Research Triangle PowerShell Users Group Tools for Automation, 8 Oct 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SuperPowered Git Hooks with Thomas Rayner

Description

Thomas Rayner is a Senior Microsoft Security Engineer, PluralSight content author and former Microsoft MVP. In this video, Thomas discusses how you can use the Git Hooks built into Git repositories to do some amazing things!

So what are git hooks? git hooks are scripts that run when a certain event happens in a Git repo. Thomas shows how you can use the automated nature of git hooks to do some truly useful things in your repos automatically.

Research Triangle PowerShell Users Group (RTPSUG) is the largest PowerShell group in the world! We meet twice a month to discuss all topics related to PowerShell and automation. Our topics cover beginner to advanced concepts and offer people a chance to learn new skills and ask questions. One of the foundations that we live by is to create a space to for all to attendees to feel welcome, have a chance to ask questions and be part of a community. For more information on our group, please visit any of following links:

WEB: https://rtpsug.com
MEETUP: https://www.meetup.com/Research-Triangle-PowerShell-Users-Group
LINKEDIN: https://www.linkedin.com/company/rtpsug/
TWITTER: https://twitter.com/rtpsug
GITHUB: https://github.com/rtpsug

A

Hey, thank you, everyone for joining us tonight. It is september 2nd, and we are excited to have everybody here for our presentation tonight with mr thomas rayner who's going to be talking about supercharging, your git repos, with git hooks and we're going to turn it over to mr raynor.

B

All right thanks everyone for uh joining. uh We are going to talk about get hooks tonight as promised uh real, quick just to provide some credibility. I'm tom schringer, I'm a certified. I have a cissp cert, um I'm a security engineer at microsoft. uh I've got a blog, you can check out thomasrender.ca the powershell discord in slack is terrific, it's bridged, so you can join whichever one you prefer. uh You'll you'll talk to the same people.

B

You know if you're looking for any type of power, she'll help or even just to contribute or get more in touch with the powershell community. I can't recommend it highly enough. uh So that's enough about me.

B

Let's talk about get hooks and let's do a little level setting first because, like I know, git and source control in general can be kind of a weird one uh for operations, people and partial people to get their heads around in the first place, like uh I did. My uh I think was my first or second presentation for this user group was just like the six commands you need to know to survive, and this is beyond survival.

B

This is moving into the thriving phase of working with git, so first like okay, sure what is a git hook. Maybe that's a good question to start with.

B

Git hooks are just scripts that run whenever a certain event happens in a git repo, so like, for example, the one I have on the screen here is when you type git commit a script runs and does something so a lot. There's lots of events in get there's commits, there's pushing there's, pulling, there's merging, there's rebasing, um there's different periods within each of these events, and you can create hooks that um triggered these scripts for all of these different events within git.

B

Well, they do like they do anything. You want it's an arbitrary script. You can write them in powershell. You can write them in bash. You can write them in python. You can write them in anything. You want you'll, see uh because git is made by linus torvalds, who uh is also responsible for a popular operating system platform called linux. You may have heard of it.

B

Powershell runs there too, but uh it's kind of a recent development. So a lot of the git hook. Scripting looks a little linuxy, but don't worry you're gonna be just fine and okay. Well. Why would I want to do this? Like that's, probably a good question, because you can customize the behavior of your git client and uh you can use it to customize the behavior of the people uh participating in your repository that you control.

B

So if you've got a bunch of people that you work with and you're just getting them on source control, and you wish they would do something a little differently with their get hygiene or their practices.

B

You can help put put the bumpers down on the pool gutters to help them avoid, throwing a gutter, ball and kind of guide them through through the right steps.

B

uh If a git hook exits in a non-zero like if it throws anything other than a successful exit, it can abort the operation that's in place and we'll talk about more about that. But you can stop get from doing things if some of these hooks don't uh complete successfully, which is kind of nice, because a lot of the time you do something you go. Oh man, this is going to be such a pain to undo this. Well, what if it just caught itself and stopped itself before that ever happened.

B

So what else can we do? You can encourage a commit policy, alter the environment run tests integrate with your ci cd system. Send emails, do literally anything that you can write a script for you can make it a part of your get hooks all right. Now, I'm sure I've sold you you're all a champion of the building. All right. I need to get my hands dirty. How do you use them? Well, let's keep going.

A

So is this: is this more like the idea that we're we're automating the kit process itself? Is that what this is all about?.

B

Not necessarily you're, adding uh customization to the git process and you're, adding your own scripting and utility around the process itself.

B

All right cool it'll become a little more clear as we go through like exactly what the utility here is. So we should first talk about types of hooks right. uh The first is local hooks. These only affect the repo that they live in and by repo I mean like the local copy of the repo. So that's the copy, that's downloaded to your computer, that's the copy that uh your peer downloaded to their computer.

