#!/bin/bash

# =============================================================================

# pre-commit

#

# Pre-commit hook that enforces secret scanning and shell script security

# checks on staged files before allowing a commit.

#

# Checks (in order):

# 1. Secret scanning — gitleaks (if installed) or built-in regex patterns

# 2. Shell linting — shellcheck on staged .sh files (if installed)

#

# Install:

# git config core.hooksPath .githooks

# (or run: ./install-hooks.sh)

#

# Bypass (emergency only):

# git commit --no-verify

#

# Requirements:

# - bash 4+

# - gitleaks (recommended — brew install gitleaks)

# - shellcheck (recommended — brew install shellcheck)

# =============================================================================

set -euo pipefail

###

## COLOR CODES

###

RED='\033[0;31m'

GREEN='\033[0;32m'

YELLOW='\033[1;33m'

BLUE='\033[0;34m'

NC='\033[0m'

print_status() { echo -e "${BLUE}[PRE-COMMIT]${NC} $1"; }

print_success() { echo -e "${GREEN}[PRE-COMMIT]${NC} $1"; }

print_warning() { echo -e "${YELLOW}[PRE-COMMIT]${NC} $1"; }

print_error() { echo -e "${RED}[PRE-COMMIT]${NC} $1" >&2; }

HOOK_FAILED=0

###

## Staged file list (new, copied, or modified — excludes deleted files)

###

STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || true)

if [[ -z "$STAGED_FILES" ]]; then

print_status "No staged files to check."

exit 0

fi

# =============================================================================

# CHECK 1: SECRET SCANNING

# =============================================================================

print_status "Running secret scan on staged changes..."

if command -v gitleaks > /dev/null 2>&1; then

# gitleaks v8+ — scan only staged diff

if ! gitleaks protect --staged --no-banner 2>&1; then

print_error "gitleaks detected secrets in staged changes. Commit blocked."

print_error " Fix the issues above, then stage your changes again."

print_error " To see the full report: gitleaks protect --staged --verbose"

HOOK_FAILED=1

else

print_success "gitleaks: no secrets detected."

fi

else

print_warning "gitleaks not found — running built-in secret pattern check."

print_warning " Install for more thorough detection: brew install gitleaks"

# Built-in patterns applied to staged content only (git show :path)

# Each pattern: DESCRIPTION|REGEX

declare -a SECRET_PATTERNS=(

"GitHub classic PAT|ghp_[A-Za-z0-9]{36,}"

"GitHub fine-grained PAT|github_pat_[A-Za-z0-9_]{80,}"

"GitHub OAuth token|gho_[A-Za-z0-9]{36,}"

"GitHub user-to-server token|ghu_[A-Za-z0-9]{36,}"

"GitHub server-to-server token|ghs_[A-Za-z0-9]{36,}"

"GitHub refresh token|ghr_[A-Za-z0-9]{36,}"

"AWS access key ID|AKIA[0-9A-Z]{16}"

"AWS secret access key|(?i)(aws_secret|aws_key|aws_access_key_id)\s*[=:]\s*['\"]?[A-Za-z0-9/+]{40}"

"Private key header|-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY"

"Generic secret assignment|(?i)(password|passwd|secret|api_key|apikey|auth_token|access_token)\s*=\s*['\"][^'\"]{8,}['\"]"

)

SECRETS_FOUND=0

while IFS= read -r file; do

# Skip binary files

if git diff --cached --name-only --diff-filter=ACM -- "$file" | grep -q . && \

git show ":${file}" 2>/dev/null | file - | grep -iq "binary"; then

continue

fi

# Get staged content for this file

STAGED_CONTENT=$(git show ":${file}" 2>/dev/null || true)

[[ -z "$STAGED_CONTENT" ]] && continue

for pattern_entry in "${SECRET_PATTERNS[@]}"; do

description="${pattern_entry%%|*}"

regex="${pattern_entry##*|}"

if echo "$STAGED_CONTENT" | grep -qP "$regex" 2>/dev/null; then

# Report line numbers for the match

matches=$(echo "$STAGED_CONTENT" | grep -nP "$regex" 2>/dev/null | head -5)

print_error "Potential secret detected in ${file}:"

print_error " Pattern : ${description}"

while IFS= read -r match_line; do

print_error " Line : ${match_line}"

done <<< "$matches"

SECRETS_FOUND=1

fi

done

done <<< "$STAGED_FILES"

if [[ "$SECRETS_FOUND" -eq 1 ]]; then

print_error ""

print_error "Secret scan failed. Remove secrets before committing."

print_error "If this is a false positive, install gitleaks and use .gitleaks.toml to allowlist the pattern."

HOOK_FAILED=1

else

print_success "Built-in secret scan: no secrets detected."

fi

fi

# =============================================================================

# CHECK 2: SHELLCHECK — shell script security and correctness

# =============================================================================

# Collect staged .sh files

STAGED_SH_FILES=$(echo "$STAGED_FILES" | grep '\.sh$' || true)

if [[ -n "$STAGED_SH_FILES" ]]; then

print_status "Running shellcheck on staged shell scripts..."

if ! command -v shellcheck > /dev/null 2>&1; then

print_warning "shellcheck not found — skipping shell script linting."

print_warning " Install for shell security checks: brew install shellcheck"

else

SC_FAILED=0

while IFS= read -r sh_file; do

[[ -z "$sh_file" ]] && continue

# Write staged content to a temp file so shellcheck can read it

TEMP_FILE=$(mktemp "/tmp/pre-commit-sc-XXXXXX.sh")

trap 'rm -f "${TEMP_FILE}"' EXIT

git show ":${sh_file}" > "$TEMP_FILE" 2>/dev/null || true

# SC2034 (unused vars) and SC1091 (can't follow source) are noisy

# for this project's pattern of sourcing github-common.sh.

# Severity: error and warning (skip info/style for speed).

if ! shellcheck \

--severity=warning \

--exclude=SC2034,SC1091 \

--shell=bash \

"$TEMP_FILE" 2>&1 | sed "s|${TEMP_FILE}|${sh_file}|g"; then

SC_FAILED=1

fi

rm -f "$TEMP_FILE"

trap - EXIT

done <<< "$STAGED_SH_FILES"

if [[ "$SC_FAILED" -eq 1 ]]; then

print_error "shellcheck found issues in staged scripts. Fix them before committing."

print_error " To disable a specific check inline: # shellcheck disable=SC####"

HOOK_FAILED=1

else

print_success "shellcheck: all staged shell scripts passed."

fi

fi

else

print_status "No staged .sh files — skipping shellcheck."

fi

# =============================================================================

# RESULT

# =============================================================================

if [[ "$HOOK_FAILED" -eq 1 ]]; then

echo ""

print_error "Pre-commit checks failed. Commit blocked."

print_error "Fix the issues above, or bypass with: git commit --no-verify"

exit 1

fi

print_success "All pre-commit checks passed."

exit 0