overcommit 0.75.0 → 0.76.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 825a9ffd0ad7bacf35ecb3901ead1f1249085cad5536314434e89ce5ff802d15
-  data.tar.gz: f4d3ea4ecbc7d2fe7d2c35e1dd4d44f86e30a2e31ba241366735937952a95c30
+  metadata.gz: b471934e19dc5c5c31b3ec1b5ed3dccebb4b54990cd3612890623310151fc189
+  data.tar.gz: 054c6937dc7c9dde353d2be3f6f03e4ad38bee29f2c348b4299a1ed2e004f36e
 SHA512:
-  metadata.gz: 590bcf4bdb5bb506425bbc41050adaa16311baa45f37071d1ffc0a9d96412f508f552eeea2278946bbab622af3aa0a6d216d388c520e41804a4f4dc7ee69e381
-  data.tar.gz: 73222064a9fcc44930ae9c027c19bb851004d5d1000303854b52c2650ef52ef29177f783e9faa5e064717be3ea03e676512a1dd631ddf68f459acbeb46e08df4
+  metadata.gz: 7b32d40b8a2cb773a9bfb7007f67b50c93de5669c5d27df4ea2bfe1e45bd8a771313e3ec8ce79dbadd0762b4ab7b04ef90cd77dfebe5fb019bd33c5417b0bab2
+  data.tar.gz: cd1fbd57591dabb7b8ccbf4862e3c0ee3cbb2c2a9c6f0f9e6e2584066c6fbf4b5b77eaaa40ca0bc3638c2c805244991d56704ce9acb2b4a7aed3f0b682718389

data/config/default.yml

@@ -43,6 +43,10 @@ gemfile: false
 # to the root of the repository.
 plugin_directory: '.git-hooks'
 
+# Explicit namespaces for gem-provided hooks. No gems are loaded by default.
+# Example: { Company: overcommit-company }
+gem_plugins: {}
+
 # Whether to hide hook output by default. This results in completely silent hook
 # runs except in the case of warning or failure.
 quiet: false
@@ -165,6 +169,7 @@ PreCommit:
     description: 'Check for vulnerable versions of gems'
     required_executable: 'bundle-audit'
     install_command: 'gem install bundler-audit'
+    update: false # Update ruby-advisory-db before checking for vulnerabilities
 
   BundleCheck:
     enabled: false
@@ -949,6 +954,57 @@ PreCommit:
     install_command: 'gem install travis'
     include: '.travis.yml'
 
+  Vale:
+    enabled: false
+    description: 'Check spelling and style with Vale'
+    required_executable: 'vale'
+    install_command: 'brew install vale'
+    message_pattern: !ruby/regexp /^(?<file>(?:\w:)?[^:]+):(?<line>[0-9]+):/
+    flags: ['--output=line']
+    include:
+      # Text, markup, and source formats supported by Vale. Some formats require
+      # additional software/configuration; use 'exclude' to disable them.
+      - '**/*.adoc'
+      - '**/*.bsh'
+      - '**/*.c'
+      - '**/*.cc'
+      - '**/*.cpp'
+      - '**/*.cs'
+      - '**/*.css'
+      - '**/*.csx'
+      - '**/*.cxx'
+      - '**/*.dita'
+      - '**/*.java'
+      - '**/*.js'
+      - '**/*.go'
+      - '**/*.h'
+      - '**/*.hpp'
+      - '**/*.hs'
+      - '**/*.html'
+      - '**/*.less'
+      - '**/*.lua'
+      - '**/*.md'
+      - '**/*.php'
+      - '**/*.pl'
+      - '**/*.pm'
+      - '**/*.pod'
+      - '**/*.py'
+      - '**/*.py3'
+      - '**/*.pyi'
+      - '**/*.pyw'
+      - '**/*.R'
+      - '**/*.r'
+      - '**/*.rb'
+      - '**/*.rpy'
+      - '**/*.rst'
+      - '**/*.sass'
+      - '**/*.sbt'
+      - '**/*.scala'
+      - '**/*.swift'
+      - '**/*.txt'
+      - '**/*.xhtml'
+      - '**/*.xml'
+
   Vint:
     enabled: false
     description: 'Analyze with Vint'

data/lib/overcommit/cli.rb

@@ -17,7 +17,7 @@ module Overcommit
       Overcommit::Utils.log = logger
     end
 
