pre-commit only sees the commit being made, so a key committed with
--no-verify or from a clone without the hooks still reached the
remote. pre-push applies the same rules to every commit being
pushed, not just the tip: a key removed in a later commit still
lands in the remote history.
pre-commit: `grep -q` exited early and, under pipefail, turned a
match into a pass when a long diff followed the key; a config.ini
without an X_KEY line made the hook fail silently.
Block commits whose staged content would leak a BFL API key:
config.ini must keep the your-key placeholder, FluxConfig_BFL nodes in
workflows/*.json must have an empty or bfl_xxx x_key widget, and no
staged addition may match bfl_<16+ chars> key material. Installed via
git config core.hooksPath .githooks (run once per clone).
Çağan Kiraz