pre-push

#!/bin/bash

# set against for comparisons
if git rev-parse --verify HEAD >/dev/null 2>&1
then
    against=HEAD
else
    # Initial commit: diff against an empty tree object
    against=$(git hash-object -t tree /dev/null)
fi

# Check for common data formats #
#################################

if [ -z "${GIT_ALLOW_DATA}" ]; then

    
  REG='.*\.(xls[sxtm]?|csv|txt|sav|db|sqlite|feather|pkl|pickle|ods|gsheet|RData|Rds)'
    MATCH=$(git diff --cached --name-only $against | grep -i -P $REG)

    if [[ ! -z $MATCH ]]; then
        printf "\nIt looks like you're trying to commit a data file':\n\n"
        printf "$MATCH\n\n"
        printf "Check to ensure that it is ok to commit the file, then run:\n\n\tGIT_ALLOW_DATA=1 git commit"
        printf "\n\nYou can stack these commands if required, like:\n\n\tGIT_ALLOW_DATA=1 GIT_ALLOW_OFFICIAL=1 git commit\n\n"
        exit 1
    fi

fi

# Check for files labelled official #
#####################################

if [ -z "${GIT_ALLOW_OFFICIAL}" ]; then
    
  REG='.*OFFICIAL.*'
    MATCH=$(git diff --cached --name-only $against | grep -i -P $REG)

    if [[ ! -z $MATCH ]]; then
        printf "\nIt looks like you're trying to commit a file which has been\nlabelled 'OFFICIAL':\n\n"
        printf "$MATCH\n\n"
        printf "Ideally you should rename the file, and remove 'OFFICIAL'.\n"
        printf "If you must commit the file without changing the name,\n ensure that the file is OK to commit, then run:\n\n\tGIT_ALLOW_OFFICIAL=1 git commit\n\n"
        printf "You can stack these commands if required, like:\n\n\tGIT_ALLOW_DATA=1 GIT_ALLOW_OFFICIAL=1 git commit\n\n"
        exit 1
    fi

fi

# Check for AWS keys #
######################

if [ -z "${GIT_ALLOW_AWS_KEYS}" ]; then

   REG='((?<![A-Z0-9])[A-Z0-9]{20}(?![A-Z0-9])|(?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=]))'
    # key match regex from http://blogs.aws.amazon.com/security/blog/tag/key+rotation
    MATCH=$(git diff --cached --name-only -z $against | xargs -0 cat | grep -c -P $REG)

    if [[ $MATCH -ne 0 ]]; then
        printf "Found patterns for AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY in:"
        printf "$MATCH\n\n"
        printf "Please check your code and remove API keys."
        printf "If you really want to commit this:\n\n\tGIT_ALLOW_AWS_KEYS=1 git commit\n"
        printf "You can stack these commands if required, like:\n\n\tGIT_ALLOW_DATA=1 GIT_ALLOW_OFFICIAL=1 git commit\n\n"
        exit 1
    fi

fi

# Check for Private Keys #
##########################

if [ -z "${GIT_ALLOW_PRIVATE_KEYS}" ]; then

  REG=' PRIVATE KEY'
    # key match regex from http://blogs.aws.amazon.com/security/blog/tag/key+rotation
    MATCH=$(git diff --cached --name-only -z $against | xargs -0 cat | grep -c ' PRIVATE KEY')

    if [[ $MATCH -ne 0 ]]; then
        printf "It looks like you're trying to commit a private key in:"
        printf "$MATCH\n\n"
        printf "Please check your code and remove any private keys."
        printf "If you really want to commit this:\n\n\tGIT_ALLOW_PRIVATE_KEYS=1 git commit\n"
        printf "You can stack these commands if required, like:\n\n\tGIT_ALLOW_DATA=1 GIT_ALLOW_OFFICIAL=1 git commit\n\n"
        exit 1
    fi

fi

# Check for .pem files #
########################

if [ -z "${GIT_ALLOW_PEM_FILES}" ]; then

  REG='.*\.pem$'
    # key match regex from http://blogs.aws.amazon.com/security/blog/tag/key+rotation
    MATCH=$(git diff --cached --name-only $against | grep -P $REG)

    if [[ ! -z $MATCH ]]; then
        printf "It looks like you're trying to commit a PEM file in:"
        printf "$MATCH\n\n"
        printf "Please check your code and remove any PEM files."
        printf "If you really want to commit this:\n\n\tGIT_ALLOW_PEM_FILES=1 git commit\n"
        printf "You can stack these commands if required, like:\n\n\tGIT_ALLOW_DATA=1 GIT_ALLOW_OFFICIAL=1 git commit\n\n"
        exit 1
    fi

fi

# Check for ipynb formats #
#################################

if [ -z "${GIT_ALLOW_IPYNB}" ]; then

    
  REG='.*\.(ipynb|IPYNB)'
    MATCH=$(git diff --cached --name-only $against | grep -i -P $REG)

    if [[ ! -z $MATCH ]]; then
        printf "\nIt looks like you're trying to commit an ipython notebook':\n\n"
        printf "$MATCH\n\n"
        printf "Have you checked that no sensitive information is contained in any output chunks?\n"
        printf "Check to ensure that it is ok to commit the file, then run:\n\n\tGIT_ALLOW_IPYNB=1 git commit"
        printf "\n\nYou can stack these commands if required, like:\n\n\tGIT_ALLOW_DATA=1 GIT_ALLOW_OFFICIAL=1 git commit\n\n"
        exit 1
    fi

fi

# Local Variables:
# mode: Shell-Script
# sh-indentation: 2
# indent-tabs-mode: nil
# sh-basic-offset: 2
# End:
# vim: ft=zsh sw=2 ts=2 et