-    def run
+    def run # rubocop:disable Metrics/MethodLength
       parse_arguments
 
       case @options[:action]
@@ -35,6 +35,12 @@ module Overcommit
     rescue Overcommit::Exceptions::ConfigurationSignatureChanged => e
       puts e
       exit 78 # EX_CONFIG
+    rescue Overcommit::Exceptions::InvalidHookSignature
+      exit 78 # EX_CONFIG
+    rescue Overcommit::Exceptions::ConfigurationError,
+           Overcommit::Exceptions::HookLoadError => e
+      puts e
+      exit 78 # EX_CONFIG
     rescue Overcommit::Exceptions::HookContextLoadError => e
       puts e
       exit 64 # EX_USAGE

data/lib/overcommit/configuration.rb

@@ -127,12 +127,19 @@ module Overcommit
         select { |hook_name| hook_enabled?(hook_context, hook_name) }
     end
 
+    # Gem hooks are explicitly namespaced; discovery never executes gem code.
+    def enabled_gem_hooks(hook_context)
+      @hash[hook_context.hook_class_name].keys.select do |hook_name|
+        hook_name.include?('::') && hook_enabled?(hook_context, hook_name)
+      end
+    end
+
     # Returns a non-modifiable configuration for a hook.
     def for_hook(hook, hook_type = nil)
       unless hook_type
         components = hook.class.name.split('::')
-        hook = components.last
-        hook_type = components[-2]
+        hook = components[3..].join('::')
+        hook_type = components[2]
       end
 
       # Merge hook configuration with special 'ALL' config
@@ -155,8 +162,9 @@ module Overcommit
     # Applies additional configuration settings based on the provided
     # environment variables.
     def apply_environment!(hook_context, env)
-      skipped_hooks = "#{env['SKIP']} #{env['SKIP_CHECKS']} #{env['SKIP_HOOKS']}".split(/[:, ]/)
-      only_hooks = env.fetch('ONLY') { '' }.split(/[:, ]/)
+      separator = /(?<!:):(?!:)|[, ]/
+      skipped_hooks = "#{env['SKIP']} #{env['SKIP_CHECKS']} #{env['SKIP_HOOKS']}".split(separator)
+      only_hooks = env.fetch('ONLY') { '' }.split(separator)
       hook_type = hook_context.hook_class_name
 
       if only_hooks.any? || skipped_hooks.include?('all') || skipped_hooks.include?('ALL')
@@ -179,6 +187,10 @@ module Overcommit
     end
 
     def plugin_hook?(hook_context_or_type, hook_name)
+      if hook_name.include?('::')
+        return (@hash['gem_plugins'] || {}).key?(hook_name.split('::').first)
+      end
+
       hook_type_name =
         if hook_context_or_type.is_a?(String)
           Overcommit::Utils.snake_case(hook_context_or_type)
@@ -190,12 +202,11 @@ module Overcommit
       File.exist?(File.join(plugin_directory, hook_type_name, "#{hook_name}.rb"))
     end
 
-    # Return whether the signature for this configuration has changed since it
-    # was last calculated.
+    # Return whether this configuration has been explicitly trusted before.
     #
     # @return [true,false]
-    def signature_changed?
-      signature != stored_signature
+    def signature_verified?
+      signature_store.include?(signature)
     end
 
     # Return whether a previous signature has been recorded for this
@@ -203,7 +214,7 @@ module Overcommit
     #
     # @return [true,false]
     def previous_signature?
-      !stored_signature.empty?
+      signature_store.recorded?
     end
 
