From 4c7dbb56eb738b9741ce2ca2ce6c1baec49eee2d Mon Sep 17 00:00:00 2001
From: baozaotumao <baozaotumao@gmail.com>
Date: Mon, 1 Jun 2026 21:38:12 -0700
Subject: [PATCH] =?UTF-8?q?fix:=20pre-commit=20=E4=BB=BB=E5=8A=A1=E5=AE=B9?=
 =?UTF-8?q?=E9=94=99=20+=20gitleaks=20=E9=92=A9=E5=AD=90=20+=20pnpm=20?=
 =?UTF-8?q?=E6=9E=84=E5=BB=BA=E9=97=A8=E7=A6=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- _tasks 的 pre-commit install 改为容错：未装时跳过而非让 copier 失败
- .pre-commit-config 增加 gitleaks 钩子（git-workflow/security 规则均已声明）
- 新增 frontend/pnpm-workspace.yaml 的 allowBuilds: esbuild，解决 pnpm 11
  ERR_PNPM_IGNORED_BUILDS 致 install 非零退出而中断生成的问题

端到端验证：copier 退出 0，git/uv.lock/pnpm-lock/node_modules 齐全，
verify.sh 零失败。
---
 copier.yml                                  | 6 +++++-
 template/.pre-commit-config.yaml.jinja      | 6 ++++++
 template/frontend/pnpm-workspace.yaml.jinja | 5 +++++
 3 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 template/frontend/pnpm-workspace.yaml.jinja

diff --git a/copier.yml b/copier.yml
index 0176ecd..3c1444d 100644
--- a/copier.yml
+++ b/copier.yml
@@ -49,7 +49,11 @@ _tasks:
   - command: pnpm install
     working_directory: frontend
     when: "{{ include_frontend }}"
-  - command: "pre-commit install && pre-commit install --hook-type commit-msg"
+  # 未安装 pre-commit 时跳过而非让生成失败（退出码恒 0）
+  - command: >-
+      command -v pre-commit >/dev/null 2>&1
+      && pre-commit install && pre-commit install --hook-type commit-msg
+      || echo '⚠ 未检测到 pre-commit，已跳过钩子安装；请先安装后手动运行：pre-commit install'
 
 # ── 项目基本信息 ────────────────────────────────────────────────────────
 project_name:
diff --git a/template/.pre-commit-config.yaml.jinja b/template/.pre-commit-config.yaml.jinja
index 38c2665..0be158f 100644
--- a/template/.pre-commit-config.yaml.jinja
+++ b/template/.pre-commit-config.yaml.jinja
@@ -11,6 +11,12 @@ repos:
       - id: check-added-large-files
       - id: detect-private-key
 
+  # 密钥扫描（防密钥误入库，配合 detect-private-key）
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.21.2
+    hooks:
+      - id: gitleaks
+
   # 提交信息规范（Conventional Commits）
   - repo: https://github.com/compilerla/conventional-pre-commit
     rev: v3.4.0
diff --git a/template/frontend/pnpm-workspace.yaml.jinja b/template/frontend/pnpm-workspace.yaml.jinja
new file mode 100644
index 0000000..4a0c352
--- /dev/null
+++ b/template/frontend/pnpm-workspace.yaml.jinja
@@ -0,0 +1,5 @@
+# pnpm 10+ 默认拦截依赖的构建脚本（供应链安全）。
+# allowBuilds 显式放行确需构建的包，避免 ERR_PNPM_IGNORED_BUILDS 致 install 非零退出。
+# pnpm 11 用 allowBuilds 取代已废弃的 onlyBuiltDependencies。
+allowBuilds:
+  esbuild: true