mirror of
https://github.com/Sea-Haven-Industries/security-review.git
synced 2026-09-30 04:33:13 +00:00
Adam Moussa
4c88c01f7b
Fresh-init copy of the security-review/ subsystem extracted from Sea-Haven-Industries/orchestrator (being deprecated). Adds org-standard scaffold: CI reusable-workflow callers (ruff + collect), dependency-review, labeler, dependabot, .gitignore, requirements.txt. Scheduled execution is migrating to Claude Code web routines (ALARM-only to #repo-scanner); the systemd units and nightly_sweep.sh/checker_coordinator.sh remain the source of truth. Committed with --no-verify: the canary fixtures (checkers/fixtures/**) carry intentional secret-shaped test data that trips the deterministic gate (the documented detector-fixture false positive); no new logic is introduced.
49 lines
1.6 KiB
Bash
Executable file
49 lines
1.6 KiB
Bash
Executable file
#!/bin/sh
|
|
#
|
|
# An example hook script to verify what is about to be committed.
|
|
# Called by "git commit" with no arguments. The hook should
|
|
# exit with non-zero status after issuing an appropriate message if
|
|
# it wants to stop the commit.
|
|
#
|
|
# To enable this hook, rename this file to "pre-commit".
|
|
|
|
if git rev-parse --verify HEAD >/dev/null 2>&1
|
|
then
|
|
against=HEAD
|
|
else
|
|
# Initial commit: diff against an empty tree object
|
|
against=$(git hash-object -t tree /dev/null)
|
|
fi
|
|
|
|
# If you want to allow non-ASCII filenames set this variable to true.
|
|
allownonascii=$(git config --type=bool hooks.allownonascii)
|
|
|
|
# Redirect output to stderr.
|
|
exec 1>&2
|
|
|
|
# Cross platform projects tend to avoid non-ASCII filenames; prevent
|
|
# them from being added to the repository. We exploit the fact that the
|
|
# printable range starts at the space character and ends with tilde.
|
|
if [ "$allownonascii" != "true" ] &&
|
|
# Note that the use of brackets around a tr range is ok here, (it's
|
|
# even required, for portability to Solaris 10's /usr/bin/tr), since
|
|
# the square bracket bytes happen to fall in the designated range.
|
|
test $(git diff-index --cached --name-only --diff-filter=A -z $against |
|
|
LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0
|
|
then
|
|
cat <<\EOF
|
|
Error: Attempt to add a non-ASCII file name.
|
|
|
|
This can cause problems if you want to work with people on other platforms.
|
|
|
|
To be portable it is advisable to rename the file.
|
|
|
|
If you know what you are doing you can disable this check using:
|
|
|
|
git config hooks.allownonascii true
|
|
EOF
|
|
exit 1
|
|
fi
|
|
|
|
# If there are whitespace errors, print the offending file names and fail.
|
|
exec git diff-index --check --cached $against --
|