gitrupt 0.1.0__py3-none-any.whl

gitrupt/hooks/install.py

@@ -0,0 +1,255 @@
+"""
+Hook installer for Gitrupt.
+
+Safely installs Git hooks without destroying existing ones.
+Chains existing hooks rather than replacing them.
+
+Supports: pre-commit, pre-push.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import platform
+import stat
+import sys
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+GITRUPT_MARKER = "# Gitrupt pre-commit hook"
+GITRUPT_VERSION_MARKER = "# Gitrupt-version:"
+
+# Per-hook configuration: how to identify a Gitrupt-installed hook, and how
+# to build the shell template.
+_HOOK_MARKERS: dict[str, str] = {
+    "pre-commit": "# Gitrupt pre-commit hook",
+    "pre-push": "# Gitrupt pre-push hook",
+}
+
+_HOOK_MODULES: dict[str, str] = {
+    "pre-commit": "gitrupt.hooks.pre_commit",
+    "pre-push": "gitrupt.hooks.pre_push",
+}
+
+
+# ── Templates ───────────────────────────────────────────────────────────────
+
+PRE_COMMIT_TEMPLATE = """\
+#!/bin/sh
+{marker}
+{version_marker} {version}
+# Installed by Gitrupt. Do not edit manually.
+# Uninstall with: gitrupt uninstall
+
+"{python_executable}" -m {module}
+GITRUPT_EXIT=$?
+
+{existing_section}
+
+if [ $GITRUPT_EXIT -ne 0 ]; then
+    exit $GITRUPT_EXIT
+fi
+
+exit 0
+"""
+
+PRE_PUSH_TEMPLATE = """\
+#!/bin/sh
+{marker}
+{version_marker} {version}
+# Installed by Gitrupt. Do not edit manually.
+# Uninstall with: gitrupt uninstall
+#
+# $1 = remote name, $2 = remote URL
+# stdin = one line per ref: <local_ref> <local_sha> <remote_ref> <remote_sha>
+
+REMOTE_NAME="$1"
+REMOTE_URL="$2"
+
+# Capture stdin once so both Gitrupt and any chained hook can read it.
+STDIN_DATA=$(cat)
+
+printf '%s\\n' "$STDIN_DATA" | "{python_executable}" -m {module} "$REMOTE_NAME" "$REMOTE_URL"
+GITRUPT_EXIT=$?
+
+{existing_section}
+
+if [ $GITRUPT_EXIT -ne 0 ]; then
+    exit $GITRUPT_EXIT
+fi
+
+exit 0
+"""
+
+_EXISTING_PRE_COMMIT = """\
+# Run existing hook (preserved by Gitrupt)
+if [ -f "{backup}" ]; then
+    "{backup}" "$@"
+    EXISTING_EXIT=$?
+    if [ $EXISTING_EXIT -ne 0 ]; then
+        exit $EXISTING_EXIT
+    fi
+fi
+"""
+
+_EXISTING_PRE_PUSH = """\
+# Run existing hook (preserved by Gitrupt), feeding it the same stdin.
+if [ -f "{backup}" ]; then
+    printf '%s\\n' "$STDIN_DATA" | "{backup}" "$REMOTE_NAME" "$REMOTE_URL"
+    EXISTING_EXIT=$?
+    if [ $EXISTING_EXIT -ne 0 ]; then
+        exit $EXISTING_EXIT
+    fi
+fi
+"""
+
+_NO_EXISTING = "# No existing hook was present"
+
+
+class HookInstallError(Exception):
+    """Raised when hook installation fails."""
+
+
+class HookInstaller:
+    """Installs and manages Gitrupt Git hooks."""
+
+    def __init__(self, repo_root: str, hooks_dir: str) -> None:
+        self._repo_root = repo_root
+        self._hooks_dir = Path(hooks_dir)
+
+    # -------------------------------------------------------------------------
+    # Public API — pre-commit (backward compatible wrappers)
+    # -------------------------------------------------------------------------
+
+    def install_pre_commit(self) -> tuple[bool, bool, str]:
+        return self.install_hook("pre-commit")
+
+    def uninstall_pre_commit(self) -> tuple[bool, str]:
+        return self.uninstall_hook("pre-commit")
+
+    def is_installed(self) -> bool:
+        """Backward-compatible check for the pre-commit hook."""
