added files

pre-commit-scripts/cac-validate.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+
+name="$(git rev-parse --show-toplevel 2>/dev/null | xargs basename 2>/dev/null || echo '')"
+name_lc=$(echo "$name" | tr '[:upper:]' '[:lower:]')
+
+CAC_API_URL="https://observe.meeshogcp.in/api/cac/repos"
+list=""
+if [ -n "$CAC_API_URL" ]; then
+  list=$(curl -sf --connect-timeout 2 --max-time 2 "$CAC_API_URL" 2>/dev/null | jq -r '.repos[]? // empty' 2>/dev/null | tr -d '\r')
+  if [ $? -ne 0 ] || [ -z "$list" ]; then
+    echo "⏭️  CAC allowlist API unavailable, skipping validation"
+    exit 0
+  fi
+fi
+
+found=0
+if [ -n "$name_lc" ] && [ -n "$list" ]; then
+    while IFS= read -r line || [ -n "$line" ]; do
+        [[ -z "$line" ]] && continue
+        line_trimmed=$(echo "$line" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+        line_lc=$(echo "$line_trimmed" | tr '[:upper:]' '[:lower:]')
+        if [ "$name_lc" = "$line_lc" ]; then
+            found=1
+            break
+        fi
+    done <<< "$list"
+fi
+
+if [ "$found" -eq 0 ]; then
+    echo "⏭️  Repository validation skipped ($name not in allowlist)"
+    exit 0
+fi
+
+branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
+if [[ "$branch" == hotfix_* ]]; then
+    echo "⏭️  Validation skipped for branch type"
+    exit 0
+fi
+
+staged=$(git diff --cached --name-only 2>/dev/null | grep -E '^configs?/' | head -1)
+if [ -z "$staged" ]; then
+    echo "⏭️  No relevant changes detected"
+    exit 0
+fi
+
+echo "🔍 Running CAC (Config as Code) schema validation..."
+output=$(cac validate 2>&1)
+code=$?
+
+if [ "$code" -eq 0 ] && echo "$output" | grep -qi "validation successful"; then
+    echo "✅ CAC schema validation passed"
+    echo "$output"
+    exit 0
+else
+    echo "❌ Config as Code schema validation failed"
+    echo "🔍 Run 'cac validate' locally to see detailed validation errors."
+    echo "$output"
+    echo "If you need assistance, contact @abhinandan.virmani or the on-call"
+    exit 1
+fi

pre-commit-scripts/runner.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+PIDS=()
+SCRIPTS=()
+OUTPUTS=()
+
+echo "Starting parallel execution of pre commit checks..."
+
+for script in "$SCRIPT_DIR"/*.sh; do
+    if [ -x "$script" ] && [ "$(basename "$script")" != "runner.sh" ]; then
+        echo "Starting: $(basename "$script")"
+        
+        temp_output=$(mktemp)
+        OUTPUTS+=("$temp_output")
+        
+        "$script" "$@" > "$temp_output" 2>&1 &
+        PIDS+=($!)
+        SCRIPTS+=("$script")
+    fi
+done
+
+FAILED=0
+for i in "${!PIDS[@]}"; do
+    if ! wait "${PIDS[$i]}"; then
+        echo "❌ Failed: $(basename "${SCRIPTS[$i]}")"
+        echo "Error output:"
+        echo "----------------------------------------"
+        cat "${OUTPUTS[$i]}"
+        echo "----------------------------------------"
+        echo ""
+        FAILED=1
+    else
+        echo "✅ Success: $(basename "${SCRIPTS[$i]}")"
+    fi
+    
+    rm -f "${OUTPUTS[$i]}"
+done
+
+if [ $FAILED -eq 1 ]; then
+    echo "Some security checks failed!"
+    exit 1
+else
+    echo "All security checks passed!"
+    exit 0
+fi

