javi-forge 1.25.0 → 1.26.0

package/templates/security-hooks/pre-push-deps

@@ -1,83 +0,0 @@
-#!/bin/bash
-# =============================================================================
-# SECURITY LAYER 2: Dependency Audit (pre-push)
-# =============================================================================
-# Runs dependency vulnerability audit before pushing.
-# Checks for known CVEs in project dependencies.
-#
-# Supports: npm/pnpm/yarn, pip-audit, cargo audit, govulncheck
-# To skip:  git push --no-verify (NOT recommended)
-# =============================================================================
-
-set -e
-
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-GREEN='\033[0;32m'
-NC='\033[0m'
-
-echo "SECURITY [2/6]: Dependency audit..."
-
-# Auto-detect stack and run appropriate audit
-if [ -f "package.json" ]; then
-    if [ -f "pnpm-lock.yaml" ]; then
-        echo -e "${YELLOW}  Running: pnpm audit${NC}"
-        pnpm audit --audit-level=high 2>/dev/null || {
-            echo -e "${RED}  High/critical vulnerabilities found in dependencies.${NC}"
-            echo -e "${YELLOW}  Run 'pnpm audit' for details, 'pnpm audit --fix' to auto-fix.${NC}"
-            exit 1
-        }
-    elif [ -f "yarn.lock" ]; then
-        echo -e "${YELLOW}  Running: yarn npm audit${NC}"
-        yarn npm audit --severity high 2>/dev/null || {
-            echo -e "${RED}  High/critical vulnerabilities found in dependencies.${NC}"
-            echo -e "${YELLOW}  Run 'yarn npm audit' for details.${NC}"
-            exit 1
-        }
-    else
-        echo -e "${YELLOW}  Running: npm audit${NC}"
-        npm audit --audit-level=high 2>/dev/null || {
-            echo -e "${RED}  High/critical vulnerabilities found in dependencies.${NC}"
-            echo -e "${YELLOW}  Run 'npm audit' for details, 'npm audit fix' to auto-fix.${NC}"
-            exit 1
-        }
-    fi
-elif [ -f "requirements.txt" ] || [ -f "pyproject.toml" ]; then
-    if command -v pip-audit &>/dev/null; then
-        echo -e "${YELLOW}  Running: pip-audit${NC}"
-        pip-audit 2>/dev/null || {
-            echo -e "${RED}  Vulnerabilities found in Python dependencies.${NC}"
-            echo -e "${YELLOW}  Run 'pip-audit' for details.${NC}"
-            exit 1
-        }
-    else
-        echo -e "${YELLOW}  pip-audit not installed. Skipping. Install: pip install pip-audit${NC}"
-    fi
-elif [ -f "Cargo.toml" ]; then
-    if command -v cargo-audit &>/dev/null; then
-        echo -e "${YELLOW}  Running: cargo audit${NC}"
-        cargo audit 2>/dev/null || {
-            echo -e "${RED}  Vulnerabilities found in Rust dependencies.${NC}"
-            echo -e "${YELLOW}  Run 'cargo audit' for details.${NC}"
-            exit 1
-        }
-    else
-        echo -e "${YELLOW}  cargo-audit not installed. Skipping. Install: cargo install cargo-audit${NC}"
-    fi
-elif [ -f "go.mod" ]; then
-    if command -v govulncheck &>/dev/null; then
-        echo -e "${YELLOW}  Running: govulncheck${NC}"
-        govulncheck ./... 2>/dev/null || {
-            echo -e "${RED}  Vulnerabilities found in Go dependencies.${NC}"
-            echo -e "${YELLOW}  Run 'govulncheck ./...' for details.${NC}"
-            exit 1
-        }
-    else
-        echo -e "${YELLOW}  govulncheck not installed. Skipping. Install: go install golang.org/x/vuln/cmd/govulncheck@latest${NC}"
-    fi
-else
-    echo -e "${YELLOW}  No supported dependency manifest found. Skipping.${NC}"
-fi
-
-echo -e "${GREEN}  Dependency audit passed.${NC}"
-exit 0

package/templates/security-hooks/pre-push-signing

@@ -1,67 +0,0 @@
-#!/bin/bash
-# =============================================================================
-# SECURITY LAYER 4: Code Signing Verification (pre-push)
-# =============================================================================
-# Checks that commits being pushed are GPG/SSH signed (if configured).
-# Warns but does not block if signing is not configured.
-#
-# To skip:  git push --no-verify (NOT recommended)
-# =============================================================================
-
-set -e
-
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-GREEN='\033[0;32m'
-CYAN='\033[0;36m'
-NC='\033[0m'
-
-echo "SECURITY [4/6]: Code signing check..."
-
-# Check if commit signing is configured
-SIGN_KEY=$(git config --get user.signingkey 2>/dev/null || echo "")
-GPG_SIGN=$(git config --get commit.gpgsign 2>/dev/null || echo "false")
-GPG_FORMAT=$(git config --get gpg.format 2>/dev/null || echo "openpgp")
-
-if [ -z "$SIGN_KEY" ] || [ "$GPG_SIGN" != "true" ]; then
-    echo -e "${YELLOW}  Commit signing not configured. Skipping verification.${NC}"
-    echo -e "${CYAN}  To enable: git config --global commit.gpgsign true${NC}"
-    echo -e "${CYAN}  GPG:  git config --global user.signingkey <KEY_ID>${NC}"
-    echo -e "${CYAN}  SSH:  git config --global gpg.format ssh && git config --global user.signingkey ~/.ssh/id_ed25519.pub${NC}"
-    exit 0
-fi
-
-# Verify recent commits are signed
-REMOTE="$1"
-URL="$2"
-
-while read -r LOCAL_REF LOCAL_OID REMOTE_REF REMOTE_OID; do
-    if [ "$LOCAL_OID" = "0000000000000000000000000000000000000000" ]; then
-        continue  # Branch deletion
-    fi
-
-    # Check last 10 commits (or all new ones)
-    RANGE=""
-    if [ "$REMOTE_OID" = "0000000000000000000000000000000000000000" ]; then
-        RANGE="$LOCAL_OID"
-    else
-        RANGE="$REMOTE_OID..$LOCAL_OID"
-    fi
-
-    UNSIGNED=$(git log --format='%H %G?' "$RANGE" 2>/dev/null | grep -E ' N$' | head -5 || true)
-
-    if [ -n "$UNSIGNED" ]; then
-        echo -e "${YELLOW}  Warning: unsigned commits detected:${NC}"
-        echo "$UNSIGNED" | while read -r hash status; do
-            MSG=$(git log --format='%s' -1 "$hash" 2>/dev/null)
-            echo -e "${YELLOW}    ${hash:0:8} $MSG${NC}"
-        done
-        echo -e "${YELLOW}  Signing is configured but some commits are unsigned.${NC}"
-        echo -e "${CYAN}  To sign: git commit -S -m 'message'${NC}"
-        echo -e "${CYAN}  To amend: git commit --amend -S${NC}"
-        # Warning only, don't block
-    fi
-done
-
-echo -e "${GREEN}  Signing check complete.${NC}"
-exit 0