#!/bin/sh
# OpenUltraSAST pre-push safety net. Advisory: nothing here rejects a push unless
# OUSAST_PUSH_MODE=blocking is set explicitly. Install with `ousast pre-push install`
# (or ops/install-pre-push from a checkout); remove with `ousast pre-push uninstall`.
# A prior hook is chained only after it was moved to the sibling path "$0.before-ousast".
artifact_dir=${OUSAST_ARTIFACT_DIR:-${XDG_CACHE_HOME:-$HOME/.cache}/openultrasast/push}
prior="$0.before-ousast"
# The Docker wrapper installed beside this hook (`ousast pre-push install --docker`) is used
# unless OUSAST_COMMAND names another command; otherwise `ousast` from PATH.
if [ -z "${OUSAST_COMMAND:-}" ] && [ -x "$(dirname -- "$0")/ousast-docker" ]; then
    OUSAST_COMMAND="$(dirname -- "$0")/ousast-docker"
fi
command=${OUSAST_COMMAND:-ousast}
if ! command -v "$command" >/dev/null 2>&1; then
    echo "ousast: pre-push check did not run: '$command' is not on PATH." \
        "Install it (pip install git+https://github.com/norandom/OpenUltraSAST) or set OUSAST_COMMAND. Push continues."
    if [ -e "$prior" ] || [ -L "$prior" ]; then
        exec "$prior" "$@"
    fi
    exit 0
fi
remote_name=$1
remote_url=$2
set -- pre-push . --artifact "$artifact_dir/push-$$.json" \
    --deadline "${OUSAST_PUSH_DEADLINE:-30}" \
    --mode "${OUSAST_PUSH_MODE:-advisory}" \
    --incomplete-coverage "${OUSAST_INCOMPLETE_COVERAGE:-allow}"
# Optional settings are passed only when set, so an older ousast (or image) still runs.
if [ -n "${OUSAST_PUSH_ENGINE:-}" ]; then
    set -- "$@" --engine "$OUSAST_PUSH_ENGINE"
fi
if [ -n "${OUSAST_COMPARISON_BASE:-}" ]; then
    set -- "$@" --comparison-base "$OUSAST_COMPARISON_BASE"
fi
if [ -e "$prior" ] || [ -L "$prior" ]; then
    set -- "$@" --prior-hook "$prior"
fi
exec "$command" "$@" --remote "$remote_name" "$remote_url"