1
+ #! /usr/bin/env sh
2
+ # Pre-commit hook to run Snyk and Talisman scans, completing both before deciding to commit
3
+
4
+ # Function to check if a command exists
5
+ command_exists () {
6
+ command -v " $1 " > /dev/null 2>&1
7
+ }
8
+
9
+ # Check if Snyk is installed
10
+ if ! command_exists snyk; then
11
+ echo " Error: Snyk is not installed. Please install it and try again."
12
+ exit 1
13
+ fi
14
+
15
+ # Check if Talisman is installed
16
+ if ! command_exists talisman; then
17
+ echo " Error: Talisman is not installed. Please install it and try again."
18
+ exit 1
19
+ fi
20
+
21
+ # Allow bypassing the hook with an environment variable
22
+ if [ " $SKIP_HOOK " = " 1" ]; then
23
+ echo " Skipping Snyk and Talisman scans (SKIP_HOOK=1)."
24
+ exit 0
25
+ fi
26
+
27
+ # Initialize variables to track scan results
28
+ snyk_failed=false
29
+ talisman_failed=false
30
+
31
+ # Run Snyk vulnerability scan
32
+ echo " Running Snyk vulnerability scan..."
33
+ snyk test --all-projects > snyk_output.log 2>&1
34
+ snyk_exit_code=$?
35
+
36
+ if [ $snyk_exit_code -eq 0 ]; then
37
+ echo " Snyk scan passed: No vulnerabilities found."
38
+ elif [ $snyk_exit_code -eq 1 ]; then
39
+ echo " Snyk found vulnerabilities. See snyk_output.log for details."
40
+ snyk_failed=true
41
+ else
42
+ echo " Snyk scan failed with error (exit code $snyk_exit_code ). See snyk_output.log for details."
43
+ snyk_failed=true
44
+ fi
45
+
46
+ # Run Talisman secret scan (continues even if Snyk failed)
47
+ echo " Running Talisman secret scan..."
48
+ talisman --githook pre-commit > talisman_output.log 2>&1
49
+ talisman_exit_code=$?
50
+
51
+ if [ $talisman_exit_code -eq 0 ]; then
52
+ echo " Talisman scan passed: No secrets found."
53
+ else
54
+ echo " Talisman scan failed (exit code $talisman_exit_code ). See talisman_output.log for details."
55
+ talisman_failed=true
56
+ fi
57
+
58
+ # Evaluate results after both scans
59
+ if [ " $snyk_failed " = true ] || [ " $talisman_failed " = true ]; then
60
+ echo " Commit aborted due to issues found in one or both scans."
61
+ [ " $snyk_failed " = true ] && echo " - Snyk issues: Check snyk_output.log"
62
+ [ " $talisman_failed " = true ] && echo " - Talisman issues: Check talisman_output.log"
63
+ exit 1
64
+ fi
65
+
66
+ # If both scans pass, allow the commit
67
+ echo " All scans passed. Proceeding with commit.cd ."
68
+ rm -f snyk_output.log talisman_output.log
69
+ exit 0
0 commit comments