Remote usage, and script files inheritance

[createchange]

Hello,

I have a few questions:

1. When using a remote configuration: if a change is made to remote, is the user's only method to get them via lefthook install -f?
2. When using scripts: Is there any way to pass, e.g., {staged_files} values through to a bash runner? Similarly, can I pass through a glob that contains a subset of files?
3. Continuing on the above question, the point of offloading scanners, e.g. semgrep, into a script is because I want to precede the scan with logic that ensures the tooling is installed. Is there a better way to approach this? I had explored pipes and other functionality, but would prefer each script is run in parallel and the other options I saw seemed to not allow that.

Sorry for the dump, but evaluating implementing with our Engineering team, and need to capture as much info as I can. A dump of questions seemed like the quickest path forward.

Sincerely,
Jonathan

[mrexox]

Hey @createchange!

1. Yes, but actually just lefthook install should work. So, changes are pulled only manually.
2. Unfortunately, no. Scripts accept git args, so no custom arguments can be passed. However you can use commands option and explicitly run scripts with the arguments you want. But this won't work if you are using remote lefthook configs.
3. Unfortunately right now there's no way to ensure the tooling is properly installed. I am thinking of a good configuration for that, something like prepare script that runs on first lefthook install. But I don't have a strong opinion on how to achieve that. I can suggest you to use fail_text option to tell the user how to install a proper tool.

I am glad to see that remote feature is being used. Could you share a small example of a configuration you are trying to create with the tool and the scripts that use it? Maybe this is still possible to pass, let's say, {staged_files} to a script or transform the scripts to commands. Please, note that you can use the following syntax:

pre-commit:
  commands:
    multiline:
      run: |
        echo 'this is pretty similar to a script'
        echo 'a bit limited'
        if test 1 -eq 1; then
          echo 'but still working'
        fi

[createchange]

1. Noted - thanks for the clarification.
2. No worries on this. Would be nice to have those arguments available, but I can get around it by parsing out that information myself.
3. prepare_tooling would be great, but I do appreciate the advice on fail_text. I can make use of that in multiple ways, and had previously glossed over that potential.

The remote functionality should be great for us, especially because I am going to be centrally managing rulesets. Our team has way too many repositories to where managing in each project would be a nightmare to manage. Any change to a scan definition or flag, e.g. would result in 100+ changes. It's also great that I can allow the engineers to merge their own jobs if they so choose.

Here is an example of one such script:

#!/bin/bash

set -e

gitleaks_cmd="gitleaks"

if ! command -v "$gitleaks_cmd" &> /dev/null; then
    echo "$gitleaks_cmd not found in PATH. Installing..."
    HOMEBREW_NO_AUTO_UPDATE=1 brew install "$gitleaks_cmd" 1> /dev/null
fi

# Get default ruleset
GITLEAKS_RULESET_URL="https://raw.githubusercontent.com/zricethezav/gitleaks/master/config/gitleaks.toml"
wget $GITLEAKS_RULESET_URL -O $HOME/.gitleaks.toml --quiet --no-check-certificate

# Synthesize default config with company-specific rules
cat <<EOT >> $HOME/.gitleaks.toml
[[rules]]
description = "Check for 1"
id = "id1"
regex = '''custom_rule''

[[rules]]
description = "Check for 2"
id = "id2"
regex ='''custom_rule'''
EOT

# Run scan
gitleaks protect --staged --config $HOME/.gitleaks.toml --verbose

I have tried a less verbose example using your suggestion here:

pre-commit:
  commands:
    flake8:
      run: |
        flake8_cmd="flake8"

        if ! command -v "$flake8_cmd" &> /dev/null; then
            echo "$flake8_cmd not found in PATH. Installing..."
            pip install "$flake8_cmd" 1> /dev/null
        fi

        # this would be replaced by usage of {staged_files}
        staged_files=$(git diff --staged --name-only | grep -E "\.py$" || true)

        if [ -z $staged_files ]; then
            exit 0
        else
            flake8 $staged_files --exclude .venv
        fi

This worked just fine - but I think for readability sake - for whoever comes after me - it might be better to have the individuals jobs partitioned off into their own scripts.

Thanks again for your responsiveness. Having used some other, significantly larger open source projects with basically zero support anywhere you look, this has been a breath of fresh air.