From 90b7100d6be3a6efbfb388bcb93ad2e91846ea47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1niel=20K=C3=A1ntor?= <git@daniel-kantor.com>
Date: Thu, 19 Dec 2024 18:16:49 +0100
Subject: [PATCH] add rule to require pre-commit to be configured in the
 repository (#242)

Co-authored-by: Giuseppe Scuglia <peppescg@gmail.com>
---
 ...uire_pre_commit_to_be_configured.test.yaml | 19 +++++++
 .../correct/.pre-commit-config.yaml           | 13 +++++
 .../misconfigured/.pre-commit-config.yaml     |  4 ++
 .../require_pre_commit_to_be_configured.yaml  | 53 +++++++++++++++++++
 4 files changed, 89 insertions(+)
 create mode 100644 rule-types/common/require_pre_commit_to_be_configured.test.yaml
 create mode 100644 rule-types/common/require_pre_commit_to_be_configured.testdata/correct/.pre-commit-config.yaml
 create mode 100644 rule-types/common/require_pre_commit_to_be_configured.testdata/misconfigured/.pre-commit-config.yaml
 create mode 100644 rule-types/common/require_pre_commit_to_be_configured.yaml

diff --git a/rule-types/common/require_pre_commit_to_be_configured.test.yaml b/rule-types/common/require_pre_commit_to_be_configured.test.yaml
new file mode 100644
index 0000000..7d24f14
--- /dev/null
+++ b/rule-types/common/require_pre_commit_to_be_configured.test.yaml
@@ -0,0 +1,19 @@
+tests:
+  - name: "Should have at least one pre-commit hook configured"
+    def: {}
+    params: {}
+    expect: "pass"
+    git:
+      repo_base: correct
+  - name: "Should fail pre-commit is not configured with at least one hook"
+    def: {}
+    params: {}
+    expect: "fail"
+    git:
+      repo_base: misconfigured
+  - name: "Should fail is pre-commit is not configured at all"
+    def: {}
+    params: {}
+    expect: "fail"
+    git:
+      repo_base: empty
diff --git a/rule-types/common/require_pre_commit_to_be_configured.testdata/correct/.pre-commit-config.yaml b/rule-types/common/require_pre_commit_to_be_configured.testdata/correct/.pre-commit-config.yaml
new file mode 100644
index 0000000..88bff22
--- /dev/null
+++ b/rule-types/common/require_pre_commit_to_be_configured.testdata/correct/.pre-commit-config.yaml
@@ -0,0 +1,13 @@
+repos:
+-   repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v3.2.0
+    hooks:
+    -   id: trailing-whitespace
+    -   id: end-of-file-fixer
+    -   id: check-yaml
+    -   id: check-added-large-files
+
+-   repo: https://github.com/tenable/terrascan
+    rev: 'v1.28.0'
+    hooks:
+      - id: terraform-pre-commit
diff --git a/rule-types/common/require_pre_commit_to_be_configured.testdata/misconfigured/.pre-commit-config.yaml b/rule-types/common/require_pre_commit_to_be_configured.testdata/misconfigured/.pre-commit-config.yaml
new file mode 100644
index 0000000..92cd124
--- /dev/null
+++ b/rule-types/common/require_pre_commit_to_be_configured.testdata/misconfigured/.pre-commit-config.yaml
@@ -0,0 +1,4 @@
+repos:
+-   repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v3.2.0
+    hooks: []
diff --git a/rule-types/common/require_pre_commit_to_be_configured.yaml b/rule-types/common/require_pre_commit_to_be_configured.yaml
new file mode 100644
index 0000000..5a8e722
--- /dev/null
+++ b/rule-types/common/require_pre_commit_to_be_configured.yaml
@@ -0,0 +1,53 @@
+---
+version: v1
+release_phase: alpha
+type: rule-type
+name: require_pre_commit_to_be_configured
+display_name: Require pre-commit to be installed
+short_failure_message: pre-commit configuration file missing
+severity:
+  value: medium
+context: {}
+description: |
+  Verifies that `pre-commit` is installed in the repository
+guidance: |
+  Ensure that (pre-commit)[https://pre-commit.com/] is configured in a repository.
+
+def:
+  in_entity: repository
+  rule_schema:
+    type: object
+    properties: {}
+  ingest:
+    type: git
+    git: {}
+  eval:
+    type: rego
+    rego:
+      type: deny-by-default
+      def: |
+        package minder
+        import future.keywords.if
+        import future.keywords.every
+
+        default message := "pre-commit configuration file missing"
+        default allow := false
+
+        
+        # pre-commit hook
+        precommit := file.read(".pre-commit-config.yaml")
+        
+        parsed_data := parse_yaml(precommit)
+
+        allow if {
+          some repo_id, hook_id
+          repo_data := parsed_data.repos[repo_id]
+          hooks = repo_data["hooks"]
+
+          hooks[hook_id]
+        }
+
+        message := "" if allow
+  alert:
+    type: security_advisory
+    security_advisory: {}