Never Commit a Secret Again: Git Hooks, pre-commit, prek, and evnx

# Install pre-commit itself (one-time, per machine)
pip install pre-commit
# or: brew install pre-commit

# Install hooks into .git/hooks/ (one-time, per clone)
pre-commit install

# Also install pre-push hooks
pre-commit install --hook-type pre-push

# .pre-commit-config.yaml
default_install_hook_types: [pre-commit, pre-push]

repos:
  - repo: https://github.com/some-org/some-hook
    rev: v1.2.3          # always pin to a tag, never a branch
    hooks:
      - id: the-hook-id
        args: [--extra-flag]

# Install prek (macOS/Linux)
curl -fsSL https://prek.j178.dev/install.sh | sh

# or via Cargo
cargo install prek

# Install git hooks (same command as pre-commit)
prek install

repos:
  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: v1.10.0
    hooks:
      - id: mypy
        additional_dependencies: [types-requests, types-PyYAML]

repos:
  - repo: https://github.com/doublify/pre-commit-rust
    rev: v1.0
    hooks:
      - id: fmt        # cargo fmt --all
      - id: clippy     # cargo clippy -- -D warnings

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.6.0
    hooks:
      - id: trailing-whitespace     # remove trailing spaces
      - id: end-of-file-fixer       # ensure files end with newline
      - id: check-yaml              # validate YAML syntax
      - id: check-json              # validate JSON syntax
      - id: check-toml              # validate TOML syntax
      - id: check-merge-conflict    # catch leftover merge markers
      - id: check-added-large-files # block files > 500KB by default
        args: [--maxkb=500]
      - id: detect-private-key      # catch raw PEM private keys
      - id: no-commit-to-branch     # protect main/master
        args: [--branch, main, --branch, master]

repos:
  - repo: https://github.com/commitizen-tools/commitizen
    rev: v3.27.0
    hooks:
      - id: commitizen
        stages: [commit-msg]    # runs on the commit message, not files

# pre-commit
pre-commit install && pre-commit install --hook-type pre-push

# prek (installs all stages from default_install_hook_types)
prek install

# .evnx.toml — commit this file
[defaults]
env_file = ".env"
example_file = ".env.example"

[validate]
strict = true          # treat warnings as errors

[scan]
ignore_placeholders = true
exclude_patterns = [
  "*.example",
  "*.sample",
  ".env.test"          # exclude test fixtures from scanning
]

# Skip a specific hook
SKIP=evnx-scan git commit -m "wip: local only"

# Skip all hooks (last resort)
git commit --no-verify -m "hotfix: production down"

my-cli/├── .pre-commit-hooks.yaml    ← hook manifest (new)├── .pre-commit-config.yaml   ← dogfood: use your own hooks (new)├── Cargo.toml├── Cargo.lock├── src/│   └── main.rs└── tests/    └── integration_test.rs

// src/main.rs
use std::process;

fn main() {
    let args: Vec<String> = std::env::args().collect();
    let result = run(&args);

    match result {
        Ok(findings) if findings == 0 => {
            println!("No issues found.");
            process::exit(0);  // pre-commit sees this as PASS
        }
        Ok(findings) => {
            eprintln!("{} issue(s) found.", findings);
            process::exit(1);  // pre-commit sees this as FAIL, blocks commit
        }
        Err(e) => {
            eprintln!("Error: {}", e);
            process::exit(2);  // framework treats non-zero as failure
        }
    }
}

fn run(args: &[String]) -> Result<usize, String> {
    // Your validation logic here.
    // Return Ok(0) for clean, Ok(n) for n findings, Err for runtime errors.
    todo!()
}

# .pre-commit-hooks.yaml
- id: my-cli-check
  name: my-cli — Default Check
  description: Describe what this hook catches in one sentence.
  entry: my-cli check        # binary name, as produced by Cargo
  language: rust             # framework runs: cargo install --bins --locked
  pass_filenames: false      # set true if your tool takes file arguments
  always_run: true           # run even if no files match
  stages: [pre-commit]

- id: my-cli-strict
  name: my-cli — Strict Mode
  description: Same check with strict flag — fails on warnings too.
  entry: my-cli check --strict
  language: rust
  pass_filenames: false
  stages: [pre-commit]

- id: my-cli-push
  name: my-cli — Pre-push Check
  description: Heavier check that runs on git push, not every commit.
  entry: my-cli check --full
  language: rust
  pass_filenames: false
  always_run: true
  stages: [pre-push]