B

Those in this context are different repos, it's the same, like git repositories, the same project, but in this case these hooks live in your specific instance of that repository uh and therefore developers and if you write code, you're a developer, sorry to say can edit their own hooks because they just run locally and they're, not cloned along with the repository, so that it may initially seem a little bit limiting and it kind of is but you'll see why that sort of works that way as we go forward, but these are files that are on your local copy of the git repository that you're, using to interact with your git process.

B

There's server side hooks as well, which are not widely supported, um github, does not support these azure uh devops does not support these. I think gitlab supports them. I don't know about like bitbucket and others, but most popular is obviously github and in this audience probably azure devops. They don't support server side hooks they do support automatic builds. Github has actions azure pipelines, this all runs.

B

You can be set to run automatically when you push to a branch or something which is usually what you would want to do with a server side hook, but they're we're not going to talk about them much because they're not widely supported and there's other ways to achieve the goals.

B

You would normally think to achieve with that, but they would run on a remote like your github remote or your azure devops remote, or something uh in this presentation and going forwards from here we're only talking about local hooks and that's the stuff that runs on your workstation when you're interacting with git uh and you'll you'll, see uh some cool things. We can do with that as we go on, uh so this might have jumped out to you they're, not cloned, along with the repo.

B

So when you go get clone and you put in the url and it pulls the repo down your hooks aren't there well, why not? Let's talk about installing a hook right like how do I set one up? What do I configure? What do I have to do? um I got to set this up for like every repository and everyone who downloads my repository's gonna have to set this up.

B

Don't worry it's not that bad, uh so every git repository has a dot, get folder right, and that is per repository that every time you do a git clone. uh You have a dot, get folder that doesn't get pushed up to your remote.

B

It doesn't uh live anywhere else other than on your local copy of that uh repository, because it's tracking a bunch of metadata, that's where kind of all the inner workings for get live and your inner workings and the branches you created locally, don't need to go anywhere other than your workstation inside of the dot git folder is the hooks folder and that's where all of your git hooks live easy to. Remember right: where do my git hooks live? They live in the get hooked.

B

Folder and all you have to do to install one is copy in your script into that folder. That's it it's all seriously! That's all! There's a bit more!

B

uh The files have to have a specific name so that it uh so git knows like what action your hook is tied to, but that's the installation process so they're very conveniently distributed.

A

So you're saying in that same fashion I know you can probably get to it, but you can simply just you know, copy that file around that that folder around and you're effectively moving it from repo to repo.

B

Exactly um so, this is a peek inside a hooks folder. This is what's in there by default. This is just my demo repository my cat, fax repo, and you notice uh there's a bunch of different files and they all end in dot sample, and that's because they are literally samples when you want to have a git hook. That corresponds to one of these actions.

B

You overwrite it and remove the dot sample extension from it, and then, whenever git detects that you're committing that action, it will trigger your hook and you see they have length right like some are longer and some are shorter, but each of them has content in there that you can use as a crutch and as an aid to kind of learn about the specific hooks. But these are the different events that you can use, and this is kind of an easy way to remember in a reference that you can uh refer to.

B

Let's look at like the anatomy of a hook. Let's look at some code right. If I do a get content on uh this, is the pre-merge commit sample right this so there's an event called pre-merge commit and we're going to talk about what the different events are. So you can kind of get your head around it, but this is the content everything below this is uh what is in that file this.

B

The web part that just shook. If you're, not a linux person, might look weird, you go. Oh, it's commented out that doesn't run in linux, that's called a shebang and, in addition to being fun to say it tells uh linux what kind of shell or environment your script is gonna run in, and so this indicates that it's a bash script. You could see a reference to python here. You could see a reference to other shells here, but the default content- that's in here is just a bash thing. So that's what that is this part.

B

The big part in the middle is a description of when the hook is called and a description of the sample code. That's below, and this also lists what the different arguments that get passed to your hook are sometimes when you, when git calls one of the hooks it'll pass arguments to that hook. So yeah and we'll talk about those specifically later, this one, it says, doesn't have any arguments and it describes how to enable this hook.

B

It describes when this hook is called and has all that other wonderful information great great to have that on hand, and then this part below this is the bash script that runs. This is the code that is uh executing when this hook is installed and gets triggered.

B

So that's everything that's in this one. I picked this one because it's short and it fits on the screen you may have seen in the previous slide. uh I'm sure you all memorized the file lengths. This was a pretty short one. They have much longer ones that have longer descriptions longer examples of how the code works, usually when they have arguments that get passed. It shows you an example of working with those arguments too, but I think they're all bash, which isn't necessarily how a powershell user group audience is going to want to use them.

B

So my demos are going to show you how they work in powershell, but quickly.

B

This is the bulk of the slides, but we're not going to spend a ton of time going through them.

