Modular Git Hooks (Pick-and-Choose)

#!/usr/bin/env bash
# Reject staged changes that add Git conflict markers.
set -euo pipefail

# Staged files (Added/Copied/Modified), NUL-safe for paths with spaces.
# --no-renames lists a renamed file under its new name instead of leaving it out.
files=()
while IFS= read -r -d '' f; do files+=("$f"); done \
  < <(git diff --cached --name-only --no-renames --diff-filter=ACM -z)
[ ${#files[@]} -eq 0 ] && exit 0

# Look at added lines only ('^+') for the unambiguous markers.
# (======= is intentionally omitted to avoid Markdown/asciidoc false positives.)
hits="$(git diff --cached --no-renames -U0 --no-color -- "${files[@]}" \
        | grep -nE '^\+(<<<<<<<|>>>>>>>)' || true)"

if [ -n "$hits" ]; then
  echo "❌ Merge conflict markers found in staged changes:" >&2
  echo "$hits" >&2
  echo "   Resolve the conflict before committing (or 'git commit --no-verify' to bypass)." >&2
  exit 1
fi
exit 0

#!/usr/bin/env bash
# Reject staged build artifacts and log files.
set -euo pipefail

# Maven's target/ output and any .log file (skaffold.log, verify.log, ...), but not a
# source package that happens to be named target (src/main/java/.../target/).
# --no-renames lists a renamed file under its new name instead of leaving it out.
blocked="$(git diff --cached --name-only --no-renames --diff-filter=ACM \
           | grep -E '(^|/)target/|\.log$' | grep -vE '(^|/)src/(.*/)?target/' || true)"

if [ -n "$blocked" ]; then
  echo "❌ Refusing to commit build artifacts / logs:" >&2
  echo "$blocked" | sed 's/^/   - /' >&2
  echo "   Unstage them ('git restore --staged <file>') and add them to .gitignore." >&2
  echo "   To bypass for one commit: git commit --no-verify" >&2
  exit 1
fi
exit 0

#!/usr/bin/env bash
# Scan staged changes for secrets with TruffleHog.
set -euo pipefail
# Git apps started from the Dock (Sourcetree, GitHub Desktop, Fork, ...) don't have
# Homebrew's folders on PATH, so look there too.
PATH="$PATH:/opt/homebrew/bin:/usr/local/bin"

# If TruffleHog isn't installed, warn but don't block the commit.
if ! command -v trufflehog >/dev/null 2>&1; then
  echo "warning: trufflehog not found on PATH; skipping secret scan." >&2
  echo "         install it with 'brew install trufflehog' to enable scanning." >&2
  exit 0
fi

# Collect staged files that are Added, Copied, or Modified (skip deletions).
# --no-renames lists a renamed file under its new name instead of leaving it out.
# Uses NUL separators to handle paths with spaces.
staged_files=()
while IFS= read -r -d '' file; do
  staged_files+=("$file")
done < <(git diff --cached --name-only --no-renames --diff-filter=ACM -z)

# Nothing to scan (e.g. a commit with only deletions).
[ ${#staged_files[@]} -eq 0 ] && exit 0

# Scan what will be committed: the staged version of each file, which differs
# from the one on disk after 'git add -p' or an edit made after 'git add'.
staged="$(mktemp -d "${TMPDIR:-/tmp}/staged-scan.XXXXXX")"
trap 'rm -rf "$staged"' EXIT
printf '%s\0' "${staged_files[@]}" | git checkout-index -z --stdin --prefix="$staged/"

echo "🔍 Scanning ${#staged_files[@]} staged file(s) for secrets with TruffleHog..."

# --fail returns exit code 183 if any results are found; any other non-zero code
# means the scan itself failed. All results are reported, including unverified
# ones: secrets TruffleHog can't check with their provider, such as private keys
# and passwords, are unverified. The pre-push scan reports fewer, since it covers
# whole branches, where old false positives would get in the way.
status=0
# The folder, not a list of files: thousands of staged paths would be too long for a
# command line, and a path starting with "-" would read as an option.
(cd "$staged" && trufflehog filesystem . \
      --results=verified,unverified,unknown \
      --fail \
      --no-update) || status=$?
if [ "$status" -eq 183 ]; then
  echo
  echo "❌ Potential secret(s) detected in your staged changes (see above)." >&2
  echo "   - Remove the secret and use a vault/env var instead, or" >&2
  echo "   - If it is a false positive, add a 'trufflehog:ignore' comment on that line, or" >&2
  echo "   - To bypass for a single commit (use sparingly): git commit --no-verify" >&2
  exit 1
elif [ "$status" -ne 0 ]; then
  echo "❌ The secret scan didn't finish (trufflehog exit code $status; see above), so the commit was stopped." >&2
  echo "   Fix the problem, or bypass for a single commit (use sparingly): git commit --no-verify" >&2
  exit 1
fi

