#!/bin/sh
# bravos hook template: git pre-push — runs `bravos pre-pr` before every push.
#
# Installed by `bravos hooks install git-pre-push`, on your say-so, into git's own hooks directory,
# which git never commits or shares. It is yours to edit: change BRAVOS_PRE_PR_ARGS below (for
# example add --no-scan to skip SAST on every push, or --require sast to refuse a push when the
# analyzer cannot run here), or delete this file to remove it.
#
# What it does: stops the push only when `bravos pre-pr` exits 1 — a finding this change introduced,
# or annotations guardlink cannot parse. Every other answer lets the push through, saying why on
# stderr: 0 (pass or warn), 2 (nothing to evaluate) and 3 (a stage you --require could not run).
# Skip it once with `git push --no-verify`.
BRAVOS_PRE_PR_ARGS=${BRAVOS_PRE_PR_ARGS:-}

if ! command -v bravos >/dev/null 2>&1; then
    echo "bravos pre-push: bravos is not on PATH, so this push was not checked" >&2
    exit 0
fi

# shellcheck disable=SC2086  # the arguments are meant to split
bravos pre-pr $BRAVOS_PRE_PR_ARGS
status=$?
case "$status" in
    0) exit 0 ;;
    1) echo "bravos pre-push: the change introduced a finding (listed above). Fix it, or push" \
            "with --no-verify to skip this check once." >&2
       exit 1 ;;
    *) echo "bravos pre-push: the check could not run fully here (exit $status); pushing anyway" >&2
       exit 0 ;;
esac
