zappzarapp-php-security/captainhook.json at master · marcstraube/zappzarapp-php-security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
{
  "commit-msg": {
    "enabled": true,
    "actions": [
      {
        "action": "\\CaptainHook\\App\\Hook\\Message\\Action\\Regex",
        "options": {
          "regex": "#^(feat|fix|docs|style|refactor|test|chore|security|perf|ci|build|revert)(\\(.+\\))?!?: .{1,72}#"
        },
        "config": {
          "label": "Validate commit message format (Conventional Commits)"
        }
      }
    ]
  },
  "pre-commit": {
    "enabled": true,
    "actions": [
      {
        "action": "\\CaptainHook\\App\\Hook\\Diff\\Action\\BlockSecrets",
        "options": {
          "suppliers": [
            "CaptainHook\\Secrets\\Regex\\Supplier\\Aws",
            "CaptainHook\\Secrets\\Regex\\Supplier\\GitHub",
            "CaptainHook\\Secrets\\Regex\\Supplier\\Google",
            "CaptainHook\\Secrets\\Regex\\Supplier\\Stripe",
            "CaptainHook\\Secrets\\Regex\\Supplier\\Gitlab"
          ],
          "entropyThreshold": 4.8,
          "allowed": [
            "#example\\.com#",
            "#localhost#",
            "#127\\.0\\.0\\.1#",
            "#your-secret-key#",
            "#api\\.github\\.com#",
            "#UNSIGNED_COMMITS#"
          ]
        },
        "config": {
          "label": "Block secrets in staged files (API keys, tokens, passwords)"
        }
      },
      {
        "action": "php -l {$STAGED_FILES|of-type:php}",
        "options": [],
        "conditions": [
          {
            "exec": "\\CaptainHook\\App\\Hook\\Condition\\FileStaged\\OfType",
            "args": ["php"]
          }
        ],
        "config": {
          "label": "Check PHP syntax on staged files"
        }
      },
      {
        "action": "vendor/bin/php-cs-fixer fix --config=.php-cs-fixer.dist.php --path-mode=intersection -- {$STAGED_FILES|of-type:php}",
        "options": [],
        "conditions": [
          {
            "exec": "\\CaptainHook\\App\\Hook\\Condition\\FileStaged\\OfType",
            "args": ["php"]
          }
        ],
        "config": {
          "label": "Fix PHP code style on staged files (auto-fix and re-stage)"
        }
      }
    ]
  },
  "pre-push": {
    "enabled": true,
    "actions": [
      {
        "action": "composer check",
        "options": [],
        "config": {
          "label": "Run all quality checks (PHPStan, Psalm, PHPMD, Tests, Deptrac)"
        }
      }
    ]
  },
  "post-checkout": {
    "enabled": true,
    "actions": [
      {
        "action": "find . -maxdepth 1 -type f \\( -name '*.json' -o -name '*.neon' -o -name '*.xml' -o -name '*.yaml' -o -name '*.yml' -o -name '*.md' -o -name 'LICENSE' \\) -not -perm 644 -exec chmod 644 {} +",
        "options": [],
        "config": {
          "label": "Fix root config file permissions (644)"
        }
      }
    ]
  },
  "post-merge": {
    "enabled": true,
    "actions": [
      {
        "action": "find . -maxdepth 1 -type f \\( -name '*.json' -o -name '*.neon' -o -name '*.xml' -o -name '*.yaml' -o -name '*.yml' -o -name '*.md' -o -name 'LICENSE' \\) -not -perm 644 -exec chmod 644 {} +",
        "options": [],
        "config": {
          "label": "Fix root config file permissions (644)"
        }
      },
      {
        "action": "CHANGED=$(git diff-tree -r --name-only --no-commit-id ORIG_HEAD HEAD 2>/dev/null | grep -E '^composer\\.json$'); if [ -n \"$CHANGED\" ]; then echo ''; echo -e '\\033[0;33m⚠️  composer.json changed! Run:\\033[0m'; echo '   composer install'; echo ''; fi",
        "options": [],
        "config": {
          "label": "Warn if composer.json changed after merge/pull"
        }
      }
    ]
  },
  "post-rewrite": {
    "enabled": false,
    "actions": []
  },
  "prepare-commit-msg": {
    "enabled": false,
    "actions": []
  },
  "post-commit": {
    "enabled": false,
    "actions": []
  }
}