Skip to content

feat: Add bmake pre-commit hook #3998

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arkid15r merged 8 commits into from
Feb 19, 2026
+80 −41
Merged

feat: Add bmake pre-commit hook #3998

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
6804118
feat: add makefile linter
hassaansaleem28 Feb 18, 2026
12b50cb
update code
hassaansaleem28 Feb 18, 2026
03a88b1
Merge branch 'main' into feat/add-makefile-linter-checkmake
hassaansaleem28 Feb 18, 2026
b563223
using bmake instead
hassaansaleem28 Feb 19, 2026
29d03fe
remove custom-dict vars
hassaansaleem28 Feb 19, 2026
9a1a8a2
Merge branch 'main' into feat/add-makefile-linter-checkmake
hassaansaleem28 Feb 19, 2026
1df5a94
Update code
arkid15r Feb 19, 2026
6a10c28
Merge branch 'main' into feat/add-makefile-linter-checkmake
arkid15r Feb 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions .bake.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
# mbake configuration file

debug = false
gnu_error_format = true
verbose = false
wrap_error_messages = false

[formatter]
align_across_comments = false
align_variable_assignments = false
auto_insert_phony_declarations = false
ensure_final_newline = true
fix_missing_recipe_tabs = true
group_phony_declarations = false
indent_nested_conditionals = false
max_consecutive_empty_lines = 2
max_line_length = 120
normalize_empty_lines = true
normalize_line_continuations = true
phony_at_top = false
remove_trailing_whitespace = true
space_after_colon = true
space_around_assignment = true
space_before_colon = false
tab_width = 2
13 changes: 13 additions & 0 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,17 @@
repos:
- repo: https://github.com/EbodShojaei/bake
rev: v1.4.5
Comment on lines +2 to +3
Copy link
Contributor

@coderabbitai coderabbitai bot Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Supply chain risk: personal repository pinned by mutable tag, not by commit SHA.

https://github.com/EbodShojaei/bake is a personal GitHub repository (not an established org/foundation project), and rev: v1.4.5 is a git tag that can be silently re-pointed to a different commit. Pre-commit hooks execute code on every developer's machine on every commit, making this a meaningful supply chain exposure.

Recommend pinning to the specific commit SHA that corresponds to v1.4.5 and adding a comment for traceability:

🔒 Proposed fix: pin to commit SHA 
  - repo: https://github.com/EbodShojaei/bake
-   rev: v1.4.5
+   rev: <full-40-char-SHA-of-v1.4.5-tag>  # v1.4.5

Retrieve the SHA with:

git ls-remote https://github.com/EbodShojaei/bake refs/tags/v1.4.5
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.pre-commit-config.yaml around lines 2 - 3, The pre-commit entry uses a
mutable tag for the third-party repo (repo: https://github.com/EbodShojaei/bake,
rev: v1.4.5); replace the tag with the exact commit SHA for v1.4.5 (obtain via
git ls-remote https://github.com/EbodShojaei/bake refs/tags/v1.4.5) and update
the rev value to that SHA in .pre-commit-config.yaml, then add a short comment
next to the repo entry noting the tag and the resolved SHA for future
traceability.

hooks:
- id: mbake-format
args:
- --config
- .bake.toml
- id: mbake-validate
args:
- --config
- .bake.toml
exclude: ^backend/

