pre-commit

#!/usr/bin/env python
# -*- coding: utf-8 -*-
"""A git hook for syntax and style check of puppet manifests and templates.

This hook can act as an pre-commit or update based on it's filename and checks
the following things:
- syntax and code style check for all puppet manifests
- syntax check for erb templates

Author: Daniel Roschka <daniel@smaato.com>
Author: Denny Schäfer <denny.schaefer@smaato.com>
Author: Andreas Gerler <andreas.gerler@smaato.com>
Copyright: Smaato Inc. 2013-2016
URL: https://github.com/smaato/puppet-git-hook
"""

from distutils.spawn import find_executable
import os
import re
import shutil
import subprocess
import sys
import tempfile

def puppet_syntax_check(cwd, filename):
    """Runs "puppet parser validate $filename" to check the syntax of a puppet manifest."""
    routput = []
    try:
        syntax_check = subprocess.Popen([find_executable('puppet'), 'parser', 'validate', filename],
                                        cwd=cwd,
                                        stdout=subprocess.PIPE,
                                        stderr=subprocess.PIPE)
        output, error = syntax_check.communicate()
        if syntax_check.returncode != 0:
            if output:
                routput.append(re.sub("\033\[[0-9;]+m", "", output.decode()).rstrip())
            if error:
                routput.append(re.sub("\033\[[0-9;]+m", "", error.decode()).rstrip())
        return syntax_check.returncode, routput
    except OSError as e:
        return 1, ["\033[1;31mUnknown error while calling the puppet syntax check.\033[1;m"]


def puppet_style_check(cwd, filename):
    """Runs a puppet style check for a puppet manifest using puppet-lint.

    Puppet lint is called in the following way to do the style check:
    puppet-lint --no-80-chars-check --no-puppet_url_without_modules-check --fail-on-warnings $filename
    """
    routput = []
    try:
        style_check = subprocess.Popen([find_executable('puppet-lint'), '--no-80chars-check', '--no-puppet_url_without_modules-check', '--fail-on-warnings', filename],
                                       cwd=cwd,
                                       stdout=subprocess.PIPE,
                                       stderr=subprocess.PIPE)
        output, error = style_check.communicate()
        if style_check.returncode != 0:
            if output:
                routput.append(re.sub("\033\[[0-9;]+m", "", output.decode()).rstrip())
            if error:
                routput.append(re.sub("\033\[[0-9;]+m", "", error.decode()).rstrip())
        return style_check.returncode, routput
    except OSError as e:
        return 1, ["\033[1;31mUnknown error while calling the puppet style check.\033[1;m"]


def erb_syntax_check(cwd, filename):
    """Runs a syntax check for puppet erb templates, using erb."""
    routput = []
    try:
        erb_check = subprocess.Popen(["%s -P -x -T '-' %s | %s -c" % (find_executable('erb'), filename, find_executable('ruby'))],
                                     cwd=cwd,
                                     stdout=subprocess.PIPE,
                                     stderr=subprocess.PIPE,
                                     shell=True)
        output, error = erb_check.communicate()
        if erb_check.returncode != 0:
            if output:
                routput.append(re.sub("\033\[[0-9;]+m", "", output.decode()).rstrip())
            if error:
                routput.append(re.sub("\033\[[0-9;]+m", "", error.decode()).rstrip())
        return erb_check.returncode, routput
    except OSError as e:
        return 1, ["\033[1;31mUnknown error while calling the erb template check.\033[1;m"]

def yaml_syntax_check(cwd, filename):
    """Runs a syntax check for yaml files, using ruby."""
    fake_yaml_returncode = 0
    routput = []
    try:
        yaml_check = subprocess.Popen(["%s -ryaml -e \"begin;YAML.load_file('%s');rescue Exception => e;STDERR.puts \\\"%s:#{e}\\\";end\"" % (find_executable('ruby'), filename, filename)],
                                      cwd=cwd,
                                      stdout=subprocess.PIPE,
                                      stderr=subprocess.PIPE,
                                      shell=True)
        output, error = yaml_check.communicate()
        if output:
            routput.append(re.sub("\033\[[0-9;]+m", "", output.decode()).rstrip())
        if error:
            routput.append(re.sub("\033\[[0-9;]+m", "", error.decode()).rstrip())
            fake_yaml_returncode = 1

        return fake_yaml_returncode, routput
    except OSError as e:
        return 1, ["\033[1;31mUnknown error while calling the yaml file check.\033[1;m"]

def check_files(cwd, files):
    """Method to find all files to check and to call the associated checks per file."""
    syntax_check_returncode = 0
    style_check_returncode = 0
    erb_syntax_check_returncode = 0
    yaml_syntax_check_returncode = 0

    for filename in files:
        syntax_check_returncode_temp = 0
        style_check_returncode_temp = 0
        erb_syntax_check_returncode_temp = 0
        yaml_syntax_check_returncode_temp = 0

        # only check files which are existing, because git might list files which
        # have been moved or removed with the commit.
        if not os.path.isfile(os.path.join(cwd, filename)):
            continue

        # files ending with .pp should be puppet manifests and should pass
        # trough the puppet syntax and style check
        if filename.lower().endswith('.pp'):
            syntax_check_returncode_temp, syntax_check_output = puppet_syntax_check(cwd, filename)
            syntax_check_returncode = syntax_check_returncode+syntax_check_returncode_temp
            style_check_returncode_temp, style_check_output = puppet_style_check(cwd, filename)
            style_check_returncode = style_check_returncode_temp+style_check_returncode

