diff --git a/.githooks/pre-commit b/.githooks/pre-commit new file mode 100755 index 0000000000000000000000000000000000000000..39148cfc5bc90d6d22f6acbad18f26e6b26771bf --- /dev/null +++ b/.githooks/pre-commit @@ -0,0 +1,127 @@ +#!/bin/bash +# +# An example hook script to verify what is about to be committed. +# Called by "git commit" with no arguments. The hook should +# exit with non-zero status after issuing an appropriate message if +# it wants to stop the commit. +# +# To enable this hook, rename this file to "pre-commit". + +if git rev-parse --verify HEAD >/dev/null 2>&1 +then + against=HEAD +else + # Initial commit: diff against an empty tree object + against=$(git hash-object -t tree /dev/null) +fi + +# If you want to allow non-ASCII filenames set this variable to true. +allownonascii=$(git config --bool hooks.allownonascii) + +# Redirect output to stderr. +exec 1>&2 + +# Cross platform projects tend to avoid non-ASCII filenames; prevent +# them from being added to the repository. We exploit the fact that the +# printable range starts at the space character and ends with tilde. +if [ "$allownonascii" != "true" ] && + # Note that the use of brackets around a tr range is ok here, (it's + # even required, for portability to Solaris 10's /usr/bin/tr), since + # the square bracket bytes happen to fall in the designated range. + test $(git diff --cached --name-only --diff-filter=A -z $against | + LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0 +then + cat <<\EOF +Error: Attempt to add a non-ASCII file name. + +This can cause problems if you want to work with people on other platforms. + +To be portable it is advisable to rename the file. + +If you know what you are doing you can disable this check using: + + git config hooks.allownonascii true +EOF + exit 1 +fi + +# If there are whitespace errors, print the offending file names and fail. +# exec git diff-index --check --cached $against -- + + + +################################################################################ +## Everything below this is customized, everything above is from the example. ## +################################################################################ + +### PREPARE + +# Expand aliases and make alias command work in the bash script. +shopt -s expand_aliases + +REPOPATH="$(git rev-parse --show-toplevel)" +GREP_CMD='grep -Rn --color' +GREP_EXCLUDES="--exclude-dir=\.git --exclude-dir=\.githooks --exclude=*\.example" + +### YAMLLINT stage +STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM) +YAML_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep ".yml$") +if [[ ${YAML_FILES} != "" ]]; then + for file in ${YAML_FILES}; do + yamllint "${file}" + if [[ ${?} -ne 0 ]]; then + exit 1 + fi + done +fi && echo "SUCCESS: Yamllint stage." + +### VAULT detection stage +VAULT_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep ".vault$") +if [[ ${VAULT_FILES} != "" ]]; then + echo "ERROR: Vaultfiles found:" + for file in ${VAULT_FILES}; do + echo "- ${file}" + done + exit 1 +fi +# https://docs.ansible.com/ansible/latest/user_guide/vault.html#vault-format +if [[ ${STAGED_FILES} != "" ]]; then + for file in ${STAGED_FILES}; do + grep -e "\$ANSIBLE_VAULT;[[:digit:]]\.[[:digit:]];AES256" "${file}" + [[ ${?} -eq 0 ]] && echo "ERROR: Ansible-Vault in String found in file '${file}'." && exit 1 + done +fi +echo "SUCCESS: Vault detection stage." + +### URL detection stage +${GREP_CMD} ${GREP_EXCLUDES} -e "http[s]*.*git.*SLUB" -e "http[s]*.*git.*slub" -e "git@" "${REPOPATH}" +if [[ ${?} -eq 0 ]]; then + echo "ERROR: found internal URLs." + exit 1; +fi +echo "SUCCESS: URL detection stage." + +### IP address detection stage +# This is pretty basic regex matching, but it's a start. +IP_REGEX='[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' +${GREP_CMD} ${GREP_EXCLUDES} -e "${IP_REGEX}" "${REPOPATH}" | grep -v "127.0.0" +if [[ ${?} -eq 0 ]]; then + echo "ERROR: found IP address." + exit 1; +fi +echo "SUCCESS: IP address detection stage." + +### SSH-Key detection stage +${GREP_CMD} ${GREP_EXCLUDES} -e "ssh-[dr]sa " "${REPOPATH}" +if [[ ${?} -eq 0 ]]; then + echo "ERROR: found SSH key." + exit 1; +fi +echo "SUCCESS: SSH Key detection stage." + + + + +### DONE +# Return explicit 0. +exit 0;