|
| 1 | +#!/usr/bin/env bash |
| 2 | + |
| 3 | +# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ |
| 4 | +# MDSIG Frontend — Pre-Push Hook |
| 5 | +# Runs security scans, lint/format, type-check, and build before pushing. |
| 6 | +# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ |
| 7 | + |
| 8 | +TOTAL_STEPS=8 |
| 9 | +BUNDLE_SIZE_LIMIT_MB=50 |
| 10 | + |
| 11 | +# Colors |
| 12 | +_CLI_RED='\033[0;31m' |
| 13 | +_CLI_GREEN='\033[0;32m' |
| 14 | +_CLI_YELLOW='\033[0;33m' |
| 15 | +_CLI_BLUE='\033[0;34m' |
| 16 | +_CLI_PURPLE='\033[0;35m' |
| 17 | +_CLI_CYAN='\033[0;36m' |
| 18 | +_CLI_GRAY='\033[0;90m' |
| 19 | +_CLI_NC='\033[0m' |
| 20 | + |
| 21 | +# Symbols |
| 22 | +_CLI_CHECK="${_CLI_GREEN}[✓]${_CLI_NC}" |
| 23 | +_CLI_CROSS="${_CLI_RED}[✗]${_CLI_NC}" |
| 24 | +_CLI_WARN="${_CLI_YELLOW}[!]${_CLI_NC}" |
| 25 | +_CLI_INFO="${_CLI_CYAN}[i]${_CLI_NC}" |
| 26 | + |
| 27 | +# Helpers |
| 28 | +log_info() { echo -e "$_CLI_INFO $1"; } |
| 29 | +log_success() { echo -e "$_CLI_CHECK $1"; } |
| 30 | +log_warn() { echo -e "$_CLI_WARN $1"; } |
| 31 | +log_error() { echo -e "$_CLI_CROSS $1"; } |
| 32 | + |
| 33 | +print_divider() { |
| 34 | + local color="${1:-$_CLI_PURPLE}" label="${2:-}" |
| 35 | + local width="${COLUMNS:-$(tput cols 2>/dev/null || echo 80)}" |
| 36 | + if [[ -n "$label" ]]; then |
| 37 | + local padding=$((width - ${#label} - 6)) |
| 38 | + local fill |
| 39 | + printf -v fill '%*s' "$padding" '' |
| 40 | + printf '%b━━━━[%s]%s%b\n' "$color" "$label" "${fill// /━}" "$_CLI_NC" |
| 41 | + else |
| 42 | + local fill |
| 43 | + printf -v fill '%*s' "$width" '' |
| 44 | + printf '%b%s%b\n' "$color" "${fill// /━}" "$_CLI_NC" |
| 45 | + fi |
| 46 | +} |
| 47 | + |
| 48 | +run_step() { |
| 49 | + local step_num="$1" |
| 50 | + local step_name="$2" |
| 51 | + local step_cmd="$3" |
| 52 | + |
| 53 | + log_info "${_CLI_GRAY}[${step_num}/${TOTAL_STEPS}]${_CLI_NC} Running ${_CLI_CYAN}${step_name}${_CLI_NC}..." |
| 54 | + |
| 55 | + if eval "$step_cmd"; then |
| 56 | + log_success "${_CLI_GRAY}[${step_num}/${TOTAL_STEPS}]${_CLI_NC} ${step_name}" |
| 57 | + return 0 |
| 58 | + else |
| 59 | + echo "" |
| 60 | + log_error "${_CLI_GRAY}[${step_num}/${TOTAL_STEPS}]${_CLI_NC} ${step_name} ${_CLI_RED}failed${_CLI_NC}" |
| 61 | + echo "" |
| 62 | + log_info "Fix the errors above, then try pushing again." |
| 63 | + echo "" |
| 64 | + print_divider "$_CLI_RED" |
| 65 | + echo "" |
| 66 | + return 1 |
| 67 | + fi |
| 68 | +} |
| 69 | + |
| 70 | +# ── Check Functions ─────────────────────────────────────────────── |
| 71 | + |
| 72 | +check_env_secrets() { |
| 73 | + local failed=0 |
| 74 | + |
| 75 | + # Check for .env files being pushed |
| 76 | + local env_files |
| 77 | + env_files=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.env(\..*)?\.local$' || true) |
| 78 | + if [[ -z "$env_files" ]]; then |
| 79 | + env_files=$(git diff origin/HEAD --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.env(\..*)?\.local$' || true) |
| 80 | + fi |
| 81 | + |
| 82 | + if [[ -n "$env_files" ]]; then |
| 83 | + echo "" |
| 84 | + log_error "Secret files detected in changes:" |
| 85 | + while IFS= read -r f; do |
| 86 | + echo -e " ${_CLI_RED}✗${_CLI_NC} $f" |
| 87 | + done <<< "$env_files" |
| 88 | + echo "" |
