mirror of
https://github.com/Sea-Haven-Industries/security-review.git
synced 2026-09-30 03:23:13 +00:00
Adam Moussa
4c88c01f7b
Fresh-init copy of the security-review/ subsystem extracted from Sea-Haven-Industries/orchestrator (being deprecated). Adds org-standard scaffold: CI reusable-workflow callers (ruff + collect), dependency-review, labeler, dependabot, .gitignore, requirements.txt. Scheduled execution is migrating to Claude Code web routines (ALARM-only to #repo-scanner); the systemd units and nightly_sweep.sh/checker_coordinator.sh remain the source of truth. Committed with --no-verify: the canary fixtures (checkers/fixtures/**) carry intentional secret-shaped test data that trips the deterministic gate (the documented detector-fixture false positive); no new logic is introduced.
53 lines
1.3 KiB
Bash
Executable file
53 lines
1.3 KiB
Bash
Executable file
#!/bin/sh
|
|
|
|
# An example hook script to verify what is about to be pushed. Called by "git
|
|
# push" after it has checked the remote status, but before anything has been
|
|
# pushed. If this script exits with a non-zero status nothing will be pushed.
|
|
#
|
|
# This hook is called with the following parameters:
|
|
#
|
|
# $1 -- Name of the remote to which the push is being done
|
|
# $2 -- URL to which the push is being done
|
|
#
|
|
# If pushing without using a named remote those arguments will be equal.
|
|
#
|
|
# Information about the commits which are being pushed is supplied as lines to
|
|
# the standard input in the form:
|
|
#
|
|
# <local ref> <local oid> <remote ref> <remote oid>
|
|
#
|
|
# This sample shows how to prevent push of commits where the log message starts
|
|
# with "WIP" (work in progress).
|
|
|
|
remote="$1"
|
|
url="$2"
|
|
|
|
zero=$(git hash-object --stdin </dev/null | tr '[0-9a-f]' '0')
|
|
|
|
while read local_ref local_oid remote_ref remote_oid
|
|
do
|
|
if test "$local_oid" = "$zero"
|
|
then
|
|
# Handle delete
|
|
:
|
|
else
|
|
if test "$remote_oid" = "$zero"
|
|
then
|
|
# New branch, examine all commits
|
|
range="$local_oid"
|
|
else
|
|
# Update to existing branch, examine new commits
|
|
range="$remote_oid..$local_oid"
|
|
fi
|
|
|
|
# Check for WIP commit
|
|
commit=$(git rev-list -n 1 --grep '^WIP' "$range")
|
|
if test -n "$commit"
|
|
then
|
|
echo >&2 "Found WIP commit in $local_ref, not pushing"
|
|
exit 1
|
|
fi
|
|
fi
|
|
done
|
|
|
|
exit 0
|