B

I'm going to go through what a lot of the different events are, not all of them, but the most useful ones. So you get a good idea of uh some of you. It might spark the creative juices you might get a bit of an idea of when you can start using some of these before we before.

B

I show you how a demo I've got uh so the pre-commit hook when you type git commit this runs before git asks you for a commit message before a commit is actually created and this hook is triggered and executed, and the script within that hook runs it doesn't take any. It doesn't pass any arguments to your hook and you might use this for like inspecting.

B

What's about to get committed, you might run this when you're gonna automate some tests like hey, wouldn't it be great like before you commit make sure you didn't break any of your tests. Well, that's handy because who wants to commit broken code? uh This way, if you make a git hook, that executes pre-commit before the commit is generated runs your tests. If your tests fail, then it can abort and be like whoa. This didn't work, um I'm gonna, I'm gonna! Stop you from creating that commit. Now you don't have to revert it now.

B

You don't have to do anything. uh It's just it's just all good.

A

So question in here got me thinking the idea of just like all the different things pre-commit to do so. You could even like the idea that you could run anything across the environment, you're running effectively any script, and so hey you want to make sure that you don't commit credentials to your code. So right here go look for credentials. Objects in the you know, fault, throw an error, throw some stopper.

A

So then there's some workflow here where you can stop a commit and you'll get to it right. Something like that.

B

Yeah absolutely um but, like you said, uh like I mentioned, you can run any powershell code. You want python code bashcode. Any code you want to run can be triggered when this event occurs and if that code exits non-zero like if you do an exit one somewhere in that script, then it's gonna. Stop you from creating that commit. So exactly like you said, like hey, I'm inspecting what's about to be committed, are there credentials in there?

B

Well then, maybe my credential scan through an error and exited in an error state there you go uh there's a question in the chat. Is it safe to say these only run when using the git cli and not guitar tools?

B

These should run with your gui tools, but I don't promise anything because a lot of the gui tools behave in ways that you wouldn't necessarily think they would, if you're familiar with the cli, so I'll use, commands differently and obscure flags to change the behavior of git in a way that you wouldn't necessarily expect if you were just kind of living, your life in the cli.

B

um I'd recommend experimenting with that, if you're more keen for that. um But so this is kind of the format that the next few slides go through when it's going to run what the arguments are and kind of what they're good for we're going to go through the next ones. A little quicker here prepare commit message. This is just again. This is a complete file.

B

Name, you make a file called prepare, dash, commit dash msg, and you put that your get hooks folder and then it'll run whatever that code is, and it runs that code in this case again when you run git commit this runs in the same command that the last one did, but it runs after that last hook, it runs after the pre-commit hook to help populate the commit message, so they're very similar, but they run at a slightly different time and you can tell because the art there's arguments that get passed in this one.

B

The last one didn't pass any arguments to the script you're running, but when you run this one, it's going to pass arguments to your hook and you don't have to use them, uh but you can't it's gonna pass um and so again in linux. Everything is a file. Even the temporary data surrounding your commit is a file when you create a commit, it creates a temporary file.

B

That includes the message and includes some other stuff, and when you do- and it runs this script, that temporary file is created, but your commit hasn't been created yet so you get the name of the file that contains the message uh like the commit message when you go like git commit dash m and you put a message in there: um that's stored in a temporary file and where the first argument you get is the path to that temporary file, uh and it also gives you what kind of commit it is.

B

It uses the show one hash of the commit if typo, if that's relevant, if there is a commit there, uh so this can be good for manipulating the commit message. uh This is going to be the demos that I show you if I recall correctly, uh because you can use it to enforce conformity to message standards.

B

If you want all your commits, if you have a branch that is starting with like issue dash and then a number- and you want all your commits to begin with that issue number, you can write a script that detects the name of the branch you're on and then, if you're, on an issue branch it finds that number and it puts the number as a prefix.

B

If it's not there already, and you can build that in and so if you're somebody who's forgetful or you've got junior admins that never remember to put their issue number in their commit message.

B

Then here's a way that you can kind of help them and make that a little bit easier for them to work with the commit dash message hook, also runs when you run git commit and- and it runs after you enter a commit message- uh the hooks assume positional arguments, yeah they're, um they're they're in through standard input, uh I'll show you an example of how the arguments come in and how I like to deal with them.

B

Sorry, just a question there. um This also gets a path to the temp file, name. That contains the message, um and so this runs after that message has been put into that file. um The first sorry, the one we just looked at is just where the file is. This one shows you again, it's the same path, all right, you'll, you'll see.

B

uh This is really good for editing the commit message, so you can use the first one to like reject a bad, commit message or just put one in in the first place. You can use this one to inspect and edit the commit message.

B

Post commit again it's just a file named post dash commit in the get hooks. Folder, that's executable runs when you run git commit, uh but this one doesn't actually affect the outcome of the commit operation. This is just something that runs after you create a commit, so the commit is already created. You can't abort the process of creating a commit with this one, but you can uh it takes no arguments. You can email your boss every time you make a commit.

