Skip to main content

vulkro init and vulkro install-hook

Install git hooks that block a commit or push which adds new findings. Use install-hook: vulkro init is deprecated.

vulkro install-hook               # pre-commit and pre-push
vulkro install-hook --pre-commit  # pre-commit only
vulkro install-hook --uninstall   # remove the Vulkro block

vulkro install-hook​

It writes a marked block into each hook file, so it is safe to re-run and works alongside Husky or a hand-written hook.

  • pre-commit runs vulkro ctx check --staged --fast (warns on broken call sites), then vulkro gate against HEAD, which fails only on findings new since HEAD.
  • pre-push runs a fast, high-confidence quick scan of src.
FlagDescription
--pre-commit, --pre-pushManage only this hook. With neither, both are installed.
--block-on-ctx-checkBlock the commit when ctx check finds a problem, instead of warning.
--uninstallRemove the Vulkro block.
--forceReplace the whole hook file with the Vulkro block.

Skip the hooks once with VULKRO_SKIP_HOOKS=1. Set VULKRO_OFFLINE=1 to keep the hooks off the network. Without a licence, the hooks never block: they print a notice ending in vulkro: license_required and let git continue.

Exit codes: 0 hooks installed, updated or removed; 2 not a git repo or a write failure. The hook itself exits 1 on findings.

vulkro init (deprecated)​

vulkro init --pre-commit writes a whole pre-commit hook file (.husky/pre-commit with Husky, else .git/hooks/pre-commit) that runs vulkro gate --base HEAD. --force overwrites an existing file. Skip it once with VULKRO_SKIP_PRECOMMIT=1. It still works for at least one more release and prints a warning.

Exit codes: 0 hook installed; 2 not a git repo, hook exists without --force, or a write failure.

See also: vulkro gate, vulkro ctx, CI/CD integration.

Last updated on