feat(zenable): migrate from zenable-mcp to compiled CLI

[JonZeolla]

Summary

• Replace uvx zenable-mcp@latest with the compiled Zenable CLI binary from cli.zenable.app
• Auto-install the CLI during cookiecutter generation (non-interactive, curl/wget fallback)
• Fix trufflehog pre-commit hook to work in git worktrees by resolving repo root via git-common-dir

Test plan

• Generate a new project with cookiecutter and verify zenable CLI is auto-installed
• Verify zenable install runs and configures IDE integrations
• Run pre-commit run --all-files to verify all hooks pass
• Test on a machine without zenable pre-installed to verify the install script flow

🤖 Generated with Claude Code

[ai-coding-guardrails]

I've got 2 comments for you to consider

Reviewed with 🤟 by Zenable

[ai-coding-guardrails]

The --branch flag passed to trufflehog may not correctly scope the scan. When HEAD is detached (e.g., in CI), git rev-parse --abbrev-ref HEAD returns HEAD literally, which trufflehog may interpret incorrectly. Also, the --since-commit main~1 combined with --branch could cause issues if main doesn't exist in the current context (e.g., a fresh worktree or shallow clone).

Consider using --since-commit HEAD~1 instead of main~1 to avoid dependency on the main branch existing locally, or guard against detached HEAD:

Suggested change

	entry: bash -c 'trufflehog git "file://$(cd "$(git rev-parse --git-common-dir)/.." && pwd)" --branch "$(git rev-parse --abbrev-ref HEAD)" --since-commit main~1 --no-verification --fail'
	entry: bash -c 'BRANCH=$(git rev-parse --abbrev-ref HEAD); [ "$BRANCH" = "HEAD" ] && BRANCH=$(git rev-parse HEAD); trufflehog git "file://$(cd "$(git rev-parse --git-common-dir)/.." && pwd)" --branch "$BRANCH" --since-commit HEAD~1 --no-verification --fail'

Why did I show this?

Category: bug
Comment Quality: high

Based on general best practices

Tools used:

1. get_file_lines, {'file_path': '.github/linters/lychee.toml', 'start_line': '1', 'end_line': '200'}
2. get_file_lines, {'file_path': '.github/linters/cspell.config.js', 'start_line': '1', 'end_line': '200'}
3. list_changed_files, {'pattern': '**/cookiecutter*'}
4. list_changed_files, {'pattern': ''}
5. get_file_lines, {'file_path': 'hooks/post_gen_project.py', 'start_line': '1', 'end_line': '200'}
6. get_file_lines, {'file_path': 'hooks/post_gen_project.py', 'start_line': '201', 'end_line': '380'}

[JonZeolla]

Automated Message

Addressed in b9974e1