     # Returns whether this configuration should verify itself by checking the
@@ -233,13 +244,10 @@ module Overcommit
 
     # Update the currently stored signature for this hook.
     def update_signature!
+      signature_store.add(signature)
       scope = Overcommit::GitConfig.signature_scope
-      result = Overcommit::Utils.execute(
-        %W[git config #{scope}] + [signature_config_key, signature]
-      )
-
       verify_signature_value = @hash['verify_signatures'] ? 1 : 0
-      result &&= Overcommit::Utils.execute(
+      result = Overcommit::Utils.execute(
         %W[git config #{scope} #{verify_signature_config_key} #{verify_signature_value}]
       )
 
@@ -261,11 +269,14 @@ module Overcommit
       # Ad hoc hooks are neither built-in nor have a plugin file written but
       # still have a `command` specified to be run
       !built_in_hook?(hook_context, hook_name) &&
+        !hook_name.include?('::') &&
         !plugin_hook?(hook_context, hook_name) &&
         (ad_hoc_conf['command'] || ad_hoc_conf['required_executable'])
     end
 
     def built_in_hook?(hook_context, hook_name)
+      return false if hook_name.include?('::')
+
       hook_name = Overcommit::Utils.snake_case(hook_name)
 
       File.exist?(File.join(Overcommit::HOME, 'lib', 'overcommit', 'hook',
@@ -320,26 +331,8 @@ module Overcommit
       Digest::SHA256.hexdigest(@hash.to_json)
     end
 
-    # Returns the stored signature of this repo's Overcommit configuration.
-    #
-    # This is intended to be compared against the current signature of this
-    # configuration object.
-    #
-    # @return [String]
-    def stored_signature
-      scope = Overcommit::GitConfig.signature_scope
-      result = Overcommit::Utils.execute(
-        %W[git config #{scope} --get] + [signature_config_key]
-      )
-
-      if result.status == 1 # Key doesn't exist
-        return ''
-      elsif result.status != 0
-        raise Overcommit::Exceptions::GitConfigError,
-              "Unable to read from local repo git config: #{result.stderr}"
-      end
-
-      result.stdout.chomp
+    def signature_store
+      @signature_store ||= Overcommit::Signature.new(signature_config_key)
     end
 
     def signature_config_key

data/lib/overcommit/configuration_loader.rb

@@ -28,7 +28,7 @@ module Overcommit
         # default. Explicitly enable aliases if the option is available.
         yaml =
           begin
-            YAML.load_file(file, aliases: true)
+            YAML.load_file(file, permitted_classes: [Regexp, Symbol], aliases: true)
           rescue ArgumentError
             YAML.load_file(file)
           end
@@ -95,7 +95,7 @@ module Overcommit
               "No previously recorded signature for configuration file.\n" \
               'Run `overcommit --sign` if you trust the hooks in this repository.'
 
-      elsif config.signature_changed?
+      elsif !config.signature_verified?
         raise Overcommit::Exceptions::ConfigurationSignatureChanged,
               "Signature of configuration file has changed!\n" \
               "Run `overcommit --sign` once you've verified the configuration changes."

data/lib/overcommit/configuration_validator.rb

@@ -18,6 +18,7 @@ module Overcommit
 
       hash = convert_nils_to_empty_hashes(hash)
       ensure_hook_type_sections_exist(hash)
+      check_gem_plugins(hash)
       check_hook_name_format(hash)
       check_hook_env(hash)
       check_for_missing_enabled_option(hash) unless @options[:default]
@@ -29,6 +30,19 @@ module Overcommit
 
     private
 
+    # Validate declarations without resolving, activating, or requiring gems.
+    def check_gem_plugins(hash)
+      plugins = hash.fetch('gem_plugins', {})
+      valid = plugins.is_a?(Hash) && plugins.all? do |namespace, gem_name|
+        namespace.is_a?(String) && namespace.match?(/\A[A-Z][A-Za-z0-9]*\z/) &&
+          gem_name.is_a?(String) && gem_name.match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.-]*\z/)
+      end
+      return if valid
+
+      raise Overcommit::Exceptions::ConfigurationError,
+            '`gem_plugins` must map CamelCase namespaces to gem names'
+    end
+
     # Ensures that keys for all supported hook types exist (PreCommit,
     # CommitMsg, etc.)
     def ensure_hook_type_sections_exist(hash)
@@ -102,10 +116,10 @@ module Overcommit
         hash.fetch(hook_type) { {} }.each_key do |hook_name|
           next if hook_name == 'ALL'
 
