56 lines
1.6 KiB
Bash
56 lines
1.6 KiB
Bash
#! /usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
readonly HOOK_NAME="$(basename "$0")"
|
|
|
|
if ! [[ "$HOOK_NAME" =~ ^(pre-(commit|push)|post-checkout)$ ]]
|
|
then
|
|
echo "Unknown hook '${HOOK_NAME}'."
|
|
exit 1
|
|
fi
|
|
|
|
readonly SENSITIVE_FILES=("justfile" "build.rs" "rust-toolchain.toml")
|
|
readonly BASE_BRANCH="master"
|
|
|
|
# Check which files were modified compared to the base branch.
|
|
mapfile -t CHANGED_FILES < <(comm -12 \
|
|
<(git diff --name-only "${BASE_BRANCH}" | sort) \
|
|
<(IFS=$'\n'; echo "${SENSITIVE_FILES[*]}" | sort) \
|
|
)
|
|
|
|
if [ ${#CHANGED_FILES[@]} -gt 0 ]; then
|
|
echo "⚠️ WARNING: Sensitive files have been modified relative to $BASE_BRANCH."
|
|
echo "Executing this hook may run arbitrary code from the modified files."
|
|
echo ""
|
|
|
|
git --no-pager diff "$BASE_BRANCH" -- "${SENSITIVE_FILES[@]}"
|
|
|
|
# Read from /dev/tty because stdin is not attached to the terminal in Git hooks.
|
|
exec < /dev/tty
|
|
|
|
read -r -p "Do you want to continue executing the ${HOOK_NAME} hooks? [y/N] " response
|
|
case "$response" in
|
|
[yY][eE][sS]|[yY])
|
|
echo "Continuing with '${HOOK_NAME}' hook..."
|
|
;;
|
|
*)
|
|
echo "Skipping '${HOOK_NAME}' hook."
|
|
exit 0
|
|
;;
|
|
esac
|
|
fi
|
|
|
|
# Execute the appropriate just recipe based on the hook name
|
|
if [ "$HOOK_NAME" = "pre-commit" ]; then
|
|
echo "Running pre-commit checks..."
|
|
just pre-commit
|
|
elif [ "$HOOK_NAME" = "pre-push" ]; then
|
|
echo "Running pre-push checks..."
|
|
just pre-push
|
|
elif [ "$HOOK_NAME" = "post-checkout" ]; then
|
|
just post-checkout
|
|
else
|
|
echo "Unknown hook: $HOOK_NAME"
|
|
exit 1
|
|
fi
|