- repo: https://github.com/adrienverge/yamllint.git
rev: v1.38.0
hooks:
Expand Down
60 changes: 30 additions & 30 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,36 +83,36 @@ security-scan-code-semgrep:
-w /src \
$$(grep -E '^FROM semgrep/semgrep:' docker/semgrep/Dockerfile | sed 's/^FROM //') \
semgrep \
--config p/ci \
--config p/command-injection \
--config p/cwe-top-25 \
--config p/default \
--config p/django \
--config p/docker \
--config p/docker-compose \
--config p/dockerfile \
--config p/javascript \
--config p/nextjs \
--config p/nginx \
--config p/nodejs \
--config p/owasp-top-ten \
--config p/python \
--config p/r2c-security-audit \
--config p/react \
--config p/secrets \
--config p/secure-defaults \
--config p/security-audit \
--config p/security-headers \
--config p/sql-injection \
--config p/terraform \
--config p/typescript \
--error \
--skip-unknown-extensions \
--timeout 10 \
--timeout-threshold 3 \
--text \
--text-output=semgrep-security-report.txt \
.
--config p/ci \
--config p/command-injection \
--config p/cwe-top-25 \
--config p/default \
--config p/django \
--config p/docker \
--config p/docker-compose \
--config p/dockerfile \
--config p/javascript \
--config p/nextjs \
--config p/nginx \
--config p/nodejs \
--config p/owasp-top-ten \
--config p/python \
--config p/r2c-security-audit \
--config p/react \
--config p/secrets \
--config p/secure-defaults \
--config p/security-audit \
--config p/security-headers \
--config p/sql-injection \
--config p/terraform \
--config p/typescript \
--error \
--skip-unknown-extensions \
--timeout 10 \
--timeout-threshold 3 \
--text \
--text-output=semgrep-security-report.txt \
.

SCANNERS ?= misconfig,vuln

Expand Down
12 changes: 6 additions & 6 deletions backend/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ recreate-schema:
@echo "Recreating Nest schema"
@CMD="psql -U nest_user_dev -d nest_db_dev -c \
'DROP SCHEMA public CASCADE; CREATE SCHEMA public; GRANT ALL ON SCHEMA public TO nest_user_dev'" \
$(MAKE) exec-db-command-it 2>/dev/null
$(MAKE) exec-db-command-it 2>/dev/null
@$(MAKE) migrate

restore-backup:
Expand Down Expand Up @@ -176,11 +176,11 @@ security-scan-backend-image:
--rm \
-e TRIVY_SCANNERS="$(IMAGE_SCANNERS)" \
-v $(CURDIR)/trivyignore.yaml:/trivyignore.yaml:ro \
-v /var/run/docker.sock:/var/run/docker.sock \
-v $(CURDIR)/trivy.yaml:/trivy.yaml:ro \
-v $(CURDIR)/.trivy-cache:/root/.cache/trivy \
$$(grep -E '^FROM aquasec/trivy:' docker/trivy/Dockerfile | sed 's/^FROM //') \
image --config /trivy.yaml $(BACKEND_IMAGE_NAME)
-v /var/run/docker.sock:/var/run/docker.sock \
-v $(CURDIR)/trivy.yaml:/trivy.yaml:ro \
-v $(CURDIR)/.trivy-cache:/root/.cache/trivy \
$$(grep -E '^FROM aquasec/trivy:' docker/trivy/Dockerfile | sed 's/^FROM //') \
image --config /trivy.yaml $(BACKEND_IMAGE_NAME)

SBOM_VERSION := $(if $(RELEASE_VERSION),$(RELEASE_VERSION),local)

Expand Down
1 change: 0 additions & 1 deletion backend/apps/slack/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@ slack-export-data:
@CMD="sed -E -i 's/(\"[^\"]*email\"): *\"([^\"]|\\\")*\"/\1: \"\"/g' data/slack-data.json" $(MAKE) exec-backend-command
@CMD="gzip data/slack-data.json" $(MAKE) exec-backend-command


slack-set-conversation-sync-messages-flags:
@echo "Setting conversation sync messages flags"
@CMD="python manage.py slack_set_conversation_sync_messages_flags" $(MAKE) exec-backend-command
Expand Down
2 changes: 2 additions & 0 deletions cspell/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
.PHONY: check-spelling cspell-install cspell-check cspell-run update-cspell-dependencies

check-spelling: cspell-check

cspell-install:
Expand Down
8 changes: 4 additions & 4 deletions frontend/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,10 @@ SHELL := /bin/bash
build-frontend-local-image:
@DOCKER_BUILDKIT=1 NEXT_PUBLIC_ENVIRONMENT=local docker build \
--build-arg FORCE_STANDALONE=yes \
--no-cache \
-f docker/frontend/Dockerfile \
-t nest-frontend-local \
frontend
--no-cache \
-f docker/frontend/Dockerfile \
-t nest-frontend-local \
frontend

check-frontend: \
format-frontend-code \
Expand Down