mirror of
https://github.com/Sea-Haven-Industries/security-review.git
synced 2026-09-30 09:13:15 +00:00
Adam Moussa
4c88c01f7b
Fresh-init copy of the security-review/ subsystem extracted from Sea-Haven-Industries/orchestrator (being deprecated). Adds org-standard scaffold: CI reusable-workflow callers (ruff + collect), dependency-review, labeler, dependabot, .gitignore, requirements.txt. Scheduled execution is migrating to Claude Code web routines (ALARM-only to #repo-scanner); the systemd units and nightly_sweep.sh/checker_coordinator.sh remain the source of truth. Committed with --no-verify: the canary fixtures (checkers/fixtures/**) carry intentional secret-shaped test data that trips the deterministic gate (the documented detector-fixture false positive); no new logic is introduced.
24 lines
896 B
Bash
Executable file
24 lines
896 B
Bash
Executable file
#!/bin/sh
|
|
#
|
|
# An example hook script to check the commit log message.
|
|
# Called by "git commit" with one argument, the name of the file
|
|
# that has the commit message. The hook should exit with non-zero
|
|
# status after issuing an appropriate message if it wants to stop the
|
|
# commit. The hook is allowed to edit the commit message file.
|
|
#
|
|
# To enable this hook, rename this file to "commit-msg".
|
|
|
|
# Uncomment the below to add a Signed-off-by line to the message.
|
|
# Doing this in a hook is a bad idea in general, but the prepare-commit-msg
|
|
# hook is more suited to it.
|
|
#
|
|
# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p')
|
|
# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1"
|
|
|
|
# This example catches duplicate Signed-off-by lines.
|
|
|
|
test "" = "$(grep '^Signed-off-by: ' "$1" |
|
|
sort | uniq -c | sed -e '/^[ ]*1[ ]/d')" || {
|
|
echo >&2 Duplicate Signed-off-by lines.
|
|
exit 1
|
|
}
|