prek 0.3.10

A Git hook manager written in Rust, designed as a drop-in alternative to pre-commit.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141

use std::os::unix::fs::PermissionsExt;

use anyhow::Result;
use assert_cmd::Command;
use assert_fs::fixture::{FileWriteStr, PathChild, PathCreateDir};
use prek_consts::env_vars::EnvVars;
use prek_consts::prepend_paths;

use crate::common::{TestContext, cmd_snapshot};

#[test]
fn docker_image() -> Result<()> {
    let context = TestContext::new();
    context.init_project();

    let cwd = context.work_dir();
    // Test suite from https://github.com/super-linter/super-linter/tree/main/test/linters/gitleaks/bad
    cwd.child("gitleaks_bad_01.txt")
        .write_str(indoc::indoc! {r"
        aws_access_key_id = AROA47DSWDEZA3RQASWB
        aws_secret_access_key = wQwdsZDiWg4UA5ngO0OSI2TkM4kkYxF6d2S1aYWM
    "})?;

    // Use fully qualified image name for Podman/Docker compatibility
    Command::new("docker")
        .args(["pull", "docker.io/zricethezav/gitleaks:v8.21.2"])
        .assert()
        .success();

    context.write_pre_commit_config(indoc::indoc! {r"
        repos:
          - repo: local
            hooks:
              - id: gitleaks-docker
                name: Detect hardcoded secrets
                language: docker_image
                entry: docker.io/zricethezav/gitleaks:v8.21.2 git --pre-commit --redact --staged --verbose
                pass_filenames: false
    "});
    context.git_add(".");

    let filters = context
        .filters()
        .into_iter()
        .chain([(r"\d\d?:\d\d(AM|PM)", "[TIME]")])
        .collect::<Vec<_>>();

    cmd_snapshot!(filters, context.run(), @r#"
    success: false
    exit_code: 1
    ----- stdout -----
    Detect hardcoded secrets.................................................Failed
    - hook id: gitleaks-docker
    - exit code: 1

      Finding:     aws_access_key_id = REDACTED
      Secret:      REDACTED
      RuleID:      generic-api-key
      Entropy:     3.521928
      File:        gitleaks_bad_01.txt
      Line:        1
      Fingerprint: gitleaks_bad_01.txt:generic-api-key:1

      Finding:     aws_secret_access_key = REDACTED
      Secret:      REDACTED
      RuleID:      generic-api-key
      Entropy:     4.703056
      File:        gitleaks_bad_01.txt
      Line:        2
      Fingerprint: gitleaks_bad_01.txt:generic-api-key:2


          ○
          │╲
          │ ○
          ○ ░
          ░    gitleaks

      [TIME] INF 1 commits scanned.
      [TIME] INF scan completed in [TIME]
      [TIME] WRN leaks found: 2

    ----- stderr -----
    "#);
    Ok(())
}

/// Test that `docker_image` does not try to resolve entry in the host system PATH.
#[test]
fn docker_image_does_not_resolve_entry() -> Result<()> {
    let context = TestContext::new();
    context.init_project();

    let cwd = context.work_dir();
    let bin_dir = cwd.child("bin");
    bin_dir.create_dir_all()?;

    let alpine_stub = bin_dir.child("alpine");
    alpine_stub.write_str("#!/bin/sh\necho host\n")?;

    let mut perms = std::fs::metadata(alpine_stub.path())?.permissions();
    perms.set_mode(0o755);
    std::fs::set_permissions(alpine_stub.path(), perms)?;

    Command::new("docker")
        .args(["pull", "docker.io/library/alpine:latest"])
        .assert()
        .success();

    context.write_pre_commit_config(indoc::indoc! {r"
        repos:
          - repo: local
            hooks:
              - id: alpine-echo
                name: Alpine echo
                language: docker_image
                entry: alpine /bin/sh -c 'echo ok'
                pass_filenames: false
                always_run: true
                verbose: true
    "});
    context.git_add(".");

    let mut cmd = context.run();
    cmd.env(EnvVars::PATH, prepend_paths(&[bin_dir.path()])?);

    cmd_snapshot!(context.filters(), cmd, @r"
    success: true
    exit_code: 0
    ----- stdout -----
    Alpine echo..............................................................Passed
    - hook id: alpine-echo
    - duration: [TIME]

      ok

    ----- stderr -----
    ");

    Ok(())
}