diff --git a/scripts/hooks/pre-bash-commit-quality.js b/scripts/hooks/pre-bash-commit-quality.js index d1839ac9f..c67b0f5a0 100644 --- a/scripts/hooks/pre-bash-commit-quality.js +++ b/scripts/hooks/pre-bash-commit-quality.js @@ -108,6 +108,7 @@ function findFileIssues(filePath) { // Check for hardcoded secrets (basic patterns) const secretPatterns = [ + { pattern: /sk-ant-[a-zA-Z0-9_-]{20,}/, name: 'Anthropic API key' }, { pattern: /sk-[a-zA-Z0-9]{20,}/, name: 'OpenAI API key' }, { pattern: /ghp_[a-zA-Z0-9]{36}/, name: 'GitHub PAT' }, { pattern: /AKIA[A-Z0-9]{16}/, name: 'AWS Access Key' }, diff --git a/tests/hooks/pre-bash-commit-quality.test.js b/tests/hooks/pre-bash-commit-quality.test.js index 7a9cfeb70..b845f9496 100644 --- a/tests/hooks/pre-bash-commit-quality.test.js +++ b/tests/hooks/pre-bash-commit-quality.test.js @@ -212,6 +212,7 @@ if (test('blocks commits with staged secret patterns across checkable files', () inTempRepo(repoDir => { writeAndStage(repoDir, 'index.js', [ "const openai = 'sk-abcdefghijklmnopqrstuvwxyz';", + "const anthropic = 'sk-ant-api03-AbCdEf-GhIjKlMnOpQrStUvWx_Yz012345';", "const token = 'ghp_abcdefghijklmnopqrstuvwxyzABCDEFGHIJ';", '' ].join('\n')); @@ -227,6 +228,7 @@ if (test('blocks commits with staged secret patterns across checkable files', () assert.strictEqual(result.output, input); assert.strictEqual(result.exitCode, 2); assert.ok(stderr.includes('Potential OpenAI API key'), `expected OpenAI secret warning, got: ${stderr}`); + assert.ok(stderr.includes('Potential Anthropic API key'), `expected Anthropic key warning, got: ${stderr}`); assert.ok(stderr.includes('Potential GitHub PAT'), `expected GitHub PAT warning, got: ${stderr}`); assert.ok(stderr.includes('Potential AWS Access Key'), `expected AWS key warning, got: ${stderr}`); assert.ok(stderr.includes('Potential API key'), `expected generic API key warning, got: ${stderr}`);