echo "✅ No secrets detected in staged changes."
exit 0

#!/usr/bin/env bash
# Block direct pushes to protected branches; open a PR instead.
set -euo pipefail

protected='^refs/heads/(main|master|Release/.*)$'

while read -r local_ref local_sha remote_ref remote_sha; do
  [ -z "${remote_ref:-}" ] && continue
  if [[ "$remote_ref" =~ $protected ]]; then
    echo "❌ Direct pushes to '${remote_ref#refs/heads/}' are not allowed." >&2
    echo "   Push a feature branch (e.g. CKM-12345) and open a pull request." >&2
    echo "   To bypass (rarely needed): git push --no-verify" >&2
    exit 1
  fi
done
exit 0

#!/usr/bin/env bash
# Scan outgoing commits for secrets with TruffleHog before pushing.
set -euo pipefail
# Git apps started from the Dock (Sourcetree, GitHub Desktop, Fork, ...) don't have
# Homebrew's folders on PATH, so look there too.
PATH="$PATH:/opt/homebrew/bin:/usr/local/bin"

if ! command -v trufflehog >/dev/null 2>&1; then
  echo "warning: trufflehog not found; skipping outgoing secret scan." >&2
  exit 0
fi

# Git sends one line per ref being pushed: <local ref> <local commit> <remote ref> <remote commit>.
# Each commit is scanned from where the remote already has it, or from where it left the remote's
# default branch, so only what this push sends is scanned, not your other branches. With nothing to
# compare against, such as the first push of a new repository, its whole history is scanned.
remote="${1:-origin}"
default="$(git symbolic-ref -q --short "refs/remotes/${remote}/HEAD" 2>/dev/null || true)"
if [ -z "$default" ] && git rev-parse --verify -q "${remote}/main" >/dev/null 2>&1; then
  default="${remote}/main"
fi
repo_root="$(git rev-parse --show-toplevel)"

found=0
failed=0
while read -r local_ref local_sha remote_ref remote_sha; do
  # A deleted branch sends nothing, and a tag is scanned as the commit it points to.
  commit="$(git rev-parse -q --verify "${local_sha:-0}^{commit}" 2>/dev/null || true)"
  case "${local_sha:-0}" in *[!0]*) [ -n "$commit" ] || continue ;; *) continue ;; esac
  base=""
  case "${remote_sha:-0}" in
    *[!0]*) base="$(git rev-parse -q --verify "${remote_sha}^{commit}" 2>/dev/null || true)" ;;
  esac
  if [ -z "$base" ] && [ -n "$default" ]; then
    base="$(git merge-base "$commit" "$default" 2>/dev/null || true)"
  fi
  [ "$base" != "$commit" ] || continue # nothing new to send
  name="${local_ref#refs/heads/}"
  # TruffleHog scans its own clone of the repository, where branch names point elsewhere,
  # so it gets commit IDs.
  status=0
  if [ -n "$base" ]; then
    echo "🔍 Scanning the commits ${name} adds for secrets..."
    trufflehog git "file://${repo_root}" --branch "$commit" --since-commit "$base" \
      --results=verified,unknown --fail --no-update || status=$?
  else
    echo "🔍 Scanning all of ${name}'s history for secrets (${remote} has nothing to compare it with)..."
    trufflehog git "file://${repo_root}" --branch "$commit" \
      --results=verified,unknown --fail --no-update || status=$?
  fi
  # --fail returns exit code 183 if any results are found; any other non-zero code
  # means the scan itself failed.
  if [ "$status" -eq 183 ]; then
    found=1
  elif [ "$status" -ne 0 ]; then
    failed="$status"
  fi
done

if [ "$found" -eq 1 ]; then
  echo "❌ Potential secret(s) detected in outgoing commits (see above)." >&2
  echo "   Remove the secret (and rewrite history if already committed) before pushing." >&2
  echo "   To bypass (use sparingly): git push --no-verify" >&2
  exit 1
elif [ "$failed" -ne 0 ]; then
  echo "❌ The secret scan didn't finish (trufflehog exit code $failed; see above), so the push was stopped." >&2
  echo "   Fix the problem, or bypass (use sparingly): git push --no-verify" >&2
  exit 1
fi
echo "✅ No secrets detected in outgoing commits."
exit 0