File size: 2,154 Bytes
d90d9bc 337d58c d90d9bc 337d58c d90d9bc 337d58c | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 | #!/usr/bin/env bash
# ADR-0014 pre-push security gate.
#
# This repo's `origin` IS the HuggingFace Space (git push builds the live Space),
# so there is no GitHub Actions merge gate. This hook is the enforced check in
# that HF-only deploy model: it runs the shared scan before a push ships code.
#
# Install with: make install-hooks
#
# A developer *can* bypass a local hook (`git push --no-verify`), so this is
# paired with the scheduled unattended scan — it is not as strong as a
# server-side merge gate. Set SECURITY_SCAN_STRICT=1 to fail on skipped stages.
#
# Skip intentionally (e.g. a docs-only push) with: git push --no-verify
set -euo pipefail
# Capture the ref lines git feeds a pre-push hook on stdin BEFORE anything else
# can consume them — git-lfs's chained hook below needs them to know which LFS
# objects to upload. Installing this hook REPLACED git-lfs's own pre-push hook,
# which silently broke every push containing a new LFS-tracked file (HF rejects
# with "LFS pointer pointed to a file that does not exist" until a manual
# `git lfs push <remote> main`). Found deploying b4a5c90.
hook_stdin="$(cat || true)"
repo_root="$(git rev-parse --show-toplevel)"
echo "[pre-push] running ADR-0014 security scan (git push --no-verify to skip)…"
if bash "$repo_root/scripts/security_scan.sh" < /dev/null; then
echo "[pre-push] security scan clean — proceeding."
else
echo "[pre-push] security scan reported findings — push blocked." >&2
echo "[pre-push] triage security/ artifacts, or 'git push --no-verify' to override." >&2
exit 1
fi
# Chain git-lfs's pre-push (after the scan, so a blocked push uploads nothing).
# Replays the captured ref lines; "$@" is the remote name + URL git passed us.
if command -v git-lfs >/dev/null 2>&1; then
if ! printf '%s' "$hook_stdin" | git lfs pre-push "$@"; then
echo "[pre-push] git lfs pre-push failed — push blocked (LFS objects not uploaded)." >&2
exit 1
fi
else
echo "[pre-push] WARNING: git-lfs not installed — a push with new LFS-tracked files" >&2
echo "[pre-push] will be rejected by the remote until 'git lfs push' is run manually." >&2
fi
exit 0
|