B

Who wouldn't want to do that? Hey I successfully made a commit. Don't you want to tell everyone? Don't you want to post in teams about it? Don't you want to tweet about it? You can automate that process. Hey. I just made a new commit. Everyone needs to know, maybe not, uh but you can use it to integrate with your ci solutions. Again you can. Maybe this is where you want to run your tests.

B

Maybe you want those broken commits to get created, but you want to run your tests, so the person uh interacting with your code doesn't push them if they're not passing your tests, but you want to commit so they can locally scroll through their history.

B

Just another option: uh post checkout is one that I think is a little underrated. uh This runs when you run git checkout, so you can be checking out a new branch. You could be checking out an existing branch you'd be checking out a file to change the modifications you've made to it, but it runs any time you successfully check out a reference.

B

It passes what the previous head was or the new head was and then a zero or a one depending if it was a file or a branch, and so basically the arguments that are passed here, just tell you uh where you were and what you moved to, because you checked out a new reference right uh python people like this a lot. I know it's a powershell user group, but python generates lots of temp files and stuff depending on the modules you're working with, and you can use this um just any.

B

You want to alter your working directory when you check out a new branch. Maybe maybe you have like a dev branch and when you check out the dev branch, you want a file to be named differently or you want the contents of a file to be different.

B

You can do that with this. You can even have it where you're changing git settings like you're running the git config command to change different settings. Depending on what branch you have checked out again stuff. You would probably just do manually stuff that might be a little bit niche, but it's a really powerful option to be able to run a script. Every time you run git checkout uh preview base, so this runs and you're on git rebates, pretty self-explanatory in the name. But the big deal is it runs before anything gets changed.

B

Rebasing is super powerful in git and it allows you to rewrite history. If you, especially if your permissions to push rebased history to a remote, you can go delete stuff from previous. uh You can delete previous commits. You can change, commit messages. You can change a lot of different stuff with rebasing uh when you run it, it passes arguments which is the upstream branch that the series is forked from, and then the branch that's being rebased. So uh what's the name of the branch that you're rebasing and what branch are you trying to work?

B

Are you trying to fork into um pretty pretty standard references, because that's what rebasing is it's moving commits from one place to another or we're reworking the one that you're working with yourself could be good to make sure you're not about to screw everything up?

B

Always nice uh and but like a more tangible example, you want to make sure that the topic branch hasn't already been merged uh or the one that's being merged hasn't already been merged into the next branch. Again, it's kind of into the weeds of git. If you're, not that familiar and comfortable with it, but is really helpful and useful and it's another good time to maybe run a hey, are you sure about this type of script?

B

uh Pre-Merge commit this runs when you run git merge, so if you're gonna do a merge locally uh to like merge one branch to another, this will run as the merge is being carried out, but before the commit is actually being uh put into that log, and so you can use this to abort a merge, um so there's a whole bunch of different things. You would want to do. This works a whole lot like the pre-commit hook right, because this runs before that commit actually gets created.

B

uh An important note about this one. If you do no dash verify, then you skip this hook, you go well, then. What good is it? Well? Git hooks are not a security boundary because the dev has full control over them. You can use them to interact with security tools. You can use them to interact with your different systems and your ci systems and stuff, but the dev has control over them just like they're any other file. That's on the file system, so they can skip this verification any of the other ones.

B

They can just go delete the hook. It exists on their local file system, so they're not security boundaries, so, but what you can do is use them to interact with security systems so that maybe you hash it. You hash all the contents of your git repository.

B

You push that hash somewhere and when the stuff lands in your um you do the hash again make sure it wasn't messed within transit and if they didn't run that hook, you're not gonna have that you got the idea, like you, have to get a little creative with how you implement these because on their own they're, not security, they're, they're, dev dependent uh this one doesn't take any arguments.

B

Pre-Merge commit when you're running get merged, doesn't take or doesn't pass any arguments to your hook um and, like I said it's kind of the same as pre-commit. uh You can use this to run tests hey when you're merging, hey, let's do the merge and then let's run our tests, and if all our tests fail let's hit the brakes. I don't want to merge anymore because all my stuff's broken uh this can save you some headaches for that.

B

Rather than trying to go reset your branch and undo a commit or sorry undo a merge, maybe you're, merging, like 40 different commits and they're all in between your own. You get the idea. It can be a little bit of a pain good to protect yourself. If and when you can uh post merge runs. uh I heard mike's uh mike light up and I was like not again now.

A

I got a question for you, um and maybe we could save this later, but um but I'm curious about the idea of running tests when, when committing, if a person was running things like pester tests on their own, what kind of tests are you running on a repository that would be different than individual tests, that someone would run via pester or something like that.