| 89 | + log_info "Add these to ${_CLI_CYAN}.gitignore${_CLI_NC} or unstage them." |
| 90 | + failed=1 |
| 91 | + fi |
| 92 | + |
| 93 | + # Grep source files for hardcoded secret patterns |
| 94 | + local secret_patterns='(GOOGLE_CLIENT_SECRET|NEXTAUTH_SECRET|GITHUB_TOKEN|NEXT_PUBLIC_WEBHOOK_LOGIN|DISCORD_WEBHOOK)\s*=\s*["\x27][^"\x27]{8,}' |
| 95 | + local hits |
| 96 | + hits=$(git diff origin/HEAD -- '*.ts' '*.tsx' '*.js' '*.jsx' 2>/dev/null \ |
| 97 | + | grep -E '^\+' \ |
| 98 | + | grep -iE "$secret_patterns" || true) |
| 99 | + |
| 100 | + if [[ -n "$hits" ]]; then |
| 101 | + echo "" |
| 102 | + log_error "Possible hardcoded secrets in diff:" |
| 103 | + echo -e " ${_CLI_GRAY}${hits}${_CLI_NC}" |
| 104 | + failed=1 |
| 105 | + fi |
| 106 | + |
| 107 | + return $failed |
| 108 | +} |
| 109 | + |
| 110 | +check_bundle_size() { |
| 111 | + if [[ ! -d ".next" ]]; then |
| 112 | + log_warn "No .next directory found — skipping bundle size check" |
| 113 | + return 0 |
| 114 | + fi |
| 115 | + |
| 116 | + local size_kb |
| 117 | + size_kb=$(du -sk .next 2>/dev/null | cut -f1) |
| 118 | + local size_mb=$(( size_kb / 1024 )) |
| 119 | + local limit_kb=$(( BUNDLE_SIZE_LIMIT_MB * 1024 )) |
| 120 | + |
| 121 | + if [[ "$size_kb" -gt "$limit_kb" ]]; then |
| 122 | + echo "" |
| 123 | + log_error "Bundle size ${_CLI_RED}${size_mb}MB${_CLI_NC} exceeds limit of ${_CLI_CYAN}${BUNDLE_SIZE_LIMIT_MB}MB${_CLI_NC}" |
| 124 | + echo "" |
| 125 | + log_info "Check for large imports or unoptimized assets." |
| 126 | + return 1 |
| 127 | + fi |
| 128 | + |
| 129 | + log_info " Bundle size: ${_CLI_CYAN}${size_mb}MB${_CLI_NC} ${_CLI_GRAY}(limit: ${BUNDLE_SIZE_LIMIT_MB}MB)${_CLI_NC}" |
| 130 | + return 0 |
| 131 | +} |
| 132 | + |
| 133 | +# ── Main ────────────────────────────────────────────────────────── |
| 134 | + |
| 135 | +echo "" |
| 136 | +print_divider "$_CLI_PURPLE" "Pre-Push Checks" |
| 137 | +echo "" |
| 138 | +log_info "Verifying codebase before push..." |
| 139 | +echo "" |
| 140 | + |
| 141 | +# 1. Secret detection with gitleaks |
| 142 | +if command -v gitleaks &> /dev/null; then |
| 143 | + run_step 1 "gitleaks (secret scan)" "gitleaks protect --staged --verbose" || exit 1 |
| 144 | +else |
| 145 | + log_warn "${_CLI_GRAY}[1/${TOTAL_STEPS}]${_CLI_NC} gitleaks not installed — skipping" |
| 146 | + log_info "Install with: ${_CLI_CYAN}brew install gitleaks${_CLI_NC}" |
| 147 | + echo "" |
| 148 | +fi |
| 149 | + |
| 150 | +# 2. Check for .env secrets in staged files |
| 151 | +run_step 2 "env secrets check" "check_env_secrets" || exit 1 |
| 152 | + |
| 153 | +# 3–7. Install, lint, type-check, build |
| 154 | +run_step 3 "pnpm install" "pnpm install" || exit 1 |
| 155 | +run_step 4 "pnpm run check:fix" "pnpm run check:fix" || exit 1 |
| 156 | +run_step 5 "pnpm run check:fix-unsafe" "pnpm run check:fix-unsafe" || exit 1 |
| 157 | +run_step 6 "pnpm run types" "pnpm run types" || exit 1 |
| 158 | +run_step 7 "pnpm build" "pnpm build" || exit 1 |
| 159 | + |
| 160 | +# 8. Bundle size check (after build) |
| 161 | +run_step 8 "bundle size check" "check_bundle_size" || exit 1 |
| 162 | + |
| 163 | +echo "" |
| 164 | +log_success "All pre-push checks passed" |
| 165 | +echo "" |
| 166 | +print_divider "$_CLI_PURPLE" |
| 167 | +echo "" |
0 commit comments