43 lines
1.3 KiB
YAML
43 lines
1.3 KiB
YAML
repos:
|
|
- repo: https://github.com/pre-commit/pre-commit-hooks
|
|
rev: v4.6.0
|
|
hooks:
|
|
- id: trailing-whitespace
|
|
- id: end-of-file-fixer
|
|
- id: check-yaml
|
|
args: [--unsafe] # ansible vault files have !vault tag
|
|
- id: check-added-large-files
|
|
args: [--maxkb=500]
|
|
- id: detect-private-key
|
|
- id: check-merge-conflict
|
|
|
|
- repo: https://github.com/Yelp/detect-secrets
|
|
rev: v1.5.0
|
|
hooks:
|
|
- id: detect-secrets
|
|
args: [--baseline, .secrets.baseline]
|
|
exclude: inventory/host_vars/.* # juz szyfrowane vault'em
|
|
|
|
- repo: local
|
|
hooks:
|
|
- id: no-vault-pass
|
|
name: vault.pass nie moze byc commitowany
|
|
entry: bash
|
|
args: [-c, 'git diff --cached --name-only | grep -q "vault.pass" && echo "ERROR: vault.pass jest w staged files!" && exit 1 || true']
|
|
language: system
|
|
pass_filenames: false
|
|
|
|
- id: no-unencrypted-hostvars
|
|
name: host_vars musza byc zaszyfrowane
|
|
entry: bash
|
|
args:
|
|
- -c
|
|
- |
|
|
for f in $(git diff --cached --name-only | grep "inventory/host_vars/"); do
|
|
if ! head -1 "$f" 2>/dev/null | grep -q '^\$ANSIBLE_VAULT'; then
|
|
echo "ERROR: $f nie jest zaszyfrowany!"; exit 1
|
|
fi
|
|
done
|
|
language: system
|
|
pass_filenames: false
|