max / makeover

2.9 KB · 84 lines History Blame Raw

1	#!/bin/bash
2	# rustfmt gate: blocks a commit whose staged Rust files are not formatted.
3	#
4	# Activate in a fresh clone (one-time):
5	# git config core.hooksPath scripts/githooks
6	#
7	# Bypass for a work-in-progress commit: git commit --no-verify
8	#
9	# Only crates with staged .rs changes are checked, so the hook stays fast on a
10	# large repo. Each file maps to the nearest enclosing Cargo.toml, and the check
11	# runs as `cargo fmt` there, which picks up that crate's edition and any
12	# rustfmt.toml rather than guessing.
13	set -euo pipefail
14
15	ROOT="$(git rev-parse --show-toplevel)"
16	cd "$ROOT"
17
18	# --- secret scan (gitleaks) -------------------------------------------------
19	# Independent guardrail: blocks a commit whose staged changes contain a secret,
20	# regardless of whether a human judged the value "safe". Shared ruleset lives at
21	# ~/Code/.gitleaks.toml. Degrades gracefully if gitleaks is not installed (the
22	# astra pre-receive hook is the backstop that always runs). Task: infra 97ffeda0.
23	if command -v gitleaks >/dev/null 2>&1; then
24	GL_CFG=""
25	if [ -f "$ROOT/.gitleaks.toml" ]; then
26	GL_CFG="$ROOT/.gitleaks.toml"
27	elif [ -f "$HOME/Code/.gitleaks.toml" ]; then
28	GL_CFG="$HOME/Code/.gitleaks.toml"
29	fi
30	gl_args=(git --staged --no-banner --redact)
31	[ -n "$GL_CFG" ] && gl_args+=(-c "$GL_CFG")
32	if ! gitleaks "${gl_args[@]}"; then
33	echo "pre-commit: gitleaks found a secret in the staged changes."
34	echo " remove it (or allowlist a false positive), then restage."
35	echo " bypass: git commit --no-verify."
36	exit 1
37	fi
38	echo "pre-commit: gitleaks clean."
39	else
40	echo "pre-commit: gitleaks not installed; skipping secret scan (astra gates on push)."
41	fi
42
43	# Paths the gate ignores (extended regex, matched against repo-relative paths).
44	# Empty means check everything.
45	SKIP_PATHS="${SKIP_PATHS:-}"
46
47	staged="$(git diff --cached --name-only --diff-filter=ACMR -- '*.rs')"
48	if [ -n "$SKIP_PATHS" ]; then
49	staged="$(printf '%s\n' "$staged" \| grep -Ev "$SKIP_PATHS" \|\| true)"
50	fi
51	[ -n "$staged" ] \|\| exit 0
52
53	# Map each staged file to the directory of its nearest Cargo.toml.
54	crates=""
55	while IFS= read -r f; do
56	[ -n "$f" ] \|\| continue
57	d="$(dirname "$f")"
58	while [ "$d" != "." ] && [ ! -f "$d/Cargo.toml" ]; do
59	d="$(dirname "$d")"
60	done
61	[ -f "$d/Cargo.toml" ] \|\| continue
62	crates="$crates$d"$'\n'
63	done <<< "$staged"
64
65	crates="$(printf '%s' "$crates" \| sort -u)"
66	[ -n "$crates" ] \|\| exit 0
67
68	failed=0
69	while IFS= read -r c; do
70	[ -n "$c" ] \|\| continue
71	if ! (cd "$c" && cargo fmt --check >/dev/null 2>&1); then
72	echo "pre-commit: rustfmt gate failed in $c"
73	failed=1
74	fi
75	done <<< "$crates"
76
77	if [ "$failed" -ne 0 ]; then
78	echo "pre-commit: run 'cargo fmt' in the crates above, then restage."
79	echo "pre-commit: commit aborted (use --no-verify to bypass)."
80	exit 1
81	fi
82
83	echo "pre-commit: rustfmt gate clean."
84