|
| 1 | +#!/usr/bin/env sh |
| 2 | +# Pre-commit hook to run Talisman and Snyk scans, completing both before deciding to commit |
| 3 | + |
| 4 | +# Function to check if a command exists |
| 5 | +command_exists() { |
| 6 | + command -v "$1" >/dev/null 2>&1 |
| 7 | +} |
| 8 | + |
| 9 | +# Check if Talisman is installed |
| 10 | +if ! command_exists talisman; then |
| 11 | + echo "Error: Talisman is not installed. Please install it and try again." |
| 12 | + exit 1 |
| 13 | +fi |
| 14 | + |
| 15 | +# Check if Snyk is installed |
| 16 | +if ! command_exists snyk; then |
| 17 | + echo "Error: Snyk is not installed. Please install it and try again." |
| 18 | + exit 1 |
| 19 | +fi |
| 20 | + |
| 21 | +# Allow bypassing the hook with an environment variable |
| 22 | +if [ "$SKIP_HOOK" = "1" ]; then |
| 23 | + echo "Skipping Talisman and Snyk scans (SKIP_HOOK=1)." |
| 24 | + exit 0 |
| 25 | +fi |
| 26 | + |
| 27 | +# Initialize variables to track scan results |
| 28 | +talisman_failed=false |
| 29 | +snyk_failed=false |
| 30 | + |
| 31 | +# Run Talisman secret scan |
| 32 | +echo "Running Talisman secret scan..." |
| 33 | +talisman --githook pre-commit > talisman_output.log 2>&1 |
| 34 | +talisman_exit_code=$? |
| 35 | + |
| 36 | +if [ $talisman_exit_code -eq 0 ]; then |
| 37 | + echo "Talisman scan passed: No secrets found." |
| 38 | +else |
| 39 | + echo "Talisman scan failed (exit code $talisman_exit_code). See talisman_output.log for details." |
| 40 | + talisman_failed=true |
| 41 | +fi |
| 42 | + |
| 43 | +# Run Snyk vulnerability scan (continues even if Talisman failed) |
| 44 | +echo "Running Snyk vulnerability scan..." |
| 45 | +snyk test --all-projects --fail-on=all > snyk_output.log 2>&1 |
| 46 | +snyk_exit_code=$? |
| 47 | + |
| 48 | +if [ $snyk_exit_code -eq 0 ]; then |
| 49 | + echo "Snyk scan passed: No vulnerabilities found." |
| 50 | +elif [ $snyk_exit_code -eq 1 ]; then |
| 51 | + echo "Snyk found vulnerabilities. See snyk_output.log for details." |
| 52 | + snyk_failed=true |
| 53 | +else |
| 54 | + echo "Snyk scan failed with error (exit code $snyk_exit_code). See snyk_output.log for details." |
| 55 | + snyk_failed=true |
| 56 | +fi |
| 57 | + |
| 58 | +# Evaluate results after both scans |
| 59 | +if [ "$talisman_failed" = true ] || [ "$snyk_failed" = true ]; then |
| 60 | + echo "Commit aborted due to issues found in one or both scans." |
| 61 | + [ "$talisman_failed" = true ] && echo "- Talisman issues: Check talisman_output.log" |
| 62 | + [ "$snyk_failed" = true ] && echo "- Snyk issues: Check snyk_output.log" |
| 63 | + exit 1 |
| 64 | +fi |
| 65 | + |
| 66 | +# If both scans pass, allow the commit |
| 67 | +echo "All scans passed. Proceeding with commit." |
| 68 | +rm -f talisman_output.log snyk_output.log |
| 69 | +exit 0 |
0 commit comments