Adam Moussa
c217c5656d
The live global pre-push hook was hand-edited to resolve suppressions from a
machine-level file (${SH_SECURITY_SUPPRESSIONS_DIR:-~/.config/sea-haven/security-review}/
<repo-basename>/suppressions.json) kept out of repo history, falling back to a
repo-local .security-review/suppressions.json. The repo-sourced hooks lacked it, so
install-hooks.sh --global would overwrite the live hook and lose the feature.
Port the prefer-machine/fallback-repo-local block into hooks/pre-push, align
hooks/pre-commit to the same (else a machine-suppressed finding passes at push but
blocks at commit), and document the path + SH_SECURITY_SUPPRESSIONS_DIR override +
basename-collision caveat in the README.
35 lines
2 KiB
Bash
Executable file
35 lines
2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Sea Haven global pre-push security gate — fast deterministic scanners (review.sh --scanners-only).
|
|
# Installed via install-hooks.sh --global: lays this down at ~/.config/git/hooks/pre-push and sets
|
|
# git config --global core.hooksPath ~/.config/git/hooks
|
|
# Skip a repo: add a .security-review-skip file at its root. Bypass once: git push --no-verify.
|
|
# Deep agentic pass = on-demand /sh-security-review; nightly VM sweep = the backstop.
|
|
set -uo pipefail
|
|
REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
|
|
[ -f "$REPO_ROOT/.security-review-skip" ] && exit 0
|
|
REVIEW_SH="${SH_REVIEW_SH:-$HOME/Documents/repositories/orchestrator/security-review/review.sh}"
|
|
if [ -f "$REVIEW_SH" ]; then
|
|
SUP=()
|
|
# Suppressions: prefer a MACHINE-LEVEL file kept out of repo history
|
|
# (<dir>/<repo-basename>/suppressions.json), else fall back to a repo-local
|
|
# .security-review/suppressions.json. Keyed by repo basename — adequate for the
|
|
# current single-namespace layout under ~/Documents/repositories.
|
|
MACHINE_SUP="${SH_SECURITY_SUPPRESSIONS_DIR:-$HOME/.config/sea-haven/security-review}/$(basename "$REPO_ROOT")/suppressions.json"
|
|
if [ -f "$MACHINE_SUP" ]; then
|
|
SUP=(--suppressions "$MACHINE_SUP")
|
|
elif [ -f "$REPO_ROOT/.security-review/suppressions.json" ]; then
|
|
SUP=(--suppressions "$REPO_ROOT/.security-review/suppressions.json")
|
|
fi
|
|
echo "security-review: scanning $REPO_ROOT (scanners-only) before push..." >&2
|
|
# ${SUP[@]+"${SUP[@]}"} = bash-3.2-safe expansion of a possibly-empty array under set -u.
|
|
if ! bash "$REVIEW_SH" --scanners-only ${SUP[@]+"${SUP[@]}"} "$REPO_ROOT"; then
|
|
echo "security-review: BLOCKED (confirmed crit/high). Fix it, suppress with justification, or 'git push --no-verify' to override." >&2
|
|
exit 1
|
|
fi
|
|
else
|
|
echo "security-review: review.sh not found at $REVIEW_SH (set SH_REVIEW_SH) — skipping gate" >&2
|
|
fi
|
|
# Don't silently disable a repo-local pre-push hook: chain to it if present.
|
|
LOCAL_HOOK="$REPO_ROOT/.git/hooks/pre-push"
|
|
[ -x "$LOCAL_HOOK" ] && exec "$LOCAL_HOOK" "$@"
|
|
exit 0
|