-          unless hook_name.match?(/\A[A-Za-z0-9]+\z/)
+          unless hook_name.match?(/\A(?:[A-Z][A-Za-z0-9]*::[A-Z][A-Za-z0-9]*|[A-Za-z0-9]+)\z/)
             errors << "#{hook_type}::#{hook_name} has an invalid name " \
-                      "#{hook_name}. It must contain only alphanumeric " \
-                      'characters (no underscores or dashes, etc.)'
+                      "#{hook_name}. Use an alphanumeric name or Namespace::HookName " \
+                      '(no underscores or dashes, etc.)'
           end
         end
       end

data/lib/overcommit/exceptions.rb

@@ -13,6 +13,9 @@ module Overcommit::Exceptions
   # Raised when trying to read/write to/from the local repo git config fails.
   class GitConfigError < Error; end
 
+  # Raised when local signature history cannot be read or written.
+  class SignatureError < Error; end
+
   # Raised when there was a problem reading submodule information for a repo.
   class GitSubmoduleError < Error; end
 

data/lib/overcommit/gem_plugin.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+require 'digest'
+require 'find'
+require 'json'
+
+module Overcommit
+  # A gem source and its approval, resolved without requiring its entrypoint.
+  class GemPlugin # rubocop:disable Metrics/ClassLength
+    attr_reader :namespace, :hook_names
+
+    def initialize(namespace, config, context)
+      @namespace = namespace
+      @config = config
+      @context = context
+      @gem_name = (config['gem_plugins'] || {})[namespace]
+      unless @gem_name
+        raise Overcommit::Exceptions::HookLoadError,
+              "Declare the gem for #{namespace} in `gem_plugins`"
+      end
+      @hook_names = config.enabled_gem_hooks(context).
+        select { |name| name.start_with?("#{namespace}::") }
+    end
+
+    def hook_name
+      "#{namespace} (gem #{@gem_name})"
+    end
+
+    def hook_path
+      specification.full_gem_path
+    end
+
+    def signature_verified?
+      signature_store.include?(signature)
+    end
+
+    def update_signature!
+      signature_store.add(signature)
+    end
+
+    # Resolve every hook before requiring any code, so a missing hook fails closed.
+    def hook_paths
+      hook_names.map do |name|
+        relative = File.join('overcommit', 'hooks', @context.hook_type_name,
+                             "#{Overcommit::Utils.snake_case(name.split('::').last)}.rb")
+        paths = specification.require_paths.map do |root|
+          File.expand_path(File.join(root, relative), hook_path)
+        end
+        path = paths.find { |candidate| File.file?(candidate) }
+        path = File.realpath(path) if path
+        unless path&.start_with?(File.realpath(hook_path) + File::SEPARATOR)
+          raise Overcommit::Exceptions::HookLoadError,
+                "Gem #{@gem_name} does not provide #{name} at #{relative}"
+        end
+        path
+      end
+    end
+
+    def activate
+      specifications.reverse_each(&:activate)
+    rescue Gem::LoadError => e
+      raise Overcommit::Exceptions::HookLoadError, "Unable to activate #{@gem_name}: #{e.message}"
+    end
+
+    private
+
+    def specification
+      @specification ||= find_specification(@gem_name)
+    end
+
+    def find_specification(name, requirement = Gem::Requirement.default)
+      spec = Gem.loaded_specs[name] || Gem::Specification.find_by_name(name, requirement)
+      unless requirement.satisfied_by?(spec.version)
+        raise Gem::LoadError, "#{name} #{spec.version} does not satisfy #{requirement}"
+      end
+
+      spec
+    rescue Gem::LoadError => e
+      raise Overcommit::Exceptions::HookLoadError,
+            "Unable to resolve gem plugin #{@gem_name}: #{e.message}. " \
+            'Install the gem and its dependencies; include them in your Gemfile when using Bundler.'
+    end
+
+    def specifications
+      @specifications ||= collect_specifications(specification, {}).values.sort_by(&:name)
