Keru/knowledge-genome-orchestrator
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: Pre-commit hook uses dynamic git-crypt checks

Browse source
This commit is contained in:
Matteo Cherubini 2026-05-10 15:11:04 +02:00
parent 73a031b677
commit 55834529a7
1 changed files with 26 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

54
templates/pre-commit.sh
View file

@ -1,50 +1,48 @@
#!/usr/bin/env bash
# =============================================================================
# .git/hooks/pre-commit
# Fail-safe security hook: Prevents plaintext leaks of sensitive data.
# Fail-safe security hook: prevents plaintext commits of encrypted files.
# Reads encryption requirements dynamically from .gitattributes via
# git check-attr — no hardcoded paths, inherits all future rules automatically.
# =============================================================================
set -euo pipefail
# Directories that MUST be encrypted
PRIVATE_PATTERNS=("raw/private/" "wiki/private/")
FAILED=0
# Check on git-crypt
# Verify git-crypt is initialized
if [[ ! -d ".git-crypt" ]]; then
echo -e "\n\033[0;31m[CRITICAL] git-crypt is not initialized in this repository.\033[0m"
echo "Run 'git-crypt init' and 'make setup' before committing."
exit 1
printf "\n\033[0;31m[CRITICAL] git-crypt not initialized.\033[0m\n"
printf "Run 'git-crypt init' and 'make setup' before committing.\n"
exit 1
fi
# Get staged files (excluding deletions)
# Get staged files (additions, copies, modifications — no deletions)
STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || true)
if [[ -z "$STAGED_FILES" ]]; then
exit 0
fi
[[ -z "$STAGED_FILES" ]] && exit 0
for pattern in "${PRIVATE_PATTERNS[@]}"; do
while IFS= read -r file; do
if [[ "$file" == ${pattern}* ]]; then
# Check encryption status via git-crypt
STATUS=$(git-crypt status "$file" 2>/dev/null || echo "error")
if echo "$STATUS" | grep -q "not encrypted"; then
echo -e "\n\033[0;31m[SECURITY ALERT] PLAINTEXT LEAK DETECTED\033[0m"
echo "-----------------------------------------------------------"
echo "File: $file"
echo "Status: This file is in a private/ folder but is NOT encrypted."
echo "Action: Fix your .gitattributes or run 'git-crypt init'."
echo "-----------------------------------------------------------"
while IFS= read -r file; do
# Dynamically check if this file requires git-crypt encryption
filter=$(git check-attr filter -- "$file" 2>/dev/null | sed 's/.*: //')
[[ "$filter" != "git-crypt" ]] && continue
# File is required to be encrypted — verify it actually is
status=$(git-crypt status "$file" 2>/dev/null || printf "error")
if printf '%s\n' "$status" | grep -q "not encrypted"; then
printf "\n\033[0;31m[SECURITY ALERT] PLAINTEXT LEAK DETECTED\033[0m\n"
printf -- "-----------------------------------------------------------\n"
printf "File: %s\n" "$file"
printf "Status: Marked for git-crypt in .gitattributes but NOT encrypted.\n"
printf "Action: Verify .gitattributes rules and re-run 'git-crypt init'.\n"
printf -- "-----------------------------------------------------------\n"
FAILED=1
fi
fi
done <<< "$STAGED_FILES"
done
done <<< "$STAGED_FILES"
if [[ "$FAILED" -ne 0 ]]; then
echo -e "\033[0;31mCommit blocked for security reasons.\033[0m\n"
exit 1
printf "\n\033[0;31mCommit blocked: security policy violation.\033[0m\n\n"
exit 1
fi
exit 0