B

Most of the times, probably the same tests is, uh is to kind of, in my mind, as I'm kind of saying, that is to protect against the admin who or the the dev. I should say the person who goes in and manipulates the code and then doesn't commit, does a push, never run their tests and then it's up for code review and the reviewer doesn't run the tests either, but they assume that the tests ran, and maybe your ci is not set up.

B

Maybe it doesn't run on the pull right, and this is just to protect you from the person not running the tests locally or you could have different. Maybe you have a full suite of tests that runs when you're committing and just a few tests that you run here and there as you're as you're kind of doing the development thing um it's kind of up to you like for powershell.

B

Specifically, maybe you have just a boilerplate pester test that checks for the presence of comment based help and you want that to run every time you make a commit to make sure that you didn't screw up your comment-based help how it gets parsed and the fact that you have it and everything like that, um but maybe that's not part of the functional tests that you run as a developer. Writing the code right.

B

It's kind of all up to you.

A

So effectively those tests are out of band, and so it's not so, if you're building a module with tests in it so that you know then you'd want those tests inside the module. But if you want, you know these other tests that are effectively out of band, these are functional tests that you know, keep the module itself operational, then that is where that test would go, because it's effectively out of play right, you could do both.

B

um You could have it run the tests that make sure your modules functionality uh is performing correctly. um You you can like the same test that just confirmed that the thing works. The way you want it to you could you could run those tests too? You could run the ones that are stored with module. You could run different ones, you could you can run whatever tests you like.

A

Yeah, I kind of think with what you the example you said is like do you have comment based up it's kind of weird, to actually put that in the module that you you know released to somebody else? It's like. Oh here's, the test to see you know that not that it's weird, but it's just like. Well, that's not to the function. You know it's like a meta test than a functional test.

B

Yeah for for one specifically like that, then yeah, maybe you would want to store that elsewhere, uh but you, but it doesn't matter where they're stored. You can run literally any arbitrary code that you want to, uh because it'll just run any code in that hook. So you, if you want to run stuff from a different repo, if you want to run an integration test, that tests how it works with a different module on your system. You can do that too. um It's really all up to you. It's uh it's! A blank canvas.

B

uh The post merge, uh git hook runs. uh It runs when you do a get pull, but it's actually invoked by git merge and it doesn't in. It doesn't impact the outcome of that merge.

B

It passes a flag specifying whether or not it's a squash merge uh and it could be good for uh manipulating metadata use it with a pre-commit hook to kind of save a little store metadata um this one.

B

I don't have a ton of great examples for because you kind of have to get into the weeds of git a little bit before you're finding um before you're finding a lot of use cases for this, but I just want you to know that this one's out there so that, if you're thinking, oh man, every time, I do a git pull to retrieve more updates and merge them into my branch. I wish I could also now you know that this hook exists and now you know you can do that.

B

Pre-Push this one uh is kind of underrated, uh it happens when you run get push and it can prevent you from pushing to a remote a lot of the docks out. There are like oh well yeah, whatever this one pre-push, they want you to the the commit ones are the most popular.

B

I think this one's great, because you can still create all your commits, but before you push, maybe you do or maybe you don't want to prevent that push from actually reaching your remote passes, the name of the remote in the location of the remote so like when you run git push origin main.

B

The hook receives that reference, the name of the remote um and then that number, that six, seven eight nine zero is the uh is the hash of that commit, is the commit id and then it also you like this is all in the string. These are space separated, standard input, arguments that your hook receives. So you can check out those references. You can do different things. You can manipulate them in any way that you want, but that's what comes into your remote yeah. That's what comes into your hook when you run this.

B

This can be good for aborting a push interacting with a remote system. So again it's another time. You could run your tests and keep it from going. You could have this checking um to make sure that the uh username of the person running it has uh an at yourcompany.com domain attached to it. You want to make because, um if you're like me, I've got repos for work. I've got repos for personal. I've got repos for community projects, uh some of them live on github. Some of them live in azure devops.

B

Some of them live in a different azure devops and I've got um my config set up so that my usernames and my display names are different, based on which organization I'm pushing to whether it's github, whether it's a different azure devops, and you can have these run and check. uh What was your um username when you're pushing? Was it the right one? Was there a match? um Yeah, you can again anything you want to do.

B

You can prevent that push from happening, so you don't have to go rewrite history with a rebase or whatever, and they can be really handy. I'm just going to catch up on the comments. um Yeah the hook will also yeah. You can have hooks validate ticket ids, validate formatting and naming that's great yeah. You can run.

B

um I like running ps script, analyzer in in different hooks to make sure that I'm not pushing stuff that'll, um that'll kind of screw with that um interested in the pre-push to validate the right, username and email, yeah and you'll get. I don't think I have a pre-push one here, but you'll kind of see how that works in the demo, speaking of which you can see the orange reflection on my face from this big screen here.