# Validate syntax and schema
pre-commit validate-manifest .pre-commit-hooks.yaml

# prek equivalent
prek validate-manifest .pre-commit-hooks.yaml

$ pre-commit validate-manifest .pre-commit-hooks.yamlValidating .pre-commit-hooks.yaml....pre-commit-hooks.yaml is valid (3 hook definitions)

# Test from a URL
pre-commit try-repo https://github.com/your-org/my-cli my-cli-check \
  --all-files \
  --verbose

# Test from a local path (faster, no git push needed)
pre-commit try-repo /path/to/my-cli my-cli-check --all-files --verbose

# prek equivalent
prek try-repo /path/to/my-cli my-cli-check --all-files --verbose

$ pre-commit try-repo ../my-cli my-cli-check --all-files --verbose ===============================================================================Using config:===============================================================================repos:-   repo: ../my-cli    rev: 84f01ac09fcd8610824f9626a590b83cfae9bcbd    hooks:    -   id: my-cli-check===============================================================================[INFO] Initializing environment for ../my-cli.      cargo install --bins --locked --path ../my-cli      Compiling my-cli v0.1.0 ...      Finished in 38s (cached for future runs) my-cli — Default Check..........................................Passed- hook id: my-cli-check- duration: 0.09s No issues found.

// tests/integration_test.rs
use std::process::Command;
use std::fs;
use tempfile::TempDir;

fn run_my_cli(args: &[&str], dir: &std::path::Path) -> std::process::Output {
    Command::new(env!("CARGO_BIN_EXE_my-cli"))
        .args(args)
        .current_dir(dir)
        .output()
        .expect("failed to execute binary")
}

#[test]
fn test_clean_file_exits_zero() {
    let dir = TempDir::new().unwrap();
    fs::write(
        dir.path().join(".env"),
        "DATABASE_URL=postgres://localhost/dev\nDEBUG=true\n"
    ).unwrap();

    let output = run_my_cli(&["check"], dir.path());

    // pre-commit contract: exit 0 = pass
    assert_eq!(output.status.code(), Some(0), "expected exit 0 for clean file");
}

#[test]
fn test_placeholder_exits_nonzero() {
    let dir = TempDir::new().unwrap();
    fs::write(dir.path().join(".env"), "SECRET_KEY=CHANGE_ME\n").unwrap();

    let output = run_my_cli(&["check"], dir.path());

    // pre-commit contract: non-zero = fail, commit blocked
    assert_ne!(output.status.code(), Some(0), "expected non-zero for placeholder");
    let stderr = String::from_utf8_lossy(&output.stderr);
    assert!(stderr.contains("placeholder"), "error message should mention placeholder");
}

#[test]
fn test_strict_mode_fails_on_warnings() {
    let dir = TempDir::new().unwrap();
    fs::write(
        dir.path().join(".env"),
        "DATABASE_URL=postgres://localhost/prod\n"
    ).unwrap();

    let normal = run_my_cli(&["check"], dir.path());
    let strict = run_my_cli(&["check", "--strict"], dir.path());

    assert_eq!(normal.status.code(), Some(0));  // warning, pass in normal mode
    assert_ne!(strict.status.code(), Some(0));  // warning, fail in strict mode
}

# Run integration tests
cargo test --test integration_test

# Run all tests
cargo test

# Test the compiled binary end-to-end
cargo build
./target/debug/my-cli check
echo $?   # should print 0 on a clean project

# .pre-commit-config.yaml (in your tool's repo)
repos:
  - repo: local
    hooks:
      - id: my-cli-self-check
        name: my-cli — Self Check (dev)
        entry: cargo run -- check
        language: rust
        pass_filenames: false
        always_run: true

# Install and test on your own repo
pre-commit install
git add .pre-commit-hooks.yaml .pre-commit-config.yaml
git commit -m "feat: add pre-commit hook support"
# Your hook runs on this very commit

git push origin feat/pre-commit-support
# create PR, review, merge

# Tag the release
git tag v0.2.0 -m "Add pre-commit hook support"
git push origin v0.2.0

repos:
  - repo: https://github.com/your-org/my-cli
    rev: v0.2.0
    hooks:
      - id: my-cli-check

 # Before: hoping developers remember to check manually- git commit -m "add payment integration"- # ... CI fails 20 minutes later- # ... or worse: AWS alert at 3am  + # After: automatic protection on every commit+ git commit -m "add payment integration"+ # evnx — Secret Scanner ................ Passed+ # evnx — .env Validator ................ Passed+ # ruff (lint) .......................... Passed+ # ruff (format) ........................ Passed+ # [main a1b2c3] add payment integration