Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
ansible-vault pre-commit hook
#!/bin/sh
#
# Pre-commit hook that verifies if all files containing 'vault' in the name
# are encrypted.
# If not, commit will fail with an error message
#
# Original author: @ralovely
# https://www.reinteractive.net/posts/167-ansible-real-life-good-practices
#
# File should be .git/hooks/pre-commit and executable
FILES_PATTERN='.*vault.*\.*$|digital_ocean\.ini|do_env\.sh'
REQUIRED='ANSIBLE_VAULT'
EXIT_STATUS=0
wipe="\033[1m\033[0m"
yellow='\033[1;33m'
# carriage return hack. Leave it on 2 lines.
cr='
'
for f in $(git diff --cached --name-only | grep -E $FILES_PATTERN)
do
# test for the presence of the required bit.
MATCH=`head -n1 $f | grep --no-messages $REQUIRED`
if [ ! $MATCH ] ; then
# Build the list of unencrypted files if any
UNENCRYPTED_FILES="$f$cr$UNENCRYPTED_FILES"
EXIT_STATUS=1
fi
done
if [ ! $EXIT_STATUS = 0 ] ; then
echo '# COMMIT REJECTED'
echo '# Looks like unencrypted ansible-vault files are part of the commit:'
echo '#'
while read -r line; do
if [ -n "$line" ]; then
echo -e "#\t${yellow}unencrypted: $line${wipe}"
fi
done <<< "$UNENCRYPTED_FILES"
echo '#'
echo "# Please encrypt them with 'ansible-vault encrypt <file>'"
echo "# (or force the commit with '--no-verify')."
exit $EXIT_STATUS
fi
exit $EXIT_STATUS
@punkrokk

This comment has been minimized.

Copy link

@punkrokk punkrokk commented Feb 22, 2018

I thank you!

@planet-winter

This comment has been minimized.

Copy link

@planet-winter planet-winter commented Feb 28, 2018

great! thanks! saved me time after starting to do it on my own.

@WeslyG

This comment has been minimized.

Copy link

@WeslyG WeslyG commented May 7, 2019

This is great!!
You saved me a lot of time!

@akhiljalagam

This comment has been minimized.

Copy link

@akhiljalagam akhiljalagam commented Aug 16, 2019

Greate thanks.

@brunocorreiaweb

This comment has been minimized.

Copy link

@brunocorreiaweb brunocorreiaweb commented Jun 25, 2020

Many thanks!

@tuomastielinen

This comment has been minimized.

Copy link

@tuomastielinen tuomastielinen commented Aug 24, 2020

When committing I get:
.git/hooks/pre-commit: 38: Syntax error: redirection unexpected

@cniesen

This comment has been minimized.

Copy link

@cniesen cniesen commented Oct 13, 2020

@tuomastielinen #!/bin/sh on Ubuntu is using the dash shell which does not have the <<< redirection operator.
Simply change the shell to bash #!/bin/bash.

@cniesen

This comment has been minimized.

Copy link

@cniesen cniesen commented Oct 13, 2020

Danger Will Robinson!

If the vault is encrypted on the file system but unencrypted in the staging area then this hook will let the commit go through causing an unencrypted vault to be committed.

Fix:

Change line 23 to:

  MATCH=`git show :$f | head -n1 | grep --no-messages $REQUIRED`

git show uses the file content as it is in the git staging, not the file system.

@tuomastielinen

This comment has been minimized.

Copy link

@tuomastielinen tuomastielinen commented Oct 14, 2020

Thanks @cniesen, seems to be working now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment