mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Opus 5.5
591818d5fc
`ousast pre-push install|uninstall [REPO] [--force] [--docker]` ships in the wheel with the hook as package data; it honours core.hooksPath, refuses an existing hook unless --force (which chains it as pre-push.before-ousast), and uninstall restores the chained hook. ops/ousast-docker is a hook-callable script: the repository read-only and the artifact directory at their own paths, stdin passed through, no network, --memory 3g, the GHCR 2.0.1 image by default, advisory exit unless blocking. Help text for every pre-push flag; a first-run guide, settings, skip-reason glossary, CI recipe and full --help in docs/scanning.md; README tiers 1 and 2 pull the published image. The image was not rebuilt: 1.1 GB free, below the 4 GB threshold. Requirements 7.4, 9.6. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
39 lines
1.8 KiB
Bash
Executable File
39 lines
1.8 KiB
Bash
Executable File
#!/bin/sh
|
|
# OpenUltraSAST pre-push safety net. Advisory: nothing here rejects a push unless
|
|
# OUSAST_PUSH_MODE=blocking is set explicitly. Install with `ousast pre-push install`
|
|
# (or ops/install-pre-push from a checkout); remove with `ousast pre-push uninstall`.
|
|
# A prior hook is chained only after it was moved to the sibling path "$0.before-ousast".
|
|
artifact_dir=${OUSAST_ARTIFACT_DIR:-${XDG_CACHE_HOME:-$HOME/.cache}/openultrasast/push}
|
|
prior="$0.before-ousast"
|
|
# The Docker wrapper installed beside this hook (`ousast pre-push install --docker`) is used
|
|
# unless OUSAST_COMMAND names another command; otherwise `ousast` from PATH.
|
|
if [ -z "${OUSAST_COMMAND:-}" ] && [ -x "$(dirname -- "$0")/ousast-docker" ]; then
|
|
OUSAST_COMMAND="$(dirname -- "$0")/ousast-docker"
|
|
fi
|
|
command=${OUSAST_COMMAND:-ousast}
|
|
if ! command -v "$command" >/dev/null 2>&1; then
|
|
echo "ousast: pre-push check did not run: '$command' is not on PATH." \
|
|
"Install it with 'pip install openultrasast' or set OUSAST_COMMAND. Push continues."
|
|
if [ -e "$prior" ] || [ -L "$prior" ]; then
|
|
exec "$prior" "$@"
|
|
fi
|
|
exit 0
|
|
fi
|
|
remote_name=$1
|
|
remote_url=$2
|
|
set -- pre-push . --artifact "$artifact_dir/push-$$.json" \
|
|
--deadline "${OUSAST_PUSH_DEADLINE:-30}" \
|
|
--mode "${OUSAST_PUSH_MODE:-advisory}" \
|
|
--incomplete-coverage "${OUSAST_INCOMPLETE_COVERAGE:-allow}"
|
|
# Optional settings are passed only when set, so an older ousast (or image) still runs.
|
|
if [ -n "${OUSAST_PUSH_ENGINE:-}" ]; then
|
|
set -- "$@" --engine "$OUSAST_PUSH_ENGINE"
|
|
fi
|
|
if [ -n "${OUSAST_COMPARISON_BASE:-}" ]; then
|
|
set -- "$@" --comparison-base "$OUSAST_COMPARISON_BASE"
|
|
fi
|
|
if [ -e "$prior" ] || [ -L "$prior" ]; then
|
|
set -- "$@" --prior-hook "$prior"
|
|
fi
|
|
exec "$command" "$@" --remote "$remote_name" "$remote_url"
|