B

uh It's demo time we're gonna get our hooks in the in the repo and I'm gonna show you how some of this actually works here. um First things. First, I'm gonna go get clone. I've got this cat, fax, repo.

B

And I hope that's big enough, you can see, I have a few files here and I'm just kind of killing a little bit of time. While my extensions load up I've got a license valuable. I have the most interesting script anyone has ever written. It is my favorite in the world it reaches out to the cat, facts, api and uh retrieves a cat fact.

B

um I wish this would go away forever. I think I need to update the version of the powershell extension. um I've also got my hooks demo, folder stevie uh and inside my hook. Demo folder is where you might imagine. I have a bunch of uh double hooks.

B

Where would you have a hook to try to prevent a password being checked in? um uh We could talk about that in a minute, but I'll I'll show you kind of how this demo works. First, you can see if I do.

B

This looks a lot like that screenshot I showed you earlier where these are all dot samples. I don't have any hooks in here. Yet my get behavior is normal, uh or at least as normal as getting our gets uh kind of funny. uh All of these hooks are in the hook, demo folder, but they're, not in my get hooks folder, so none of them are running. What I want to do to make that happen is I'm gonna copy.

B

I love the ps redline autocomplete stuff. uh I'm gonna get rid of those verbose. I'm gonna copy everything from that hook. Demo folder into my get hooks folder and I'm gonna exclude the ps1.

B

So I'm going to put this commit message file this post checkout file and this pre-rebase file into my git hooks and now, if I get the directory listing, all those samples are still there. But now I have my commit message. I have my post checkout hook and I have my pre-rebased hook, and so, if you remember, when those run, I'm just going to show you all this code first and then I'll go through them and execute them.

B

Let's just start here, the commit message took: you remember: this runs when I run git commit. uh I have a shebang at the top, which is just rendered as a comment here and then the code that this hook executes is I'm executing powershell no profile and the command I'm running uh you have to escape the backslashes.

B

I'm going to run this assert commit message which is in my hook, demo folder um and it might you'll see this takes a parameter called temp file, and this is how you use the positional arguments in um in a bash script like dollar. One is the first argument that gets passed and you'll recall. This was the name of the uh of the temporary file that gets created when you're. Creating a commit message uh are the hooks available in a windows environment. Yes, I'm running on windows, 10.

A

So you're running on windows 10 there, but but you're calling actually you know powershell. You know windows version 7., so you could go at this point. You'd call like powershell.exe and then the whole thing right. You wouldn't just put raw.

B

Yeah you can put powershell.exe, I like doing it this way uh because again, remember who the person who may get it is lions torvalds, mid linux, and this is sort of, in my opinion, the cleaner way of doing it, uh because you don't have to change too much with the command line, arguments and the positional parameters and stuff. um There were other arguments passed here, but I just need the first one, because I passed the path to that temporary file into this assert commit message, and so this all this does is calls my powershell script.

B

This doesn't have any syntax, highlighting that I really enjoy, because it doesn't have a file extension um when you're working in vs code. It figures out what type of file you're working with by the extension of that file, and these don't have extensions. So if you start writing powershell code you're not going to get the syntax highlighting and you're not going to get a bunch of the nice stuff that the powershell extension gives you. So I like I like doing them this way, and I recommend you do them this way.

B

You don't have to do them this way, though, because I feel like this keeps it simple and then I can come in and and check out my script. This is the script that it gets called. It takes a pat or it takes a parameter of that temp file and then I'm running I'm getting the content of that temporary file. I'm selecting the first line from it because that's my commit message and what am I doing here, I'm checking to see. uh Did you come to the regular expressions talk I did like a year ago.

B

I'm checking to see if it starts with this string. If the start of the string is cat dash check in my commit message, and if it isn't, I failed the check and it exits one, and if I don't enter this, if block then I'll exit zero, which is a success code, um you can change encoding yeah. You can get a little bit creative with some of the other ways, but I don't. I really get skeezed out messing with encoding when it comes to get stuff, um the post checkout.

B

You remember this runs after you go get checkout um again. This one looks a lot like the other one where I've got the shebang and then I'm just telling it to don't load a profile. All I'm doing is running this. You can skip this if maybe your profile is important for for these get hooks, but all I wanted to do is run this reset working directory thing here and that runs this script reset working directory. I remove all the text files from the uh from the main directory.

B

This one is kind of this one's particularly contrived, but I kind of like seeing it work and then I've got a pre-rebase. This runs every time you do git, rebase and all it does is run my confirm. Rebase script, this one's a little bit more fun.

B

This runs. uh We can step through this in a little more detail, but it this will. All of this will get how far and far ahead and behind my branches from the upstream branch and if I'm more than two commits ahead or behind I'm rejecting my attempt to rebase so uh you'll I'll demo. This as we go here, but those are my my hooks. I've got a commit message. I've got a post checkout and I've got a pre-rebase.

B

So if I do like, if I run this, I do it, let's even check the content. I I hit that api. I ran that script and I put the output into this test.text file uh and I found out.

B

Cats, don't think like uh don't think that they're little people they think we're big cats. This influences their behavior in many ways I bet it does. Can you see why this is just the best api in the world like come on? Like don't you want to learn about cats, um but now I've got one of these text files in here and I'm not tracking it in git.

B

So it's not really a part of my repo.

B

If I go get check out demo branch it uh I should have put a message in there that talked about deleting files, but my file's gone and if I go check out master again, my file doesn't come back because, like it's not like, it was on one branch, but not the other, that uh reset working directory script ran and got rid of that.

B

uh Now, I'm going to go check out my demo branch again.

A

So question there is there's kind of a discussion in chat like the idea of that: hey some more cross-plat thing kind of thing. If you're, if you'd, have some idea or some suggestions with doing some of the scripting for or the code, the hooks for linux versions versus the windows version, because the exes are different, the paths are different, the scripting would be different. You know recommendations there.

B

Yeah, um honestly, I don't cater to a ton of cross-platform stuff in my daily life. uh You might recall from that bio slide that I work at microsoft and you can imagine most of my peers use windows machines, but um so I'm not exactly an authority on the matter, but I know you can script around that, especially in the later versions of powershell you can um like there's the is whoops. Is linux global variable or not global um built-in variable?

B

And so, if you know that you're running like if you're running clock across platform, you know you're running in a version of linux that has this and uh you can kind of work that way you can do the same kind of detections with um the bash scripts in your git hook um and then uh actually david just had a great suggestion in the chat. You can switch your shebang just to be powershell um that might have weird consequences of windows.

B

uh It's a little subjective and different, depending on how you set up your repos and how you set up your workstations.

B

So I don't have a silver bullet for that, but there's a lot of different stuff that you can do and probably what I would do is um you like run it in bash and then leave the ship, bang it as bash and then detect your platform and then run a different command depending on what your platform was.

B

There's a lot of different ways to do it like that's, not the only way that might not even be the best way, but it's probably what I'd do first.

B

uh Okay, so I showed you uh when I check out a branch it deleted. All the text, files that I had in my uh in the root of my repository, pretty cool.

A

B

There one of them just worked now, I'm going to go, get commit, uh allow empty. That makes it so that I don't actually need to have something in my commit, like I don't need to add a file or make any changes. I can just make an empty commit, and my message dash m to include a message is going to be something very descriptive, very helpful, and uh oh, I always forget to do this.

B

um I don't have a global config list, and so it's complaining that it doesn't know my username and my display name. So it completely aborted this that wasn't a github that was just get uh it's saying: hey.

A

B

Global and uh I use local it didn't matter, it didn't know who I was now: let's try that again, uh git commit allow empty so that I don't actually have to be making a change. If you omit that um like, if I don't put that in.

B

And you go there's nothing to commit and I'm gonna go well that doesn't really serve my demo. Does it uh so you have to do an allow empty here, and it's going to tell me that I failed the check well, that is about as terse and unhelpful as you might expect get to be, but that wasn't standard get uh behavior right. If you recall that was the very succinct and educational error message that I write out when uh the commit message doesn't start with that string.

B

If I try that again, gotta go at the start there cat was, it can't check, yeah, okay check.

B

Now I created uh I created a commit, and my prompt is helpfully telling me that I'm a head by one now, if I do it get log, you can see um my head of my local demo branch is ahead of where the origin demo branch is by this, commit that I just created at uh you can see. This is local time for me at uh just before 6 30., so that is that git hook and action so again like this doesn't have to be such a simple file.

B

This could be checking all types of different git stuff. This can be checking all types of different stuff to do with your system. This could be running tests uh you. This can be any code, you want any arbitrary powershell, uh and so now what I'm gonna do is create. I'm gonna create 10, more empty commits and you're going to go wow. That's some powerful coding! You're doing that's a really good work!

B

uh Steve! You asked: how can you get a cat effect every time he makes a commit, make it hit this api every time you do a commit. You can make that your code, I'm also going to quickly get check out master and I'm going to just put an empty commit in there.

B

Demo, branch and now like I'm ahead by 11, commits here right. My demo branch is ahead of the remote by 11 commits and if I go, get rebase master now it's going to tell me your branch is too far out of date to rebase, and then it tells me how many commits I'm ahead are behind.

B

Remember like again, that's not get action. That's my script working here! So here's why it's not a security boundary right like if I'm, oh, I'm a developer. I know everything: okay, I'm gonna, just change that and then uh I'm gonna come back in here and I'm just gonna do that again uh now I have one stage.

B

B

Now I failed the check.

