Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
@evilmartians/lefthook-installer
Advanced tools
The fastest polyglot Git hooks manager out there
Fast and powerful Git hooks manager for Node.js, Ruby or any other type of projects.
With Go (>= 1.19):
go install github.com/evilmartians/lefthook@latest
With NPM:
npm install lefthook --save-dev
With Ruby:
gem install lefthook
Installation guide with more different installation instructions.
Lefthook is easy to use. Once you configure and setup you can forget that it even exists and rely on the magic underneath.
See:
lefthook.yml
Gives you more speed. Example
pre-push:
parallel: true
If you want your own list. Custom and prebuilt examples.
pre-commit:
commands:
frontend-linter:
run: yarn eslint {staged_files}
backend-linter:
run: bundle exec rubocop --force-exclusion {all_files}
frontend-style:
files: git diff --name-only HEAD @{push}
run: yarn stylelint {files}
If you want to filter list of files. You could find more glob pattern examples here.
pre-commit:
commands:
backend-linter:
glob: "*.rb" # glob filter
exclude: "application.rb|routes.rb" # regexp filter
run: bundle exec rubocop --force-exclusion {all_files}
If you want to execute the commands in a relative path
pre-commit:
commands:
backend-linter:
root: "api/" # Careful to have only trailing slash
glob: "*.rb" # glob filter
run: bundle exec rubocop {all_files}
If oneline commands are not enough, you can execute files. Example.
commit-msg:
scripts:
"template_checker":
runner: bash
If you want to control a group of commands. Example.
pre-push:
commands:
packages-audit:
tags: frontend security
run: yarn audit
gems-audit:
tags: backend security
run: bundle audit
If you are in the Docker environment. Example.
pre-commit:
scripts:
"good_job.js":
runner: docker run -it --rm <container_id_or_name> {cmd}
If you a frontend/backend developer and want to skip unnecessary commands or override something into Docker. Description.
# lefthook-local.yml
pre-push:
exclude_tags:
- frontend
commands:
packages-audit:
skip: true
If you want to run hooks group directly.
$ lefthook run pre-commit
If you want to run specific group of commands directly.
fixer:
commands:
ruby-fixer:
run: bundle exec rubocop --force-exclusion --safe-auto-correct {staged_files}
js-fixer:
run: yarn eslint --fix {staged_files}
$ lefthook run fixer
If you don't want to see supporting information:
skip_output:
- meta #(version and which hook running)
- success #(output from runners with exit code 0)
1.3.13 (2023-05-11)
FAQs
Simple git hooks manager
The npm package @evilmartians/lefthook-installer receives a total of 382 weekly downloads. As such, @evilmartians/lefthook-installer popularity was classified as not popular.
We found that @evilmartians/lefthook-installer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.