refactor(security): extract secrets detection into dedicated shell script

.husky/pre-commit

@@ -1,28 +1,3 @@
 # Run lint-staged (lint + test changed files)
 npx lint-staged
-
-# Check for secrets (only if Docker daemon is running)
-if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
-  echo "🔍 Checking for secrets with Gitleaks..."
-  npm run validate:secrets || {
-    echo "⚠️  Secrets detected! Please remove sensitive data before committing."
-    exit 1
-  }
-else
-  # Docker not available - provide helpful hints based on installed alternatives
-  if command -v colima >/dev/null 2>&1; then
-    echo "⚠️  Docker daemon not running - Colima is installed"
-    echo "💡 Run 'colima start' to enable secrets detection locally"
-  elif command -v podman >/dev/null 2>&1; then
-    echo "⚠️  Docker daemon not running - Podman is installed"
-    echo "💡 Run 'podman machine start' to enable secrets detection locally"
-  elif command -v orbstack >/dev/null 2>&1; then
-    echo "⚠️  Docker daemon not running - OrbStack is installed"
-    echo "💡 Start OrbStack to enable secrets detection locally"
-  elif command -v docker >/dev/null 2>&1; then
-    echo "⚠️  Docker installed but daemon not running"
-    echo "💡 Start Docker Desktop to enable secrets detection locally"
-  else
-    echo "⚠️  Docker not available - skipping secrets detection (will run in CI)"
-  fi
-fi
+npm run validate:secrets

package.json

@@ -40,7 +40,7 @@
     "commitlint": "commitlint --edit",
     "commitlint:last": "commitlint --from HEAD~1 --to HEAD --verbose",
     "validate:secrets": "node scripts/validate-secrets.js",
-    "license-check": "node scripts/license-check.js",
+    "license-check": "bash scripts/secrets-check.sh",
     "ci": "npm run license-check && npm run lint && npm run build && npm run test:unit && npm run test:integration",
     "ci:full": "npm run commitlint:last && npm run ci",
     "prepare": "husky",

scripts/secrets-check.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Secrets detection using Gitleaks via Docker or Podman.
+# Usage:
+#   scripts/secrets-check.sh          # scan staged files
+#   scripts/secrets-check.sh --git    # scan full git history
+
+GITLEAKS_IMAGE="ghcr.io/gitleaks/gitleaks:v8.30.1"
+CONTAINER_ENGINE=$(command -v docker 2>/dev/null || command -v podman 2>/dev/null)
+
+if [[ -z "$CONTAINER_ENGINE" ]]; then
+  echo "No suitable container engine found - skipping secrets detection"
+  echo "Install Docker to enable local secrets scanning"
+  exit 1
+fi
+
+if ! $CONTAINER_ENGINE info >/dev/null 2>&1; then
+  if command -v colima >/dev/null 2>&1; then
+    echo "Docker daemon not running - Colima is installed"
+    echo "Run 'colima start' to enable secrets detection locally"
+  elif command -v podman >/dev/null 2>&1; then
+    echo "Docker daemon not running - Podman is installed"
+    echo "Run 'podman machine start' to enable secrets detection locally"
+  elif command -v orbstack >/dev/null 2>&1; then
+    echo "Docker daemon not running - OrbStack is installed"
+    echo "Start OrbStack to enable secrets detection locally"
+  else
+    echo "Container engine found but daemon is not running"
+  fi
+  exit 1
+fi
+
+echo "Checking for secrets with Gitleaks..."
+
+if [[ "$1" == "--git" ]]; then
+  $CONTAINER_ENGINE run --rm -v "$(pwd):/path" "$GITLEAKS_IMAGE" git --no-banner --verbose /path
+else
+  $CONTAINER_ENGINE run --rm -v "$(pwd):/path" "$GITLEAKS_IMAGE" dir --no-banner --verbose /path
+fi
+
+if [[ $? -ne 0 ]]; then
+  echo "Secrets detected! Please remove sensitive data before committing."
+  exit 1
+fi