Add detect-secrets

.secrets.baseline

@@ -0,0 +1,127 @@
+{
+  "version": "1.5.0",
+  "plugins_used": [
+    {
+      "name": "ArtifactoryDetector"
+    },
+    {
+      "name": "AWSKeyDetector"
+    },
+    {
+      "name": "AzureStorageKeyDetector"
+    },
+    {
+      "name": "Base64HighEntropyString",
+      "limit": 4.5
+    },
+    {
+      "name": "BasicAuthDetector"
+    },
+    {
+      "name": "CloudantDetector"
+    },
+    {
+      "name": "DiscordBotTokenDetector"
+    },
+    {
+      "name": "GitHubTokenDetector"
+    },
+    {
+      "name": "GitLabTokenDetector"
+    },
+    {
+      "name": "HexHighEntropyString",
+      "limit": 3.0
+    },
+    {
+      "name": "IbmCloudIamDetector"
+    },
+    {
+      "name": "IbmCosHmacDetector"
+    },
+    {
+      "name": "IPPublicDetector"
+    },
+    {
+      "name": "JwtTokenDetector"
+    },
+    {
+      "name": "KeywordDetector",
+      "keyword_exclude": ""
+    },
+    {
+      "name": "MailchimpDetector"
+    },
+    {
+      "name": "NpmDetector"
+    },
+    {
+      "name": "OpenAIDetector"
+    },
+    {
+      "name": "PrivateKeyDetector"
+    },
+    {
+      "name": "PypiTokenDetector"
+    },
+    {
+      "name": "SendGridDetector"
+    },
+    {
+      "name": "SlackDetector"
+    },
+    {
+      "name": "SoftlayerDetector"
+    },
+    {
+      "name": "SquareOAuthDetector"
+    },
+    {
+      "name": "StripeDetector"
+    },
+    {
+      "name": "TelegramBotTokenDetector"
+    },
+    {
+      "name": "TwilioKeyDetector"
+    }
+  ],
+  "filters_used": [
+    {
+      "path": "detect_secrets.filters.allowlist.is_line_allowlisted"
+    },
+    {
+      "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
+      "min_level": 2
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_indirect_reference"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_likely_id_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_lock_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_potential_uuid"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_sequential_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_swagger_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_templated_secret"
+    }
+  ],
+  "results": {},
+  "generated_at": "2025-11-30T00:20:37Z"
+}

checks.sh

@@ -49,6 +49,24 @@ install_package(){
     echo "Done."
 }
 
+detect_secrets(){
+    echo "Running detect secrets..."
+    poetry run which detect-secrets-hook >/dev/null
+    exit_code=$?
+    if [[ $exit_code != 0 ]]
+    then 
+        install_package
+    fi
+    poetry run detect-secrets-hook --baseline .secrets.baseline
+    exit_code=$?
+    if [[ $exit_code != 0 ]]
+    then
+        echo "Detect Secrets failed!"
+        exit $exit_code 
+    fi
+    echo "Done."
+}
+
 autoflake_check(){
     echo "Running autoflake..."
     poetry run which autoflake > /dev/null
@@ -184,6 +202,7 @@ pre_commit(){
     DEBUG_FLAG="$1"
     TESTS_FLAG="$2"
     shift 2
+    detect_secrets
     autoflake_check --in-place $*
     black_check $*
     isort_check $*
@@ -196,6 +215,7 @@ pre_commit(){
 }
 
 pre_merge(){
+    detect_secrets
     autoflake_check --check $* .
     black_check --check $*
     isort_check --check-only $*
@@ -210,6 +230,7 @@ help(){
 
     COMMAND:
         install|setup   Install package.
+        *secret*        Perform detect secrets check.
         autoflake       Perform autoflake check.
         black           Perform black formatter check.
         isort           Perform isort import check.
@@ -265,6 +286,10 @@ case $CMD in
         install_package
         exit 0
         ;;
+    *secret*)
+        detect_secrets
+        exxit 0
+        ;;
     autoflake)
         autoflake_check --in-place $*
         exit 0