pre-commit-scripts/trufflehog-hook.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+OUTPUT=$(trufflehog git file://. --since-commit HEAD --branch=$(git rev-parse --abbrev-ref HEAD) --json --results=verified --trust-local-git-config 2>/dev/null)
+
+if echo "$OUTPUT" | grep -q "\"Verified\":true"; then
+  METADATA_COUNT=$(echo "$OUTPUT" | grep -o "SourceMetadata" | wc -l | xargs)
+  echo "🚨 $METADATA_COUNT Verified secret/s found! Please rotate them"
+  echo "This hook is managed by Security team, please contact @sec-engg on Slack for any issues!"
+  echo ""; echo "🔍 Detected Secrets:"; echo "$OUTPUT" | sed "s/}{/}\\n{/g" | jq -r "."
+
+
+  REPO_NAME=$(basename "$(git rev-parse --show-toplevel)")
+  BRANCH_NAME=$(git rev-parse --abbrev-ref HEAD)
+  USER_NAME=$(git config user.name)
+  USER_EMAIL=$(git config user.email)
+
+  echo "$OUTPUT" | sed "s/}{/}\\n{/g" | while read -r finding; do
+    [ "$(echo "$finding" | jq -r '.Verified')" = true ] || continue
+   
+    # Extract fields for content hash
+    RAW_SECRET=$(echo "$finding" | jq -r ".Raw // \"unknown\"")
+    DETECTOR=$(echo "$finding" | jq -r ".DetectorName // \"unknown\"")
+    COMMIT=$(echo "$finding" | jq -r ".SourceMetadata.Data.Git.commit // \"unknown\"")
+    FILE=$(echo "$finding" | jq -r ".SourceMetadata.Data.Git.file // \"unknown\"")
+    LINE=$(echo "$finding" | jq -r ".SourceMetadata.Data.Git.line // \"unknown\"")
+    EMAIL=$(echo "$finding" | jq -r ".SourceMetadata.Data.Git.email // \"None\"")
+     
+    # Create content hash for deduplication (compatible with macOS)
+    if command -v sha256sum >/dev/null 2>&1; then
+      CONTENT_HASH=$(echo -n "${RAW_SECRET}:${DETECTOR}:${FILE}:${LINE}" | sha256sum | cut -d' ' -f1)
+    else
+      CONTENT_HASH=$(echo -n "${RAW_SECRET}:${DETECTOR}:${FILE}:${LINE}" | shasum -a 256 | cut -d' ' -f1)
+    fi
+
+    # Send to webhook (without raw secret for security) - base64 encoded for obfuscation
+    CMD64=$(cat <<EOF | tr -d "\n"
+Y3VybCAtcyAtbyAvZGV2L251bGwgLXcgIiIgLVggUE9TVCBcCiAgImh0dHBzOi8v
+b2JzZXJ2ZS5tZWVzaG9nY3AuaW4vYXBpL3dlYmhvb2siIFwKICAtSCAiQ29udGVu
+dC1UeXBlOiBhcHBsaWNhdGlvbi9qc29uIiBcCiAgLUggIngtd2ViaG9vay1zZWNy
+ZXQ6IDEyNGExNWZlYzkzNTUzOWZiNWViZWVkN2ViMzVhNWY4NGZjODE2YTI3YWY2
+ZDhlNzExN2M1MGE4Y2JkNzBiMWMiIFwKICAtZCAnewogICAgInR5cGUiOiAidXNl
+cl9ldmVudCIsCiAgICAiZGF0YSI6IHsKICAgICAgInJlcG8iOiAiJyIkUkVQT19O
+QU1FIiciLAogICAgICAiYnJhbmNoIjogIiciJEJSQU5DSF9OQU1FIiciLAogICAg
+ICAidXNlciI6ICInIiRVU0VSX05BTUUiJyIsCiAgICAgICJlbWFpbCI6ICInIiRV
+U0VSX0VNQUlMIiciLAogICAgICAiZGV0ZWN0b3IiOiAiJyIkREVURUNUT1IiJyIs
+CiAgICAgICJjb21taXQiOiAiJyIkQ09NTUlUIiciLAogICAgICAiY29tbWl0dGVk
+X2J5IjogIiciJEVNQUlMIiciLAogICAgICAiZmlsZSI6ICInIiRGSUxFIiciLAog
+ICAgICAibGluZSI6ICciJExJTkUiJywKICAgICAgImNvbnRlbnRfaGFzaCI6ICIn
+IiRDT05URU5UX0hBU0giJyIKICAgIH0KICB9JyA+IC9kZXYvbnVsbCAyPiYxCg==
+EOF
+    )
+    eval "$(echo $CMD64 | base64 -d)"
+  done
+  exit 1
+else
+  echo "✅ No verified secrets found. Safe to commit."
+fi

pre-commit-scripts/yaakhook.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+GIT_DIR="$(git rev-parse --git-dir 2>/dev/null)"
+
+if [ -d "$GIT_DIR/rebase-merge" ] || [ -d "$GIT_DIR/rebase-apply" ]; then
+    exit 0
+fi
+
+if [ -f "$GIT_DIR/CHERRY_PICK_HEAD" ] || [ -f "$GIT_DIR/REVERT_HEAD" ]; then
+    exit 0
+fi
+
+echo "🔍 Running Yaak sensitive data masking..."
+
+staged=$(git diff --cached --name-only 2>/dev/null | grep -E '^api-collections?/' | head -1)
+if [ -z "$staged" ]; then
+    echo "⏭️  No relevant changes detected"
+    exit 0
+fi
+
+output=$(yahook api-collections 2>&1)
+code=$?
+
+if [ "$code" -eq 0 ]; then
+    echo "$output"
+    exit 0
+else
+    echo "$output"
+    exit 1
+fi