chore(security): add pre-commit check for specific vocab

[etiennej70]

PR Description

What this PR Provides

This pull request introduces a pre-commit hook to block commits containing certain rejected vocabulary terms. The hook uses a new shell script that scans staged files for any terms listed in a maintained reject list, ensuring that problematic or undesired terms do not enter the codebase.

Pre-commit hook for rejected vocabulary enforcement:

• Added a new pre-commit hook to .pre-commit-config.yaml that runs a script to check for rejected vocabulary terms in staged files, excluding the reject list itself.
• Implemented the scripts/check-rejected-terms.sh script, which scans staged files for case-insensitive, substring matches of terms listed in .vale/styles/config/vocabularies/IDP/reject.txt and blocks the commit if any are found.

Fixes

• fixes unexpected sensitive push without disclosing them

Review

The reviewer must double-check these points:

• The reviewer has tested the feature
• The reviewer has reviewed the implementation of the feature

How to test

• Try to add sensitive information from the internal env
• See pre-commit stage failing

Breaking changes (if any)

• N/A

[github-code-quality]

Code Coverage Overview

Languages: Java

Java / code-coverage/jacoco

The overall coverage remains at 90%, unchanged from the main branch.

---

_{Updated July 17, 2026 14:26 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[Copilot]

Pull request overview

Adds a new local pre-commit hook to prevent committing rejected vocabulary terms (as maintained in the Vale reject list), by scanning staged files via a dedicated script.

Changes:

• Added scripts/check-rejected-terms.sh to scan hook-provided staged files for case-insensitive, substring matches against the Vale reject list.
• Introduced a new Vale reject vocabulary list at .vale/styles/config/vocabularies/IDP/reject.txt.
• Registered a new local pre-commit hook in .pre-commit-config.yaml to run the script (excluding the reject list file itself).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
scripts/check-rejected-terms.sh	Implements the staged-file scanning logic against the Vale reject vocabulary.
.vale/styles/config/vocabularies/IDP/reject.txt	Adds the initial set of rejected terms for enforcement.
.pre-commit-config.yaml	Wires the new rejected-terms check into the pre-commit workflow.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud