CredScan as a pre-commit git hook

[nikithauc]

[zengin]

Should this be called "CredScan as a PR gate" instead? As far as I understand, pre-commit hook is a dev setup thing. Unless this issue refers to something else that I am not aware of..

cc: @MIchaelMainer

[MIchaelMainer]

PR is too late, secrets are already pushed to public, threat actors may have already consumed them. This is a dev setup thing. Now to think of it, not really a work item JS repo.

[zengin]

@MIchaelMainer we are adding it as a gate too in Raptor in case the secrets slip through from the dev setup: https://github.com/microsoftgraph/msgraph-sdk-raptor/pull/955.

[MIchaelMainer]

Yes, as a gate, that's good. I still want everyone running CredScan locally. ☺️

[nikithauc]

pre-commit hook + gate then?

[zengin]

I'd say yes. One is to prevent it from happening, the other is to catch if it happens. I think we have a way to catch it after the check-in by default security scanning tools, but the earlier we catch, the better.

[zengin]

That said, as @MIchaelMainer said, "pre-commit hook" is not really a work item specific to the repo.

[MIchaelMainer]

@zengin Yes, we should also have this as PR gate.