Add pre-commit configuration and instructions

.gitleaks.toml

@@ -0,0 +1,83 @@
+title = "Gitleaks for Vineyard"
+
+[extend]
+useDefault = true
+
+[[rules]]
+description = "Alibaba AccessKey ID"
+id = "alibaba-access-key-id"
+regex = '''(?i)((LTAI)[a-z0-9]+)'''
+keywords = [
+  "ltai",
+]
+
+[[rules]]
+description = "Alibaba AccessKey ID"
+id = "alibaba-access-id-in-config"
+regex = '''(?i)((access).?id\s*=\s*.+)'''
+keywords = [
+  "access",
+]
+
+[[rules]]
+description = "Alibaba AccessKey ID"
+id = "alibaba-access-key-in-config"
+regex = '''(?i)((access).?key\s*=\s*.+)'''
+keywords = [
+  "access",
+]
+
+[[rules]]
+description = "Alibaba AccessKey ID"
+id = "alibaba-access-secret-in-config"
+regex = '''(?i)((access).?secret\s*=\s*.+)'''
+keywords = [
+  "access",
+  "secret",
+]
+
+[[rules]]
+description = "Alibaba AccessKey ID"
+id = "alibaba-access-key-id-in-config"
+regex = '''(?i)((access).?key.?id\s*=\s*.+)'''
+keywords = [
+  "access",
+]
+
+[rules.allowlist]
+paths = [
+  '''modules/io/python/drivers/io/tests/test_open.py''',
+  '''modules/io/python/drivers/io/tests/test_serialize.py''',
+]
+
+[[rules]]
+description = "Alibaba AccessKey ID"
+id = "alibaba-access-key-secret-in-config"
+regex = '''(?i)((access).?key.?secret\s*=\s*.+)'''
+keywords = [
+  "access",
+  "secret",
+]
+
+[rules.allowlist]
+paths = [
+  '''modules/io/python/drivers/io/tests/test_open.py''',
+  '''modules/io/python/drivers/io/tests/test_serialize.py''',
+]
+
+[[rules]]
+description = "Alibaba AccessKey ID"
+id = "alibaba-secret-access-key-in-config"
+regex = '''(?i)((secret).?access.?key\s*=\s*.+)'''
+keywords = [
+  "access",
+  "secret",
+]
+
+[allowlist]
+paths = [
+  '''build''',
+  '''docs/_build''',
+  '''docs/_templates/footer.html''',
+  '''thirdparty''',
+]

.pre-commit-config.yaml

@@ -0,0 +1,8 @@
+repos:
+  - repo: https://github.com/zricethezav/gitleaks
+    rev: v8.15.0
+    hooks:
+      - id: gitleaks
+        args:
+        - '--verbose'
+

CONTRIBUTING.rst

@@ -47,6 +47,22 @@ starting the implementation. There are often a number of ways to fix a problem
 and it is important to find the right approach before spending time on a PR
 that cannot be merged.
 
+Install pre-commit
+^^^^^^^^^^^^^^^^^^
+
+GraphAr use `pre-commit`_ to ensure no secrets are accidentally committed
+into the Git repository, you could first install  `pre-commit`_ by
+
+.. code:: bash
+
+    pip3 install pre-commit
+
+The configure the necessary pre-commit hooks with
+
+.. code:: bash
+
+    pre-commit install  --install-hooks
+
 Minor Fixes
 ^^^^^^^^^^^^
 
@@ -385,6 +401,8 @@ however, it is not uncommon for the CI infrastructure itself to fail on specific
 platforms ("be red"). It is vital to visually inspect the results of all failed ("red") tests
 to determine whether the failure was caused by the changes in the pull request.
 
+.. _pre-commit: https://pre-commit.com/
+
 .. _Code of Conduct: https://github.com/alibaba/GraphAr/blob/main/CODE_OF_CONDUCT.md
 
 .. _file a bug issue: https://github.com/alibaba/GraphAr/issues/new?assignees=&labels=Bug&template=bug_report.yml&title=%5BBug%5D%3A+%3Ctitle%3E