Skip to content

Instantly share code, notes, and snippets.

@cniesen
Forked from leucos/.git_hooks_pre-commit
Last active December 29, 2021 09:26
Show Gist options
  • Save cniesen/9a2c37c338db5fb5a6ffa9e5ada3b66e to your computer and use it in GitHub Desktop.
Save cniesen/9a2c37c338db5fb5a6ffa9e5ada3b66e to your computer and use it in GitHub Desktop.
ansible-vault pre-commit hook
#!/bin/bash
###
# Pre-commit hook that verifies if all files containing 'vault' in the name # are encrypted.
# If not, commit will fail with an error message
#
# Original author: @ralovely
# https://www.reinteractive.net/posts/167-ansible-real-life-good-practices
#
# File should be .git/hooks/pre-commit and executable
###
#FILES_PATTERN='.*vault.*\.*$|digital_ocean\.ini|do_env\.sh'
FILES_PATTERN='.*vault.*'
REQUIRED='ANSIBLE_VAULT'
EXIT_STATUS=0
wipe="\033[1m\033[0m"
yellow='\033[1;33m'
# carriage return hack. Leave it on 2 lines.
cr='
'
echo '# .git/hooks/pre-commit: Checking ansible vaults'
for f in $(git diff --cached --name-only | grep -E $FILES_PATTERN)
do
# test for the presence of the required bit.
MATCH=`git show :$f | head -n1 | grep --no-messages $REQUIRED`
if [ ! $MATCH ] ; then
# Build the list of unencrypted files if any
UNENCRYPTED_FILES="$f$cr$UNENCRYPTED_FILES"
EXIT_STATUS=1
fi
done
if [ ! $EXIT_STATUS = 0 ] ; then
echo '# COMMIT REJECTED'
echo '# Looks like unencrypted ansible-vault files are part of the commit:'
echo '#'
while read -r line; do
if [ -n "$line" ]; then
echo -e "#\t${yellow}unencrypted: $line${wipe}"
fi
done <<< "$UNENCRYPTED_FILES"
echo '#'
echo "# Please encrypt them with 'ansible-vault encrypt <file>'"
echo "# (or force the commit with '--no-verify')."
exit $EXIT_STATUS
fi
exit $EXIT_STATUS
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment