sec(pre-commit): scan test files for private keys and drop the dead gitleaks ignore

[cristim]

Summary

Items 1 and 2 of #101.

• .pre-commit-config.yaml: the detect-private-key hook excluded (_test\.go|frontend/src/index\.html)$. No _test.go file in this repo contains a PEM private key (git grep for BEGIN ... PRIVATE KEY), and frontend/ does not exist here, so the exclude only hid future leaks in test fixtures. It is removed; every file is now scanned.
• .gitleaksignore: held one entry for internal/secrets/aws_resolver_httptest_test.go, a path that does not exist in this repo, and nothing runs gitleaks. Nothing references the file (git grep), so it is deleted.

Item 3 (whether to run gitleaks in CI) stays open on #101 as a decision.

Refs #101

Verification

• pre-commit run detect-private-key --all-files passes on the tree.
• Probe: a temporary pkg/zz_probe_test.go containing -----BEGIN RSA PRIVATE KEY----- makes the hook fail ("Private key found"); the file was deleted before committing. Before this change the same file was skipped by the exclude.
• check-yaml passes; commit and pre-push hooks pass.

Local review: non-author review of the 10-line diff, no findings.

🤖 Generated with Claude Code

[cristim]

@coderabbitai review

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 2 billable files and costs up to $0.50.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 45 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 71 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-go/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: b3000ba4-187d-4a16-b622-2d9072610ba7

📥 Commits

Reviewing files that changed from the base of the PR and between 7383c3a and af02798.

📒 Files selected for processing: 2

• .gitleaksignore
• .pre-commit-config.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cristim]

Independent review verdict: CLEAN at 6e041a1

Reviewer: fresh Claude agent (Sonnet, high effort), not the author, cold brief. Coordinator: claude-cc-reviewer.

Blocking findings: none. All three claims in the PR body hold:

• No private keys anywhere: git grep -nE 'BEGIN [A-Z ]*PRIVATE KEY|PuTTY-User-Key-File|BEGIN PGP PRIVATE' finds nothing, including in _test.go files. pre-commit run detect-private-key --all-files passes with the exclude removed.
• No gitleaks use: git grep gitleaks and .github return nothing, so the deleted .gitleaksignore (pointing at a nonexistent path) was dead config.
• No frontend/ here: frontend/ does not exist in this repo, so the index.html exclude was dead too.

The diff against main is only .gitleaksignore (-3) and .pre-commit-config.yaml (+2/-7).

Gate: p3, items 1-2 of #101. Merge once CI is green, in its turn in the go merge order. (claude-cc-reviewer)

[cristim]

Pure rebase onto main after go#487 merged. git range-diff of 6e041a1 against new head af02798 shows the commit identical (=), so the CLEAN verdict carries. (claude-cc-reviewer)