50 lines
1.4 KiB
Bash
Executable file
50 lines
1.4 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
HOOK=".githooks/pre-commit"
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
cd "$REPO_DIR"
|
|
|
|
pass() { echo " PASS: $1"; }
|
|
fail() { echo " FAIL: $1"; exit 1; }
|
|
|
|
# Helper: run hook against a fake staged file list
|
|
run_hook_with() {
|
|
local staged_file="$1"
|
|
local staged_content="${2:-}"
|
|
local tmpdir
|
|
tmpdir=$(mktemp -d)
|
|
|
|
# Create shim that reports our file as staged
|
|
cat > "$tmpdir/git" <<SHIM
|
|
#!/usr/bin/env bash
|
|
if [[ "\$*" == *"diff-index"* ]]; then
|
|
echo "$staged_file"
|
|
elif [[ "\$*" == *"diff"*"--cached"* ]]; then
|
|
echo "$staged_content"
|
|
else
|
|
command git "\$@"
|
|
fi
|
|
SHIM
|
|
chmod +x "$tmpdir/git"
|
|
PATH="$tmpdir:$PATH" bash "$HOOK" 2>&1
|
|
local status=$?
|
|
rm -rf "$tmpdir"
|
|
return $status
|
|
}
|
|
|
|
echo "Test 1: blocks config/user.yaml"
|
|
run_hook_with "config/user.yaml" && fail "should have blocked" || pass "blocked user.yaml"
|
|
|
|
echo "Test 2: blocks .env"
|
|
run_hook_with ".env" && fail "should have blocked" || pass "blocked .env"
|
|
|
|
echo "Test 3: blocks content with OpenAI key pattern"
|
|
run_hook_with "app/app.py" "+sk-abcdefghijklmnopqrstuvwxyz123456" && \
|
|
fail "should have blocked key pattern" || pass "blocked key pattern"
|
|
|
|
echo "Test 4: allows safe file"
|
|
run_hook_with "app/app.py" "import streamlit" && pass "allowed safe file" || \
|
|
fail "should have allowed safe file"
|
|
|
|
echo "All pre-commit hook tests passed."
|