Git Hound

Hound is a Git plugin that helps prevent sensitive data from being committed into a repository by sniffing potential commits against regular expressions.

How does it work?

Upon commit, it runs the output of git diff -U0 --staged through the Hound, which matches every added or modified line against your provided list of regular expressions from a local .githound.yml file.

Installation

To install Hound, please use go get. If you don't have Go installed, get it here. If you would like to grab a precompiled binary, head over to the releases page. The precompiled Hound binaries have no external dependencies.

go get github.com/ezekg/git-hound

Compiling

To compile for your operating system, simply run the following from the root of the project directory:

go install

To compile for all platforms using goxc, run the following:

goxc -pv={VERSION} -d=releases/

Usage

Commit

# Scan changes since last commit and pass to git-commit when clean
git hound commit …

Sniff

# Scan changes since last commit
git hound sniff HEAD

# Scan entire history of repository
git hound sniff

Option flags

Flag	Type	Default	Usage
-no-color	bool	false	Disable color output
-config=file	string	.githound.yml	Hound config file
-bin=file	string	git	Executable binary to use for git command

Example .githound.yml

Please see Go's regular expression syntax documentation for usage options.

# Output warning on match but continue
warn:
  - '(?i)user(name)?\W*[:=,]\W*.+$'
  - '\/Users\/\w+\/'
# Fail immediately upon match
fail:
  - '(?i)db_(user(name)?|pass(word)?|name)\W*[:=,]\W*.+$'
  - '(?i)pass(word)?\W*[:=,]\W*.+$'
# Skip on matched filename
skip:
  - '\.example$'
  - '\.sample$'