        # files ending with .erb should be erb templates and should pass
        # trough the erb termplate syntax check
        if filename.lower().endswith('.erb'):
            erb_syntax_check_returncode_temp, erb_syntax_check_output = erb_syntax_check(cwd, filename)
            erb_syntax_check_returncode = erb_syntax_check_returncode_temp+erb_syntax_check_returncode

        if filename.lower().endswith('.yaml'):
            yaml_syntax_check_returncode_temp, yaml_syntax_check_output = yaml_syntax_check(cwd, filename)
            yaml_syntax_check_returncode = yaml_syntax_check_returncode_temp+yaml_syntax_check_returncode

        if syntax_check_returncode_temp != 0 \
            or style_check_returncode_temp != 0 \
            or erb_syntax_check_returncode_temp != 0 \
            or yaml_syntax_check_returncode_temp != 0:

            print("\033[1;37m"+filename+":\033[1;m")

            if syntax_check_returncode_temp != 0:
                print("\n".join(syntax_check_output))

            if style_check_returncode_temp != 0:
                print("\n".join(style_check_output))

            if erb_syntax_check_returncode_temp != 0:
                print("\n".join(erb_syntax_check_output))

            if yaml_syntax_check_returncode_temp != 0:
                print("\n".join(yaml_syntax_check_output))

            print('')

    # only print out messages if we've processed at least one file
    if files:
        if syntax_check_returncode != 0 \
            or style_check_returncode != 0 \
            or erb_syntax_check_returncode != 0 \
            or yaml_syntax_check_returncode != 0:

            if syntax_check_returncode != 0:
                print("\033[1;31mSyntax check for puppet manifests failed!\033[1;m")

            if style_check_returncode != 0:
                print("\033[1;31mCode style check for puppet manifests failed!\033[1;m")

            if erb_syntax_check_returncode != 0:
                print("\033[1;31mSyntax check for erb templates failed!\033[1;m")

            if yaml_syntax_check_returncode != 0:
                print("\033[1;31mSyntax check for yaml files failed!\033[1;m")

            return 1
        else:
            print("\033[1;32mSyntax and code style check passed sucessfully.\033[1;m")
            return 0


if __name__ == '__main__':
    """Main method which checks some environmental details, before calling the actual checks.

    This method checks as what kind of hook (update or pre-commit) this script is running,
    whether old or new references are empty, because that'll mean a branch has been created
    or deleted which causes different behaviors.
    """
    binary_missing = False

    if find_executable('puppet') == None:
        print("\033[1;31mpuppet not found. Install it to get this hook working.\033[1;m")
        binary_missing = True

    if find_executable('puppet-lint') == None:
        print("\033[1;31mpuppet-lint not found. Install it to get this hook working.\033[1;m")
        binary_missing = True

    if find_executable('ruby') == None:
        print("\033[1;31mruby not found. Install them to get this hook working.\033[1;m")
        binary_missing = True

    if find_executable('erb') == None:
        print("\033[1;31merb not found. Install them to get this hook working.\033[1;m")
        binary_missing = True

    if binary_missing:
        sys.exit(1)

    script_name = os.path.basename(sys.argv[0])
    files = []

    # let's use startswith, because e.g. gitolite uses update.secondary for
    # user defined update hooks
    if script_name.startswith('update'):
        branch = sys.argv[1]
        oldrev = sys.argv[2]
        newrev = sys.argv[3]

        # allow to delete remote branches
        if newrev == '0000000000000000000000000000000000000000':
            sys.exit(0)

        if oldrev == '0000000000000000000000000000000000000000':
            files = os.popen('git diff-index --cached --name-only %s' % newrev).read().splitlines()
        else:
            files = os.popen('git diff --name-only %s..%s' % (oldrev, newrev)).read().splitlines()

        # remove duplicates
        files = list(set(files))

        temp_dir = tempfile.mkdtemp()

        try:
            # create a directory containing the version of the repository we're trying to push
            subprocess.check_output(['git archive '+newrev+' | tar -xC '+temp_dir], shell=True)
        except OSError as e:
            if e.errno == os.errno.ENOENT:
                print("git not found. Install it to get this hook working.")
            else:
                print("Unknown error while preparing temporary cloned repository.")
            sys.exit(1)

        return_code = check_files(temp_dir, files)

        try:
            shutil.rmtree(temp_dir)
        except OSError as e:
            print("Problem while trying to remove the temporary cloned repository.")
            sys.exit(1)

    elif script_name.startswith('pre-commit'):
        # stash changes which aren't being committed during this commit
        stashed_diff, error = subprocess.Popen(['git', 'diff', '--full-index', '--binary'],
                                               stdout=subprocess.PIPE,
                                               stderr=subprocess.PIPE).communicate()
        subprocess.call(['git', 'stash', '--keep-index'], stdout=subprocess.PIPE)

        output, error = subprocess.Popen(['git', 'diff', '--cached', '--name-only'],
                                         stdout=subprocess.PIPE,
                                         stderr=subprocess.PIPE).communicate()
        files = output.splitlines()
        return_code = check_files("./", [file.decode() for file in files])

        # unstash stashed files again
        subprocess.Popen(['git', 'apply', '--whitespace=nowarn'],
                         stdin=subprocess.PIPE,
                         stdout=subprocess.PIPE,
                         stderr=subprocess.PIPE).communicate(input=stashed_diff)
        subprocess.call(['git', 'stash', 'drop', '-q'],
                        stdout=subprocess.PIPE,
                        stderr=subprocess.PIPE)

    sys.exit(return_code)