Docs›Deploy›Automation & CI

Automation & CI

Catch secrets before they are committed, and again before they are merged.

Git hooks

The commit is the last place a secret is cheap to remove. Pretense writes the hooks for you.

bash
pretense install

That writes a pre-commit and a pre-push hook. If you already manage your own, add the line instead.

bash
# .husky/pre-commit
pretense scan . || exit 1

The exit codes this gate acts on are in the CLI reference.

CI

A hook can be skipped. The pipeline cannot.

yaml
- name: Pretense
  run: |
    npm i -g @pretense/cli
    pretense login --key ${{ secrets.PRETENSE_KEY }}
    pretense scan .

Those first 2 steps are the install and login from the Quickstart.

Do not swap that last line for scan ci

pretense scan ci only inspects git-tracked content. An untracked file is invisible to it, so in a working tree that still has one it reports nothing and exits 0 while those secrets sit on disk. pretense scan . walks the working tree and does not have that hole. The 2 forms also report findings with different exit codes, which the CLI reference lists.

Containers

The same 2 lines, in the image rather than the workflow.

dockerfile
RUN npm i -g @pretense/cli
ENV ANTHROPIC_BASE_URL=http://localhost:9339

The proxy binds loopback inside the container too. The interface it binds is in Configuration. Publish the port only if another container needs to reach it.