Git pre-commit hook for Ansible Vault

pre-commit.example

#!/bin/sh
#
# Pre-commit hook that verifies if all files containing 'vault' in the name
# are encrypted.
# If not, commit will fail with an error message
#
# File should be .git/hooks/pre-commit and executable
FILES_PATTERN='.*vault.*\.yml$'
REQUIRED='ANSIBLE_VAULT'

EXIT_STATUS=0
wipe="\033[1m\033[0m"
yellow='\033[1;33m'
# carriage return hack. Leave it on 2 lines.
cr='
'
for f in $(git diff --cached --name-only | grep -E $FILES_PATTERN)
do
  MATCH=`grep --invert-match --no-messages $REQUIRED $f | head -n1`
  if [ -z $MATCH ] ; then
    UNENCRYPTED_FILES="$f$cr$UNENCRYPTED_FILES"
    EXIT_STATUS=1
  fi
done
if [ $EXIT_STATUS = 0 ] ; then
  exit 0
else
  echo '# COMMIT REJECTED'
  echo '# Looks like unencrypted ansible-vault files are part of the commit:'
  echo '#'
  while read -r line; do
    if [ -n "$line" ]; then
      echo "#\t${yellow}unencrypted:   $line${wipe}"
    fi
  done <<< "$UNENCRYPTED_FILES"
  echo '#'
  echo "# Please encrypt them with 'ansible-vault encrypt <file>'"
  echo "#   (or force the commit with '--no-verify')."
  exit $EXIT_STATUS
fi

In case anyone else finds this useful - there's an issue with this code, in that it tests the contents of the file on disk. It's possible to stage a file with unencrypted data, then encrypt it on disk, but not stage it. At that point the commit will be accepted, of the unencrypted file.

This can be fixed by replacing this:

MATCH=grep --invert-match --no-messages $REQUIRED $f | head -n1

with:

MATCH=`git show :$f | grep --invert-match --no-messages $REQUIRED | head -n1