+        return self.is_hook_installed("pre-commit")
+
+    def hook_path(self) -> str:
+        """Backward-compatible path for the pre-commit hook."""
+        return str(self._hooks_dir / "pre-commit")
+
+    # -------------------------------------------------------------------------
+    # Public API — generic
+    # -------------------------------------------------------------------------
+
+    def install_hook(self, hook_name: str) -> tuple[bool, bool, str]:
+        """
+        Install a Gitrupt hook.
+
+        Returns:
+            (success, had_existing_hook, hook_path)
+        """
+        if hook_name not in _HOOK_MARKERS:
+            raise HookInstallError(f"Unsupported hook: {hook_name}")
+
+        marker = _HOOK_MARKERS[hook_name]
+        hook_path = self._hooks_dir / hook_name
+        backup_path = self._hooks_dir / f"{hook_name}.gitrupt-backup"
+
+        had_existing = False
+        if hook_path.exists():
+            content = hook_path.read_text(encoding="utf-8", errors="replace")
+            if marker in content:
+                logger.info("Gitrupt %s hook already installed at %s", hook_name, hook_path)
+                return True, False, str(hook_path)
+
+            logger.info("Existing %s found, backing up to %s", hook_name, backup_path)
+            backup_path.write_bytes(hook_path.read_bytes())
+            _make_executable(backup_path)
+            had_existing = True
+
+        hook_content = self._build_hook_content(hook_name, str(backup_path) if had_existing else None)
+
+        try:
+            self._hooks_dir.mkdir(parents=True, exist_ok=True)
+            hook_path.write_text(hook_content, encoding="utf-8")
+            _make_executable(hook_path)
+        except OSError as e:
+            raise HookInstallError(f"Failed to write {hook_name} to {hook_path}: {e}") from e
+
+        logger.info("Installed %s hook at %s", hook_name, hook_path)
+        return True, had_existing, str(hook_path)
+
+    def uninstall_hook(self, hook_name: str) -> tuple[bool, str]:
+        if hook_name not in _HOOK_MARKERS:
+            raise HookInstallError(f"Unsupported hook: {hook_name}")
+
+        marker = _HOOK_MARKERS[hook_name]
+        hook_path = self._hooks_dir / hook_name
+        backup_path = self._hooks_dir / f"{hook_name}.gitrupt-backup"
+
+        if not hook_path.exists():
+            return False, str(hook_path)
+
+        content = hook_path.read_text(encoding="utf-8", errors="replace")
+        if marker not in content:
+            logger.warning("%s at %s does not appear to be a Gitrupt hook", hook_name, hook_path)
+            return False, str(hook_path)
+
+        if backup_path.exists():
+            hook_path.write_bytes(backup_path.read_bytes())
+            _make_executable(hook_path)
+            backup_path.unlink(missing_ok=True)
+            logger.info("Restored original %s hook from backup", hook_name)
+        else:
+            hook_path.unlink(missing_ok=True)
+            logger.info("Removed Gitrupt %s hook", hook_name)
+
+        return True, str(hook_path)
+
+    def is_hook_installed(self, hook_name: str) -> bool:
+        if hook_name not in _HOOK_MARKERS:
+            return False
+        hook_path = self._hooks_dir / hook_name
+        if not hook_path.exists():
+            return False
+        content = hook_path.read_text(encoding="utf-8", errors="replace")
+        return _HOOK_MARKERS[hook_name] in content
+
+    # -------------------------------------------------------------------------
+    # Internal
+    # -------------------------------------------------------------------------
+
+    def _build_hook_content(self, hook_name: str, existing_backup: str | None) -> str:
+        from gitrupt import __version__
+
+        if existing_backup:
+            if hook_name == "pre-push":
+                existing_section = _EXISTING_PRE_PUSH.format(backup=existing_backup)
+            else:
+                existing_section = _EXISTING_PRE_COMMIT.format(backup=existing_backup)
+        else:
+            existing_section = _NO_EXISTING
+
+        template = PRE_PUSH_TEMPLATE if hook_name == "pre-push" else PRE_COMMIT_TEMPLATE
+
+        return template.format(
+            marker=_HOOK_MARKERS[hook_name],
+            version_marker=GITRUPT_VERSION_MARKER,
+            version=__version__,
+            python_executable=sys.executable,
+            module=_HOOK_MODULES[hook_name],
+            existing_section=existing_section,
+        )
+
+
+# ── Platform helper ─────────────────────────────────────────────────────────
+
+
+def _make_executable(path: Path) -> None:
+    if platform.system() == "Windows":
+        return
+    try:
+        current = stat.S_IMODE(os.stat(path).st_mode)
+        os.chmod(path, current | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+    except OSError as e:
+        logger.warning("Failed to make %s executable: %s", path, e)

gitrupt/hooks/pre_commit.py

@@ -0,0 +1,103 @@
+"""
+Pre-commit hook entry point.
