Skip to content

Commit 5bd183f

Browse files
TGreen87TGreen87
TGreen87
and
TGreen87
authored
feat: add Codex CLI customization scripts (anomalyco#336)
* chore(codex): add global ecc sync script and pnpm mcp config * chore(codex): include codex supplement when syncing agents * feat(codex): add global git safety hooks and QA/rule prompt packs * feat(codex): add global regression sanity check command --------- Co-authored-by: TGreen87 <[email protected]>
1 parent 89044e8 commit 5bd183f

5 files changed

Lines changed: 937 additions & 0 deletions

File tree

‎scripts/codex-git-hooks/pre-commit‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# ECC Codex Git Hook: pre-commit
5+
# Blocks commits that add high-signal secrets.
6+
7+
if [[ "${ECC_SKIP_GIT_HOOKS:-0}" == "1" || "${ECC_SKIP_PRECOMMIT:-0}" == "1" ]]; then
8+
exit 0
9+
fi
10+
11+
if [[ -f ".ecc-hooks-disable" || -f ".git/ecc-hooks-disable" ]]; then
12+
exit 0
13+
fi
14+
15+
if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
16+
exit 0
17+
fi
18+
19+
staged_files="$(git diff --cached --name-only --diff-filter=ACMR || true)"
20+
if [[ -z "$staged_files" ]]; then
21+
exit 0
22+
fi
23+
24+
has_findings=0
25+
26+
scan_added_lines() {
27+
local file="$1"
28+
local name="$2"
29+
local regex="$3"
30+
local added_lines
31+
local hits
32+
33+
added_lines="$(git diff --cached -U0 -- "$file" | awk '/^\+\+\+ /{next} /^\+/{print substr($0,2)}')"
34+
if [[ -z "$added_lines" ]]; then
35+
return 0
36+
fi
37+
38+
if hits="$(printf '%s\n' "$added_lines" | rg -n --pcre2 "$regex" 2>/dev/null)"; then
39+
printf '\n[ECC pre-commit] Potential secret detected (%s) in %s\n' "$name" "$file" >&2
40+
printf '%s\n' "$hits" | head -n 3 >&2
41+
has_findings=1
42+
fi
43+
}
44+
45+
while IFS= read -r file; do
46+
[[ -z "$file" ]] && continue
47+
48+
case "$file" in
49+
*.png|*.jpg|*.jpeg|*.gif|*.svg|*.pdf|*.zip|*.gz|*.lock|pnpm-lock.yaml|package-lock.json|yarn.lock|bun.lockb)
50+
continue
51+
;;
52+
esac
53+
54+
scan_added_lines "$file" "OpenAI key" 'sk-[A-Za-z0-9]{20,}'
55+
scan_added_lines "$file" "GitHub classic token" 'ghp_[A-Za-z0-9]{36}'
56+
scan_added_lines "$file" "GitHub fine-grained token" 'github_pat_[A-Za-z0-9_]{20,}'
57+
scan_added_lines "$file" "AWS access key" 'AKIA[0-9A-Z]{16}'
58+
scan_added_lines "$file" "private key block" '-----BEGIN (RSA|EC|OPENSSH|DSA|PRIVATE) KEY-----'
59+
scan_added_lines "$file" "generic credential assignment" "(?i)\\b(api[_-]?key|secret|password|token)\\b\\s*[:=]\\s*['\\\"][^'\\\"]{12,}['\\\"]"
60+
done <<< "$staged_files"
61+
62+
if [[ "$has_findings" -eq 1 ]]; then
63+
cat >&2 <<'EOF'
64+
65+
[ECC pre-commit] Commit blocked to prevent secret leakage.
66+
Fix:
67+
1) Remove secrets from staged changes.
68+
2) Move secrets to env vars or secret manager.
69+
3) Re-stage and commit again.
70+
71+
Temporary bypass (not recommended):
72+
ECC_SKIP_PRECOMMIT=1 git commit ...
73+
EOF
74+
exit 1
75+
fi
76+
77+
exit 0

