(ctx: click.Context, web: bool, prereceive_args: List[str])
scan as a pre-receive git hook.
scan as a pre-receive git hook.
scan as a pre - receive git hook .
def prereceive_cmd(ctx: click.Context, web: bool, prereceive_args: List[str]) -> int:
    """
    scan as a pre-receive git hook.
    """
    config = ctx.obj["config"]

    if get_breakglass_option():
        click.echo("SKIP: breakglass detected. Skipping GitGuardian pre-receive hook.")

        return 0

    if not web and os.getenv("GL_PROTOCOL", "") == "web":
        click.echo(
            "GL-HOOK-ERR: SKIP: web push detected. Skipping GitGuardian pre-receive hook."
        )

        return 0

    args = sys.stdin.read().strip().split()
    if len(args) < 3:
        raise click.ClickException(f"Invalid input arguments: {args}")

    before, after, *_ = args
    commit_list = []

    if after == EMPTY_SHA:
        click.echo("Deletion event or nothing to scan.")
        return 0

    if before == EMPTY_SHA:
        before = "HEAD"
        commit_list = get_list_commit_SHA(
            f"--max-count={config.max_commits_for_hook+1} {before}...{after}"
        )

        if not commit_list:
            before = EMPTY_TREE
            click.echo(
                f"New tree event. Scanning last {config.max_commits_for_hook} commits."
            )
            commit_list = get_list_commit_SHA(
                f"--max-count={config.max_commits_for_hook+1} {EMPTY_TREE} {after}"
            )
    else:
        commit_list = get_list_commit_SHA(
            f"--max-count={config.max_commits_for_hook+1} {before}...{after}"
        )

    if not commit_list:
        click.echo(
            "Unable to get commit range.\n"
            f"  before: {before}\n"
            f"  after: {after}\n"
            "Skipping pre-receive hook\n"
        )
        return 0

    if len(commit_list) > config.max_commits_for_hook:
        click.echo(
            f"Too many commits. Scanning last {config.max_commits_for_hook} commits\n"
        )
        commit_list = commit_list[-config.max_commits_for_hook :]

    if config.verbose:
        click.echo(f"Commits to scan: {len(commit_list)}")

    try:
        with ExitAfter(get_prereceive_timeout()):
            return_code = scan_commit_range(
                client=ctx.obj["client"],
                cache=ctx.obj["cache"],
                commit_list=commit_list,
                output_handler=ctx.obj["output_handler"],
                verbose=config.verbose,
                exclusion_regexes=ctx.obj["exclusion_regexes"],
                matches_ignore=config.matches_ignore,
                all_policies=config.all_policies,
                scan_id=" ".join(commit_list),
                mode_header=SupportedScanMode.PRE_RECEIVE.value,
                banlisted_detectors=config.banlisted_detectors,
            )
            if return_code:
                click.echo(
                    """Rewrite your git history to delete evidence of your secrets.
Use environment variables to use your secrets instead and store them in a file not tracked by git.

If you don't want to go through this painful git history rewrite in the future,
you can set up ggshield in your pre commit:
https://docs.gitguardian.com/internal-repositories-monitoring/integrations/git_hooks/pre_commit

Use it carefully: if those secrets are false positives and you still want your push to pass, run:
'git push -o breakglass'"""
                )
            return return_code

    except Exception as error:
        return handle_exception(error, config.verbose)
def prereceive_cmd ( ctx : click . Context , web : bool , prereceive_args : List [ str ] ) -> int : config = ctx . obj [ "config" ] if get_breakglass_option ( ) : click . echo ( "SKIP: breakglass detected. Skipping GitGuardian pre-receive hook." ) return 0 if not web and os . getenv ( "GL_PROTOCOL" , "" ) == "web" : click . echo ( "GL-HOOK-ERR: SKIP: web push detected. Skipping GitGuardian pre-receive hook." ) return 0 args = sys . stdin . read ( ) . strip ( ) . split ( ) if len ( args ) < 3 : raise click . ClickException ( f"Invalid input arguments: {args}" ) before , after , * _ = args commit_list = [ ] if after == EMPTY_SHA : click . echo ( "Deletion event or nothing to scan." ) return 0 if before == EMPTY_SHA : before = "HEAD" commit_list = get_list_commit_SHA ( f"--max-count={config.max_commits_for_hook+1} {before}...{after}" ) if not commit_list : before = EMPTY_TREE click . echo ( f"New tree event. Scanning last {config.max_commits_for_hook} commits." ) commit_list = get_list_commit_SHA ( f"--max-count={config.max_commits_for_hook+1} {EMPTY_TREE} {after}" ) else : commit_list = get_list_commit_SHA ( f"--max-count={config.max_commits_for_hook+1} {before}...{after}" ) if not commit_list : click . echo ( "Unable to get commit range.\n" f"  before: {before}\n" f"  after: {after}\n" "Skipping pre-receive hook\n" ) return 0 if len ( commit_list ) > config . max_commits_for_hook : click . echo ( f"Too many commits. Scanning last {config.max_commits_for_hook} commits\n" ) commit_list = commit_list [ - config . max_commits_for_hook : ] if config . verbose : click . echo ( f"Commits to scan: {len(commit_list)}" ) try : with ExitAfter ( get_prereceive_timeout ( ) ) : return_code = scan_commit_range ( client = ctx . obj [ "client" ] , cache = ctx . obj [ "cache" ] , commit_list = commit_list , output_handler = ctx . obj [ "output_handler" ] , verbose = config . verbose , exclusion_regexes = ctx . obj [ "exclusion_regexes" ] , matches_ignore = config . matches_ignore , all_policies = config . all_policies , scan_id = " " . join ( commit_list ) , mode_header = SupportedScanMode . PRE_RECEIVE . value , banlisted_detectors = config . banlisted_detectors , ) if return_code : click . echo ( """Rewrite your git history to delete evidence of your secrets.
Use environment variables to use your secrets instead and store them in a file not tracked by git.

If you don't want to go through this painful git history rewrite in the future,
you can set up ggshield in your pre commit:
https://docs.gitguardian.com/internal-repositories-monitoring/integrations/git_hooks/pre_commit

Use it carefully: if those secrets are false positives and you still want your push to pass, run:
'git push -o breakglass'""" ) return return_code except Exception as error : return handle_exception ( error , config . verbose )