+
+This module is invoked by the Git pre-commit hook script:
+    python -m gitrupt.hooks.pre_commit
+
+Exit codes:
+    0 — scan passed, commit allowed
+    1 — scan blocked, commit aborted
+    2 — Gitrupt internal error (fails open for resilience)
+"""
+
+from __future__ import annotations
+
+import logging
+import sys
+
+logger = logging.getLogger(__name__)
+
+
+def main() -> int:
+    """
+    Run the pre-commit scan and return an exit code.
+
+    Fails open (returns 0) on internal errors to avoid breaking
+    developer workflows due to Gitrupt bugs.
+    """
+    try:
+        return _run_pre_commit()
+    except KeyboardInterrupt:
+        return 0  # Ctrl+C → allow commit
+    except Exception as e:
+        # Gitrupt internal error — fail open with a warning
+        import sys
+        print(
+            f"\n[!] Gitrupt encountered an internal error: {e}\n"
+            f"    Commit proceeding (fail-open). Please report this bug.\n",
+            file=sys.stderr,
+        )
+        logger.exception("Pre-commit hook internal error")
+        return 0
+
+
+def _run_pre_commit() -> int:
+    """Core pre-commit scan logic."""
+    from gitrupt.config import ConfigurationError, load_config
+    from gitrupt.git import GitAdapter, GitError
+    from gitrupt.reporting import (
+        print_header,
+        print_scanning,
+        print_decision,
+        print_scan_stats,
+        print_error,
+    )
+    from gitrupt.risk import RiskEngine
+    from gitrupt.scanner import run_scan
+
+    # Detect Git repository
+    repo_root = GitAdapter.find_repo_root()
+    if not repo_root:
+        # Not in a Git repo — pass through silently
+        return 0
+
+    # Load configuration
+    try:
+        config = load_config(repo_root)
+    except ConfigurationError as e:
+        print_header()
+        print_error(f"Configuration error: {e}")
+        print_error("Fix .gitrupt.yml and try again.")
+        return 1
+
+    # Get staged files
+    try:
+        target = GitAdapter.build_scan_target(repo_root)
+    except GitError as e:
+        print_header()
+        print_error(f"Git error: {e}")
+        return 0  # Fail open for Git errors
+
+    # No staged files → nothing to scan
+    if not target.staged_files:
+        return 0
+
+    print_header()
+    print_scanning(len(target.staged_files))
+
+    # Run all scanners
+    scan_result = run_scan(target, config)
+
+    # Apply policy
+    risk_engine = RiskEngine(config.policy)
+    decision = risk_engine.evaluate(scan_result)
+
+    # Report
+    print_decision(decision)
+    print_scan_stats(scan_result)
+
+    return decision.exit_code
+
+
+if __name__ == "__main__":
+    sys.exit(main())

gitrupt/hooks/pre_push.py

@@ -0,0 +1,178 @@
+"""
+Pre-push hook entry point.
+
+Invoked by the Git pre-push hook script:
+    python -m gitrupt.hooks.pre_push <remote_name> <remote_url>
+
+Reads ref lines from stdin:
+    <local_ref> <local_sha> <remote_ref> <remote_sha>
+
+Exit codes:
+    0 — scan passed, push allowed
+    1 — scan blocked, push aborted
+    2 — reserved (unused; internal errors fail open with 0)
+"""
+
+from __future__ import annotations
+
+import logging
+import sys
+
+logger = logging.getLogger(__name__)
+
+ZERO_SHA = "0" * 40
+
+
+def _parse_ref_lines(stdin_text: str) -> list[tuple[str, str, str, str]]:
+    """
+    Parse pre-push stdin into (local_ref, local_sha, remote_ref, remote_sha).
+
+    Deletions (local_sha == all zeros) are dropped — nothing to scan.
