chore: add pre-commit config with gitleaks hook (#782)

.pre-commit-config.yaml

@@ -0,0 +1,18 @@
+# Pre-commit hooks for Clever Canary repos.
+# Run `pre-commit install` once per clone to activate.
+#
+# gitleaks is the local secret-scanning layer. The hook runs the gitleaks
+# installed on the machine (brew install gitleaks), and the commit fails
+# when gitleaks is not installed.
+repos:
+  - repo: local
+    hooks:
+      - id: gitleaks
+        name: gitleaks
+        entry: gitleaks git --pre-commit --redact --staged --verbose
+        language: system
+        # Keep `pass_filenames: false`. Without it, pre-commit appends the
+        # staged paths: a commit of one file passes unscanned, and a commit
+        # of two or more files fails.
+        pass_filenames: false
+        stages: [pre-commit]

README.md

@@ -80,6 +80,10 @@ uv run python scripts/validate_outputs.py path/to/metadata.yaml
 
 This validation is crucial for ensuring that the classification output is syntactically correct before it's incorporated into the AnVIL Explorer or Terra Data Repository.
 
+## Development
+
+Gitleaks and Pre-Commit are required in order to perform precommit checks. To install them using Homebrew, run `brew install gitleaks pre-commit`. After making any clone of this repository, run `pre-commit install` to set up precommit hooks.
+
 ## Why This Approach
 
 I'm pattern matching on domain knowledge baked into my training data. When I see `HG00673.paternal.f1_assembly_v1.fa.gz` I know it's a HPRC de novo assembly because I've seen thousands of papers, GitHub repos, and bioinformatics forums that discuss these exact naming conventions. Same with contig lengths — I know chr1 is ~248M in GRCh38 because that fact appears everywhere in the training data.