#!/usr/bin/env sh

# Pre-commit hook to run Talisman and Snyk scans, completing both before deciding to commit

# Function to check if a command exists

command_exists() {

command -v "$1" >/dev/null 2>&1

}

# Check if Talisman is installed

if ! command_exists talisman; then

echo "Error: Talisman is not installed. Please install it and try again."

exit 1

fi

# Check if Snyk is installed

if ! command_exists snyk; then

echo "Error: Snyk is not installed. Please install it and try again."

exit 1

fi

# Allow bypassing the hook with an environment variable

if [ "$SKIP_HOOK" = "1" ]; then

echo "Skipping Talisman and Snyk scans (SKIP_HOOK=1)."

exit 0

fi

# Initialize variables to track scan results

talisman_failed=false

snyk_failed=false

# Run Talisman secret scan

echo "Running Talisman secret scan..."

talisman --githook pre-commit > talisman_output.log 2>&1

talisman_exit_code=$?

if [ $talisman_exit_code -eq 0 ]; then

echo "Talisman scan passed: No secrets found."

else

echo "Talisman scan failed (exit code $talisman_exit_code). See talisman_output.log for details."

talisman_failed=true

fi

# Run Snyk vulnerability scan (continues even if Talisman failed)

echo "Running Snyk vulnerability scan..."

snyk test --all-projects --fail-on=all > snyk_output.log 2>&1

snyk_exit_code=$?

if [ $snyk_exit_code -eq 0 ]; then

echo "Snyk scan passed: No vulnerabilities found."

elif [ $snyk_exit_code -eq 1 ]; then

echo "Snyk found vulnerabilities. See snyk_output.log for details."

snyk_failed=true

else

echo "Snyk scan failed with error (exit code $snyk_exit_code). See snyk_output.log for details."

snyk_failed=true

fi

# Evaluate results after both scans

if [ "$talisman_failed" = true ] || [ "$snyk_failed" = true ]; then

echo "Commit aborted due to issues found in one or both scans."

[ "$talisman_failed" = true ] && echo "- Talisman issues: Check talisman_output.log"

[ "$snyk_failed" = true ] && echo "- Snyk issues: Check snyk_output.log"

exit 1

fi

# If both scans pass, allow the commit

echo "All scans passed. Proceeding with commit."

rm -f talisman_output.log snyk_output.log

exit 0