From 13e349c3abce388650ff109b1ac6001467eb90d9 Mon Sep 17 00:00:00 2001
From: hunterckx <118154470+hunterckx@users.noreply.github.com>
Date: Fri, 13 Nov 2026 14:00:45 -0800
Subject: [PATCH 1/2] chore: add pre-commit config with gitleaks hook (#782)

---
 .pre-commit-config.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 .pre-commit-config.yaml

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 00000000..ae8c0787
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,18 @@
+# Pre-commit hooks for Clever Canary repos.
+# Run `pre-commit install` once per clone to activate.
+#
+# gitleaks is the local secret-scanning layer. The hook runs the gitleaks
+# installed on the machine (brew install gitleaks), and the commit fails
+# when gitleaks is not installed.
+repos:
+  - repo: local
+    hooks:
+      - id: gitleaks
+        name: gitleaks
+        entry: gitleaks git --pre-commit --redact --staged --verbose
+        language: system
+        # Keep `pass_filenames: false`. Without it, pre-commit appends the
+        # staged paths: a commit of one file passes unscanned, and a commit
+        # of two or more files fails.
+        pass_filenames: false
+        stages: [pre-commit]

From 2d0eed2e213be15939fe157c12dedac0cff55c6c Mon Sep 17 00:00:00 2001
From: hunterckx <118154470+hunterckx@users.noreply.github.com>
Date: Fri, 13 Nov 2026 16:57:10 -0800
Subject: [PATCH 2/2] docs: add gitleaks and pre-commit instructions to readme
 (#782)

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 82b6fdbc..7fa0e945 100644
--- a/README.md
+++ b/README.md
@@ -80,6 +80,10 @@ uv run python scripts/validate_outputs.py path/to/metadata.yaml
 
 This validation is crucial for ensuring that the classification output is syntactically correct before it's incorporated into the AnVIL Explorer or Terra Data Repository.
 
+## Development
+
+Gitleaks and Pre-Commit are required in order to perform precommit checks. To install them using Homebrew, run `brew install gitleaks pre-commit`. After making any clone of this repository, run `pre-commit install` to set up precommit hooks.
+
 ## Why This Approach
 
 I'm pattern matching on domain knowledge baked into my training data. When I see `HG00673.paternal.f1_assembly_v1.fa.gz` I know it's a HPRC de novo assembly because I've seen thousands of papers, GitHub repos, and bioinformatics forums that discuss these exact naming conventions. Same with contig lengths — I know chr1 is ~248M in GRCh38 because that fact appears everywhere in the training data.