B

Now I'm gonna go get rebase faster right and last time I did this. It told me I was too far ahead, and so it stopped me from rebasing now I went- and I just changed that because I can't because it lives for my local uh repo and I successfully rebased now, I'm ahead by 14 and behind by one, because I had that get on. I had like a master, you get the idea right. I just circumvented that this wasn't a security control. I'm not running this as admin. I didn't need special permission.

B

It doesn't matter what permissions I have to the upstream repo I can just edit these, so these are here to help developers. These are here to help people writing code. uh They're, not here, to protect you from threats right. uh You just saw how I circumvented this control that I have in place here it doesn't. uh It doesn't protect you from someone who knows that they're consciously editing these files, I could have not copied these hooks into my get hooks folder and then they never would have run it all.

B

But they're here to help here is a productivity tool and that's how you should think of them uh catching up on stuff, because holders uh do they get hooks, become part of the get branch or do you have to create? No, so they don't when I uh like. If I go, and I push this to github, which I won't because it's just a bunch of empty, commits um everything. That's in my hooks folder like specifically this commit this post checkout and this pre-rebase.

B

They do not get pushed with everything that I pushed this dot get folder is not tracked by git. This is where all the metadata that makes git work lives, and so that's why they're in this hook, demo folder and that's why I copied these three files into my hooks. Folder is because I needed to set that up locally so that they would run for me locally uh and so, like I recommend, if you're gonna do.

B

This have a hooks folder, just kind of in the root of the repo, and maybe in your readme, where you have like you're contributing, and you have here's how to work on this project. Hey. We have a bunch of git hooks that are really helpful.

B

Here's how to install them copy these files into this folder boom you're done uh the like the the process of installing them is really straightforward. It was just copying those files, but you have to do that and otherwise you don't they don't run.

A

So then you'd exclude those folders. You'd have dot exclude.

B

I would include the like my hook: demo folder I'd include that in my repo I don't have to exclude this gun, but I don't have to exclude this dot get folder, because git already doesn't track. That git already knows that. That's just metadata about git.

A

So you were saying effectively, you could put that that hooks demo into your repo itself and then have that as a distributable part of the repo is that yeah and then there's some mechanism to copy that into your.

B

Right like so because you can see illustrating the point again. If I go get status, it tells me I've got 14 and one, but it's saying nothing to commit. My working tree is clean. I don't have any like unstaged files or anything uh like if I went.

B

If I do that and do a git status now, it's telling me I have this untracked file right, because it's.

B

Right in the cat, fax, repo right, if I do the same thing, if I go high oops, I put that in dot get slash.

B

Now, when I go get status, my working tree is still clean, even though I go uh and look inside my git folder uh out.txt file is still there, because git doesn't track that folder git doesn't track. The hooks doesn't track the info. This is like uh you can go and look inside of like uh you can go, look at the heads and stuff and you can get into the nitty-gritty of like.

B

Oh here are the different branches that I have checked out or that I know about on my local system and I can go and manipulate them here. If I really wanted to this is all metadata about get and it isn't part of the repo that you push and pull and clone and branch and uh merge and commit to so yeah. I would have like just like I haven't set up here where I have this folder. um I probably wouldn't name it dash demo, but it's got the scripts I'm running it's got.

B

Maybe I could have sub folders in here to make it a little bit more apparent, which ones I needed to move into that it hooks folder. I could even have a script in here that performs the setup for me, uh like maybe I have a setup hooks script and it just copies those files into my hooks repo or in my hooks folder uh you can. You can get as carried away with the hand holding as you want to.

A

Yeah I like that.

B

um But but again what you saw when I did a git clone. I had to set that up. So all the files were here for me to do it, but I had to set that up.

B

Okay, so that's the demo. uh Obviously we're spread we're only scratching the surface right. That is far from an exhaustive list, but I just wanted to show you uh we. I wanted to run through that list with you first, so you got an idea of the different places, the different events that can trigger these hooks, and I wanted to show you a few different examples of the types of ways I like to use them to interact with powershell and also to really demonstrate they're, not a security, boundary, 100 players, hilarious.

B

Okay, let me advance the slide, then um they're, not a security boundary. They just let you.

B

Add productivity, add helpfulness, it's something that you do, that you opt into that you have to set up for your per your actual repo. So again it's not a security boundary, but it will help you. It is a productivity tool.

B

uh So that's all I've got prepared, I'm around for another uh 20 minutes or so to kind of talk about this and other stuff. I like to thank you all very much for coming and talking about a part of git that you maybe weren't very comfortable with maybe getting generally not very comfortable with, and this was definitely off the deep end, but I really appreciate you coming and paying attention to this huge. Thank you to the organizers. This is a great user group.

B

You guys get a ton of awesome speakers and uh very professionally run organization and it's always a privilege to come work out with you folks. uh So thanks once again, I've been thomas frater. This was get hooks and enjoy the rest of your evening.