‎scripts/codex-git-hooks/pre-push‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# ECC Codex Git Hook: pre-push
5+
# Runs a lightweight verification flow before pushes.
6+
7+
if [[ "${ECC_SKIP_GIT_HOOKS:-0}" == "1" || "${ECC_SKIP_PREPUSH:-0}" == "1" ]]; then
8+
exit 0
9+
fi
10+
11+
if [[ -f ".ecc-hooks-disable" || -f ".git/ecc-hooks-disable" ]]; then
12+
exit 0
13+
fi
14+
15+
if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
16+
exit 0
17+
fi
18+
19+
ran_any_check=0
20+
21+
log() {
22+
printf '[ECC pre-push] %s\n' "$*"
23+
}
24+
25+
fail() {
26+
printf '[ECC pre-push] FAILED: %s\n' "$*" >&2
27+
exit 1
28+
}
29+
30+
detect_pm() {
31+
if [[ -f "pnpm-lock.yaml" ]]; then
32+
echo "pnpm"
33+
elif [[ -f "bun.lockb" ]]; then
34+
echo "bun"
35+
elif [[ -f "yarn.lock" ]]; then
36+
echo "yarn"
37+
elif [[ -f "package-lock.json" ]]; then
38+
echo "npm"
39+
else
40+
echo "npm"
41+
fi
42+
}
43+
44+
has_node_script() {
45+
local script_name="$1"
46+
node -e 'const fs=require("fs"); const p=JSON.parse(fs.readFileSync("package.json","utf8")); process.exit(p.scripts && p.scripts[process.argv[1]] ? 0 : 1)' "$script_name" >/dev/null 2>&1
47+
}
48+
49+
run_node_script() {
50+
local pm="$1"
51+
local script_name="$2"
52+
case "$pm" in
53+
pnpm) pnpm run "$script_name" ;;
54+
bun) bun run "$script_name" ;;
55+
yarn) yarn "$script_name" ;;
56+
npm) npm run "$script_name" ;;
57+
*) npm run "$script_name" ;;
58+
esac
59+
}
60+
61+
if [[ -f "package.json" ]]; then
62+
pm="$(detect_pm)"
63+
log "Node project detected (package manager: $pm)"
64+
65+
for script_name in lint typecheck test build; do
66+
if has_node_script "$script_name"; then
67+
ran_any_check=1
68+
log "Running: $script_name"
69+
run_node_script "$pm" "$script_name" || fail "$script_name failed"
70+
else
71+
log "Skipping missing script: $script_name"
72+
fi
73+
done
74+
75+
if [[ "${ECC_PREPUSH_AUDIT:-0}" == "1" ]]; then
76+
ran_any_check=1
77+
log "Running dependency audit (ECC_PREPUSH_AUDIT=1)"
78+
case "$pm" in
79+
pnpm) pnpm audit --prod || fail "pnpm audit failed" ;;
80+
bun) bun audit || fail "bun audit failed" ;;
81+
yarn) yarn npm audit --recursive || fail "yarn audit failed" ;;
82+
npm) npm audit --omit=dev || fail "npm audit failed" ;;
83+
*) npm audit --omit=dev || fail "npm audit failed" ;;
84+
esac
85+
fi
86+
fi
87+
88+
if [[ -f "go.mod" ]] && command -v go >/dev/null 2>&1; then
89+
ran_any_check=1
90+
log "Go project detected. Running: go test ./..."
91+
go test ./... || fail "go test failed"
92+
fi
93+
94+
if [[ -f "pyproject.toml" || -f "requirements.txt" ]]; then
95+
if command -v pytest >/dev/null 2>&1; then
96+
ran_any_check=1
97+
log "Python project detected. Running: pytest -q"
98+
pytest -q || fail "pytest failed"
99+
else
100+
log "Python project detected but pytest is not installed. Skipping."
101+
fi
102+
fi
103+
104+
if [[ "$ran_any_check" -eq 0 ]]; then
105+
log "No supported checks found in this repository. Skipping."
106+
else
107+
log "Verification checks passed."
108+
fi
109+
110+
exit 0

0 commit comments

Comments
 (0)