ansible-vault pre-commit hook

.git_hooks_pre-commit

#!/bin/bash
#
# Pre-commit hook that verifies if all files containing 'vault' in the name
# are encrypted.
# If not, commit will fail with an error message
#
# Original author: @ralovely
# https://www.reinteractive.net/posts/167-ansible-real-life-good-practices
#
# File should be .git/hooks/pre-commit and executable
FILES_PATTERN='.*vault.*\.*$|digital_ocean\.ini|do_env\.sh'
REQUIRED='ANSIBLE_VAULT'

EXIT_STATUS=0
wipe="\033[1m\033[0m"
yellow='\033[1;33m'
# carriage return hack. Leave it on 2 lines.
cr='
'
for f in $(git diff --cached --name-only --diff-filter=d | grep -E $FILES_PATTERN)
do
  # test for the presence of the required bit.
  MATCH=`git show :$f | head -n1 | grep --no-messages $REQUIRED`
  if [ ! $MATCH ] ; then
    # Build the list of unencrypted files if any
    UNENCRYPTED_FILES="$f$cr$UNENCRYPTED_FILES"
    EXIT_STATUS=1
  fi
done
if [ ! $EXIT_STATUS = 0 ] ; then
  echo '# COMMIT REJECTED'
  echo '# Looks like unencrypted ansible-vault files are part of the commit:'
  echo '#'
  while read -r line; do
    if [ -n "$line" ]; then
      echo -e "#\t${yellow}unencrypted:   $line${wipe}"
    fi
  done <<< "$UNENCRYPTED_FILES"
  echo '#'
  echo "# Please encrypt them with 'ansible-vault encrypt <file>'"
  echo "#   (or force the commit with '--no-verify')."
  exit $EXIT_STATUS
fi
exit $EXIT_STATUS

I thank you!

great! thanks! saved me time after starting to do it on my own.

This is great!!
You saved me a lot of time!

Greate thanks.

Many thanks!

When committing I get:
.git/hooks/pre-commit: 38: Syntax error: redirection unexpected

@tuomastielinen #!/bin/sh on Ubuntu is using the dash shell which does not have the <<< redirection operator.
Simply change the shell to bash #!/bin/bash.

Danger Will Robinson!

If the vault is encrypted on the file system but unencrypted in the staging area then this hook will let the commit go through causing an unencrypted vault to be committed.

Fix:

Change line 23 to:

  MATCH=`git show :$f | head -n1 | grep --no-messages $REQUIRED`

git show uses the file content as it is in the git staging, not the file system.

Thanks @cniesen, seems to be working now.

I also added the --diff-filter=d to exclude deleted files from the check on line 20.

implemented @cniesen & @cgeroux suggestions; thanks folks 🙏