🔒 Add git-leaks pre-commit hook for secret detection

.pre-commit-config.yaml

@@ -1,66 +1,6 @@
-default_language_version:
-    # force all unspecified python hooks to run python3
-    python: python3
-exclude: ^build/|CNAME
 repos:
--   repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.28.0  # latest version
     hooks:
-    -   id: check-docstring-first
-    -   id: check-executables-have-shebangs
-    -   id: check-merge-conflict
-    -   id: check-vcs-permalinks
-    -   id: check-yaml
-        exclude: ^(\.config/|lambda_code/takeover/)
-    -   id: debug-statements
-    -   id: end-of-file-fixer
-    -   id: trailing-whitespace
--   repo: https://github.com/asottile/pyupgrade
-    rev: v3.19.1
-    hooks:
-    -   id: pyupgrade
-        args: [--py36-plus]
-        exclude: .\.tf | ^\.github/
--   repo: https://github.com/asottile/add-trailing-comma
-    rev: v3.1.0
-    hooks:
-    -   id: add-trailing-comma
-        args: [--py36-plus]
-        exclude: .\.tf | ^\.github/
--   repo: https://github.com/asottile/reorder_python_imports
-    rev: v3.14.0
-    hooks:
-    -   id: reorder-python-imports
-        args: [--py3-plus]
-        exclude: .\.tf | ^\.github/
--   repo: https://github.com/psf/black
-    rev: 25.1.0
-    hooks:
-    -   id: black
-        args: [--line-length=120]
-        exclude: .\.tf | ^\.github/
--   repo: https://github.com/pycqa/bandit
-    rev: 1.7.4
-    hooks:
-    -   id: bandit
-        exclude: .\.tf | ^\.github/
--   repo: https://github.com/pycqa/prospector
-    rev: v1.16.1
-    hooks:
-    -   id: prospector
-        args:
-          - --zero-exit
-        exclude: .\.tf | ^\.github/
-        additional_dependencies: ["setuptools"]
--   repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.97.4
-    hooks:
-    -   id: terraform_fmt
-    -   id: terraform_checkov
-        args:
-          - --args=--config-file=__GIT_WORKING_DIR__/.config/sast_terraform_checkov_json.yml
-        exclude: .\.py | ^\.github/
-    -   id: terraform_docs
-        args:
-          - "--args=--config=.terraform-docs.yml"
-          - "--args=--lockfile=false"
+      - id: gitleaks
+        args: ['--verbose', '--redact']