+    end
+
+    def collect_specifications(spec, found)
+      if found.key?(spec.name)
+        unless found[spec.name].version == spec.version
+          raise Overcommit::Exceptions::HookLoadError, "Conflicting versions of #{spec.name}"
+        end
+
+        return found
+      end
+
+      found[spec.name] = spec
+      spec.runtime_dependencies.each do |dependency|
+        # Overcommit itself is already running and trusted, like built-in hooks.
+        next if dependency.name == 'overcommit'
+
+        collect_specifications(find_specification(dependency.name, dependency.requirement), found)
+      end
+      found
+    end
+
+    def signature
+      digest = Digest::SHA256.new
+      settings = hook_names.sort.map do |name|
+        hook_config = @config.for_hook(name, @context.hook_class_name).
+          reject { |key, _| HookSigner::IGNORED_CONFIG_KEYS.include?(key) }
+        [name, hook_config]
+      end
+      digest << JSON.generate([namespace, @gem_name, settings])
+      specifications.each do |spec|
+        digest << JSON.generate([spec.full_name, spec.require_paths,
+                                 spec.runtime_dependencies.map(&:to_s).sort])
+        gem_roots(spec).each_with_index do |root, index|
+          digest << JSON.generate(index)
+          sign_directory(digest, root)
+        end
+      end
+      digest.hexdigest
+    end
+
+    def gem_roots(spec)
+      roots = [spec.full_gem_path] + spec.full_require_paths
+      roots = roots.select { |root| File.directory?(root) }.
+        map { |root| File.realpath(root) }.uniq
+      if roots.empty?
+        raise Overcommit::Exceptions::HookLoadError,
+              "Unable to find contents of gem #{spec.full_name} for approval"
+      end
+
+      roots.reject do |root|
+        roots.any? { |parent| root.start_with?(parent + File::SEPARATOR) }
+      end.sort
+    end
+
+    # Cover helpers, data, added/deleted files, and native extensions, rather
+    # than just the selected hook file or a gem's potentially incomplete manifest.
+    def sign_directory(digest, root)
+      Find.find(root, ignore_error: false) do |path|
+        if File.basename(path) == '.git'
+          Find.prune
+        elsif File.symlink?(path)
+          raise Overcommit::Exceptions::HookLoadError,
+                "Gem plugin approvals cannot cover symbolic links: #{path}"
+        elsif File.file?(path)
+          relative = path.delete_prefix(root + File::SEPARATOR)
+          digest << JSON.generate([relative, Digest::SHA256.file(path).hexdigest])
+        end
+      end
+    rescue SystemCallError => e
+      raise Overcommit::Exceptions::HookLoadError,
+            "Unable to read gem plugin #{@gem_name}: #{e.message}"
+    end
+
+    def signature_store
+      @signature_store ||= Overcommit::Signature.new(
+        "overcommit.#{@context.hook_class_name}.#{namespace}.gemsignature"
+      )
+    end
+  end
+end

data/lib/overcommit/git_config.rb

@@ -13,6 +13,24 @@ module Overcommit
       char
     end
 
+    # Git does not pass cleanup options to commit-msg hooks. Use the invoking
+    # command's override, then configuration, and Git's documented editor marker.
+    def commit_cleanup_mode
+      command = Overcommit::Utils.parent_command.to_s.scrub
+      modes = command.scan(
+        /(?:\A|\s)["']?--cleanup
+         (?:=["']?|["']?\s+["']?)
+         (strip|whitespace|verbatim|scissors|default)["']?(?=\s|\z)/x
+      )
+      mode = modes.last&.first || `git config --get commit.cleanup`.chomp
+      Overcommit::Utils.log&.debug("Commit cleanup mode #{mode.inspect} from #{command.inspect}")
+      if mode.empty? || mode == 'default'
+        ENV['GIT_EDITOR'] == ':' ? 'whitespace' : 'strip'
+      else
+        mode
+      end
+    end
+
     def hooks_path
       path = `git config --get core.hooksPath`.chomp
       return File.join(Overcommit::Utils.git_dir, 'hooks') if path.empty?

