chore: add pre-commit hooks [MCP-284]

.github/workflows/code-health.yml

@@ -136,3 +136,22 @@ jobs:
         uses: coverallsapp/github-action@v2.3.6
         with:
           file: coverage/lcov.info
+
+  run-git-secrets:
+    name: Run git secrets
+    if: github.event_name == 'push' || (github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+          cache: "npm"
+      - name: Install dependencies
+        run: |
+          sudo apt-get install -y git-secrets
+      - name: Run git-secrets
+        run: git-secrets --register-aws && git-secrets --scan

.husky/pre-commit

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+if [ ! "$(which git-secrets)" ]
+then
+   echo "git-secrets is not installed. Please run 'brew install git-secrets' or visit https://github.com/awslabs/git-secrets#installing-git-secrets"
+   exit 1
+fi
+
+git-secrets --register-aws > /dev/null
+git-secrets --scan

package.json

@@ -35,7 +35,7 @@
   "scripts": {
     "start": "node dist/index.js --transport http --loggers stderr mcp",
     "start:stdio": "node dist/index.js --transport stdio --loggers stderr mcp",
-    "prepare": "npm run build",
+    "prepare": "husky && npm run build",
     "build:clean": "rm -rf dist",
     "build:update-package-version": "tsx scripts/updatePackageVersion.ts",
     "build:esm": "tsc --project tsconfig.esm.json && chmod +x dist/esm/index.js",
@@ -84,6 +84,7 @@
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.4",
     "globals": "^16.3.0",
+    "husky": "^9.1.7",
     "knip": "^5.63.1",
     "mongodb": "^6.19.0",
     "mongodb-runner": "^5.9.2",

tests/integration/fixtures/httpsServerProxyTest.ts

@@ -43,6 +43,8 @@ export class HTTPServerProxyTestSetup {
     }
 
     requests: IncomingMessage[];
+
+    // note: these are self-signed certs for testing purposes, DO NOT use in production
     tlsOptions = Object.freeze({
         key: readFileSync(path.resolve(__dirname, "server.key")),
         cert: readFileSync(path.resolve(__dirname, "server.pem")),