mirror of
https://github.com/viktoruj/obsidian-cloud-kms.git
synced 2026-07-22 06:56:21 +00:00
56 lines
1.7 KiB
Bash
56 lines
1.7 KiB
Bash
#!/usr/bin/env bash
|
|
#
|
|
# Git pre-commit hook: prevents committing plaintext in secret blocks.
|
|
#
|
|
# Checks that no staged .md files contain %%secret-start%% markers.
|
|
# If the plugin is working correctly, all secret blocks should be encrypted
|
|
# to ````ocke-v1 before reaching disk. If %%secret-start%% is found in a
|
|
# staged file, it means plaintext would be committed to Git.
|
|
#
|
|
# Install:
|
|
# cp tools/pre-commit-hook.sh .git/hooks/pre-commit
|
|
# chmod +x .git/hooks/pre-commit
|
|
#
|
|
# Or with a symlink:
|
|
# ln -sf ../../tools/pre-commit-hook.sh .git/hooks/pre-commit
|
|
|
|
set -euo pipefail
|
|
|
|
RED='\033[0;31m'
|
|
NC='\033[0m' # No Color
|
|
|
|
# Get list of staged .md files
|
|
STAGED_MD_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep '\.md$' || true)
|
|
|
|
if [ -z "$STAGED_MD_FILES" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
FOUND_PLAINTEXT=0
|
|
|
|
for file in $STAGED_MD_FILES; do
|
|
# Check staged content (not working tree) for secret markers
|
|
if git show ":$file" 2>/dev/null | grep -q '%%secret-start%%'; then
|
|
echo -e "${RED}ERROR: Plaintext secret block found in staged file: $file${NC}"
|
|
echo " The file contains %%secret-start%% markers which means"
|
|
echo " the encryption plugin did not encrypt before save."
|
|
echo ""
|
|
echo " Possible causes:"
|
|
echo " - Plugin was disabled or not loaded"
|
|
echo " - KMS credentials were unavailable"
|
|
echo " - File was edited outside Obsidian"
|
|
echo ""
|
|
echo " Fix: Open the file in Obsidian with the plugin enabled,"
|
|
echo " save it, then stage again."
|
|
echo ""
|
|
FOUND_PLAINTEXT=1
|
|
fi
|
|
done
|
|
|
|
if [ $FOUND_PLAINTEXT -ne 0 ]; then
|
|
echo -e "${RED}Commit blocked: plaintext secrets detected.${NC}"
|
|
echo "Use 'git commit --no-verify' to bypass (NOT recommended)."
|
|
exit 1
|
|
fi
|
|
|
|
exit 0
|