data/lib/overcommit/git_repo.rb

@@ -136,9 +136,20 @@ module Overcommit
     #
     # @return [Array<String>] list of absolute file paths
     def all_files
-      deleted_files = `git ls-files --deleted`.split(/\n/)
+      deleted_files, tracked_files = [%w[git ls-files -z --deleted],
+                                      %w[git ls-files -z]].map do |command|
+        result = Overcommit::Utils.execute(command)
+        unless result.success?
+          raise Overcommit::Exceptions::Error,
+                "Error listing files. EXIT STATUS: #{result.status}.\n" \
+                "STDOUT: #{result.stdout}.\n" \
+                "STDERR: #{result.stderr}."
+        end
+
+        result.stdout.split("\0")
+      end
 
-      (`git ls-files`.split(/\n/) - deleted_files).
+      (tracked_files - deleted_files).
         map { |relative_file| File.expand_path(relative_file) }.
         reject { |file| File.directory?(file) } # Exclude submodule directories
     end

data/lib/overcommit/hook/base.rb

@@ -52,7 +52,7 @@ module Overcommit::Hook
     end
 
     def name
-      self.class.name.split('::').last
+      self.class.name.split('::')[3..].join('::')
     end
 
     def description

data/lib/overcommit/hook/commit_msg/spell_check.rb

@@ -12,7 +12,11 @@ module Overcommit::Hook::CommitMsg
     MISSPELLING_REGEX = /^[&#]\s(?<word>\w+)(?:.+?:\s(?<suggestions>.*))?/.freeze
 
     def run
-      result = execute(command + [uncommented_commit_msg_file])
+      result = ::Tempfile.create('commit-msg') do |file|
+        file.write(commit_message)
+        file.close
+        execute(command + [file.path])
+      end
       return [:fail, "Error running spellcheck: #{result.stderr.chomp}"] unless result.success?
 
       misspellings = parse_misspellings(result.stdout)
@@ -29,13 +33,6 @@ module Overcommit::Hook::CommitMsg
 
     private
 
-    def uncommented_commit_msg_file
-      ::Tempfile.open('commit-msg') do |file|
-        file.write(commit_message)
-        file.path
-      end
-    end
-
     def parse_misspellings(output)
       output.scan(MISSPELLING_REGEX).map do |word, suggestions|
         Misspelling.new(word, suggestions)

data/lib/overcommit/hook/pre_commit/bundle_audit.rb

@@ -3,6 +3,8 @@
 module Overcommit::Hook::PreCommit
   # Checks for vulnerable versions of gems in Gemfile.lock.
   #
+  # Set `update: true` to refresh ruby-advisory-db before checking. Defaults to false.
+  #
   # @see https://github.com/rubysec/bundler-audit
   class BundleAudit < Base
     LOCK_FILE = 'Gemfile.lock'
@@ -13,7 +15,10 @@ module Overcommit::Hook::PreCommit
                       stdout.split("\n")
       return :pass if ignored_files.include?(LOCK_FILE)
 
-      result = execute(command)
+      audit_command = command
+      audit_command << '--update' if config['update']
+
+      result = execute(audit_command)
       if result.success?
         :pass
       else

data/lib/overcommit/hook/pre_commit/line_endings.rb

@@ -9,8 +9,7 @@ module Overcommit::Hook::PreCommit
       messages = []
 
       offending_files.map do |file_name|
-        file = File.open(file_name)
-        begin
+        File.open(file_name) do |file|
           messages += check_file(file, file_name)
         rescue ArgumentError => e
           # File is likely a binary file which this check should ignore, but

data/lib/overcommit/hook/pre_commit/yaml_syntax.rb

@@ -7,7 +7,7 @@ module Overcommit::Hook::PreCommit
       messages = []
 
       applicable_files.each do |file|
-        YAML.load_file(file, aliases: true)
+        YAML.load_file(file, permitted_classes: [Regexp, Symbol], aliases: true)
       rescue ArgumentError
         begin
           YAML.load_file(file)