - id: trailing-whitespace
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: check-added-large-files
+      - id: check-ast
+      - id: check-builtin-literals
+      - id: check-byte-order-marker
+      - id: check-json
+      - id: check-merge-conflict
+      - id: check-symlinks
+      - id: check-yaml
+      - id: debug-statements
+      - id: detect-aws-credentials
+        args: ['--allow-missing-credentials']
+      - id: detect-private-key
+        exclude: >
+          (?x)^(
 
-- repo: https://github.com/asottile/pyupgrade
-  rev: v3.21.2
-  hooks:
-  - id: pyupgrade
-    args: [--py310-plus]
+            .bumpversion.cfg
+          )$
 
+      - id: end-of-file-fixer
+        exclude: >
+          (?x)^(
 
-- repo: https://github.com/zizmorcore/zizmor-pre-commit
-  rev: v1.20.0
-  hooks:
-  - id: zizmor
+            \.bumpversion\.cfg
+          )$
 
-- repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: v0.16.1
-  hooks:
-    - id: ruff-format
-      args: ['--check']
-    - id: ruff-check
-      # excluding tests until all lints pass
-      args:
-      - '--output-format=github'
-      - '--exclude=cloudsmith_cli/cli/tests'
-      - '--exclude=cloudsmith_cli/core/tests'
+      - id: forbid-new-submodules
+      - id: name-tests-test
+        args: ['--django']
+        exclude: >
+          (?x)^(
 
-- repo: https://github.com/crate-ci/typos
-  rev: v1.42.1
-  hooks:
-    - id: typos
+            cloudsmith/.*/tests/apps\.py|
+            cloudsmith/.*/tests/enums\.py|
+            cloudsmith/.*/tests/factories\.py|
+            cloudsmith/.*/tests/forms\.py|
+            cloudsmith/.*/tests/models\.py|
+            cloudsmith/.*/tests/mixins\.py|
+            cloudsmith_cli/.*/tests/utils\.py|
+            cloudsmith/.*/tests/views\.py
+          )$
+
+      - id: trailing-whitespace
+  - repo: https://github.com/asottile/pyupgrade
+    rev: v3.21.2
+    hooks:
+      - id: pyupgrade
+        args: [--py310-plus]
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.20.0
+    hooks:
+      - id: zizmor
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.16.1
+    hooks:
+      - id: ruff-format
+        args: ['--check']
+      - id: ruff-check
+        # excluding tests until all lints pass
+        args:
+          - '--output-format=github'
+          - '--exclude=cloudsmith_cli/cli/tests'
+          - '--exclude=cloudsmith_cli/core/tests'
+  - repo: https://github.com/crate-ci/typos
+    rev: v1.42.1
+    hooks:
+      - id: typos
+  - repo: https://github.com/betterleaks/betterleaks
+    rev: v1.7.4
+    hooks:
+      - id: betterleaks