+    """
+    refs: list[tuple[str, str, str, str]] = []
+    for raw in stdin_text.splitlines():
+        line = raw.strip()
+        if not line:
+            continue
+        parts = line.split()
+        if len(parts) != 4:
+            continue
+        local_ref, local_sha, remote_ref, remote_sha = parts
+        if local_sha == ZERO_SHA:
+            continue
+        refs.append((local_ref, local_sha, remote_ref, remote_sha))
+    return refs
+
+
+def main() -> int:
+    """
+    Run the pre-push scan and return an exit code.
+
+    Fails open (returns 0) on internal errors so a Gitrupt bug never
+    blocks a developer from pushing working code.
+    """
+    try:
+        return _run_pre_push()
+    except KeyboardInterrupt:
+        return 0
+    except Exception as e:
+        print(
+            f"\n[!] Gitrupt encountered an internal error: {e}\n"
+            f"    Push proceeding (fail-open). Please report this bug.\n",
+            file=sys.stderr,
+        )
+        logger.exception("Pre-push hook internal error")
+        return 0
+
+
+def _run_pre_push() -> int:
+    from gitrupt.config import ConfigurationError, load_config
+    from gitrupt.git import GitAdapter, GitError
+    from gitrupt.models import ScanResult
+    from gitrupt.reporting import (
+        print_decision,
+        print_error,
+        print_header,
+        print_scan_stats,
+    )
+    from gitrupt.risk import RiskEngine
+    from gitrupt.scanner import build_scanners, run_scan
+
+    remote_name = sys.argv[1] if len(sys.argv) > 1 else ""
+    remote_url = sys.argv[2] if len(sys.argv) > 2 else ""  # noqa: F841
+
+    try:
+        stdin_text = sys.stdin.read()
+    except Exception:
+        stdin_text = ""
+
+    refs = _parse_ref_lines(stdin_text)
+    if not refs:
+        return 0
+
+    repo_root = GitAdapter.find_repo_root()
+    if not repo_root:
+        return 0
+
+    try:
+        config = load_config(repo_root)
+    except ConfigurationError as e:
+        print_header()
+        print_error(f"Configuration error: {e}")
+        return 1
+
+    all_findings = []
+    scanners_run: set[str] = set()
+    files_scanned = 0
+    total_duration = 0.0
+
+    for local_ref, local_sha, remote_ref, remote_sha in refs:
+        try:
+            target = GitAdapter.build_push_scan_target(
+                repo_root, remote_sha, local_sha
+            )
+        except GitError as e:
+            print_header()
+            print_error(f"Git error preparing {local_ref}: {e}")
+            continue
+
+        if not target.staged_files:
+            continue
+
+        text_provider = _make_text_provider(local_sha)
+        byte_provider = _make_byte_provider(local_sha)
+
+        scanners = build_scanners(
+            config,
+            text_provider=text_provider,
+            byte_provider=byte_provider,
+        )
+
+        result = run_scan(target, config, scanners=scanners)
+        all_findings.extend(result.findings)
+        scanners_run.update(result.scanners_run)
+        files_scanned += result.files_scanned
+        total_duration += result.scan_duration_ms
+
+    merged = ScanResult(
+        findings=all_findings,
+        files_scanned=files_scanned,
+        scan_duration_ms=total_duration,
+        scanners_run=sorted(scanners_run),
+    )
+
+    print_header()
+
+    engine = RiskEngine(config.policy, config.suppressions)
+    decision = engine.evaluate(merged)
+    print_decision(decision)
+    print_scan_stats(merged)
+    return decision.exit_code
+
+
+def _make_text_provider(ref: str):
+    """Return a provider that reads text content at <ref>:<path>."""
+    ref_prefix = f"{ref}:"
+
+    def provider(repo_root: str, path: str) -> str | None:
+        from gitrupt.git import GitAdapter
+
+        return GitAdapter.get_file_content_at(repo_root, ref_prefix, path)
+
+    return provider
+
+
+def _make_byte_provider(ref: str):
+    """Return a provider that reads raw bytes at <ref>:<path>."""
+    ref_prefix = f"{ref}:"
+
+    def provider(repo_root: str, path: str) -> bytes | None:
+        from gitrupt.git import GitAdapter
+
+        return GitAdapter.get_file_bytes_at(repo_root, ref_prefix, path)
+
+    return provider
+
+
+if __name__ == "__main__":
+    sys.exit(main())