prek 0.5.7

A fast Git hook manager written in Rust, designed as a drop-in alternative to pre-commit, reimagined.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

use std::io::Write as _;

use anyhow::{Context, Result};
use futures_util::StreamExt;
use prek_consts::env_vars::{EnvVars, EnvVarsRead};

use crate::concurrency::INTERNAL_CONCURRENCY;
use crate::git;
use crate::hook::Hook;
use crate::hooks::HookOutput;

/// Runs the `check-signed-commit` hook.
pub(crate) async fn run(hook: &Hook) -> Result<HookOutput> {
    let Some(range) = resolve_range().await? else {
        return Ok(HookOutput::unchanged(0, Vec::new()));
    };

    let output = git::git_cmd()?
        .current_dir(hook.work_dir())
        .args([
            "log",
            "--no-merges",
            "--no-show-signature",
            "-z",
            "--pretty=format:%H %h",
        ])
        .arg(range)
        .output()
        .await?;

    let commits = String::from_utf8_lossy(&output.stdout);
    let mut checks =
        futures_util::stream::iter(commits.split('\0').filter(|record| !record.is_empty()))
            .map(|record| async move {
                let (oid, short_oid) = record
                    .split_once(' ')
                    .context("Invalid commit information from Git")?;
                // Verify separately so each diagnostic belongs to a specific commit.
                let output = git::git_cmd()?
                    .current_dir(hook.work_dir())
                    .args(["verify-commit", oid])
                    .check(false)
                    .output()
                    .await
                    .with_context(|| format!("Failed to verify commit {oid}"))?;
                anyhow::Ok((short_oid, output))
            })
            .buffered(*INTERNAL_CONCURRENCY);

    let mut failed = false;
    let mut message = output.stderr;
    while let Some(result) = checks.next().await {
        let (short_oid, output) = result?;
        if output.status.success() {
            continue;
        }

        failed = true;
        writeln!(message, "{short_oid}: signature verification failed")?;
        for line in String::from_utf8_lossy(&output.stderr).trim_end().lines() {
            writeln!(message, "  {line}")?;
        }
    }

    Ok(HookOutput::unchanged(i32::from(failed), message))
}

/// Resolve the commit range to check.
///
/// Uses the push range from `PRE_COMMIT_FROM_REF`/`PRE_COMMIT_TO_REF` when available (the
/// normal `pre-push` invocation). Otherwise falls back to just `HEAD`, so the hook still does
/// something useful when run manually (`prek run check-signed-commit --hook-stage manual`).
async fn resolve_range() -> Result<Option<String>> {
    let from_ref = EnvVars.var(EnvVars::PRE_COMMIT_FROM_REF).ok();
    let to_ref = EnvVars.var(EnvVars::PRE_COMMIT_TO_REF).ok();

    if let Some(to_ref) = to_ref {
        return Ok(Some(match from_ref {
            Some(from_ref) => format!("{from_ref}..{to_ref}"),
            // Root/orphan push: there's no base to diff from, so walk the whole
            // history reachable from `to_ref`.
            None => to_ref,
        }));
    }

    if !git::rev_exists("HEAD").await? {
        // Unborn HEAD: no commits to check yet.
        return Ok(None);
    }

    Ok(Some("HEAD^!".to_string()))
}