Add deny-pattern and require-pattern builtin hooks

Cargo.toml

@@ -132,6 +132,7 @@ markdown = { version = "1.0.0" }
 predicates = { version = "3.1.2" }
 pretty_assertions = { version = "1.4.1" }
 regex = { version = "1.11.0" }
+regex-automata = { version = "0.4.14" }
 schemars = { version = "1.1.0" }
 textwrap = { version = "0.16.0" }
 

crates/prek/Cargo.toml

@@ -62,6 +62,7 @@ mea = { workspace = true }
 memchr = { workspace = true }
 owo-colors = { workspace = true }
 regex = { workspace = true }
+regex-automata = { workspace = true }
 reqwest = { workspace = true }
 aws-lc-rs = { workspace = true }
 rustc-hash = { workspace = true }

crates/prek/src/hooks/builtin_hooks/mod.rs

@@ -12,6 +12,7 @@ use crate::store::Store;
 
 mod check_illegal_windows_names;
 mod check_json5;
+mod pattern;
 
 #[derive(
     Debug,
@@ -41,6 +42,7 @@ pub(crate) enum BuiltinHooks {
     CheckVcsPermalinks,
     CheckXml,
     CheckYaml,
+    DenyPattern,
     DestroyedSymlinks,
     DetectPrivateKey,
     EndOfFileFixer,
@@ -50,6 +52,7 @@ pub(crate) enum BuiltinHooks {
     MixedLineEnding,
     NoCommitToBranch,
     PrettyFormatJson,
+    RequirePattern,
     TrailingWhitespace,
 }
 
@@ -76,10 +79,12 @@ impl BuiltinHooks {
             | Self::CheckVcsPermalinks
             | Self::CheckXml
             | Self::CheckYaml
+            | Self::DenyPattern
             | Self::DestroyedSymlinks
             | Self::DetectPrivateKey
             | Self::ForbidNewSubmodules
-            | Self::NoCommitToBranch => false,
+            | Self::NoCommitToBranch
+            | Self::RequirePattern => false,
         }
     }
 
@@ -117,6 +122,7 @@ impl BuiltinHooks {
             }
             Self::CheckXml => pre_commit_hooks::check_xml(hook, filenames).await,
             Self::CheckYaml => pre_commit_hooks::check_yaml(hook, filenames).await,
+            Self::DenyPattern => pattern::deny_pattern(hook, filenames).await,
             Self::DestroyedSymlinks => pre_commit_hooks::destroyed_symlinks(hook, filenames).await,
             Self::DetectPrivateKey => pre_commit_hooks::detect_private_key(hook, filenames).await,
             Self::EndOfFileFixer => pre_commit_hooks::fix_end_of_file(hook, filenames).await,
@@ -132,6 +138,7 @@ impl BuiltinHooks {
             Self::MixedLineEnding => pre_commit_hooks::mixed_line_ending(hook, filenames).await,
             Self::NoCommitToBranch => pre_commit_hooks::no_commit_to_branch(hook).await,
             Self::PrettyFormatJson => pre_commit_hooks::pretty_format_json(hook, filenames).await,
+            Self::RequirePattern => pattern::require_pattern(hook, filenames).await,
             Self::TrailingWhitespace => {
                 pre_commit_hooks::fix_trailing_whitespace(hook, filenames).await
             }
@@ -323,6 +330,20 @@ impl BuiltinHook {
                     ..Default::default()
                 },
             },
+            BuiltinHooks::DenyPattern => BuiltinHook {
+                id: "deny-pattern".to_string(),
+                name: "deny patterns".to_string(),
+                entry: "deny-pattern".to_string(),
+                priority: None,
+                groups: None,
+                options: HookOptions {
+                    description: Some(
+                        "fails if any file contains a matching regular expression.".to_string(),
+                    ),
+                    types: Some(tags::TAG_SET_TEXT),
+                    ..Default::default()
+                },
+            },
             BuiltinHooks::DestroyedSymlinks => BuiltinHook {
                 id: "destroyed-symlinks".to_string(),
                 name: "detect destroyed symlinks".to_string(),
@@ -442,6 +463,21 @@ impl BuiltinHook {
                     ..Default::default()
                 },
             },
+            BuiltinHooks::RequirePattern => BuiltinHook {
+                id: "require-pattern".to_string(),
+                name: "require patterns".to_string(),
+                entry: "require-pattern".to_string(),
+                priority: None,
+                groups: None,
+                options: HookOptions {
+                    description: Some(
+                        "fails if any file does not contain a matching regular expression."
+                            .to_string(),
+                    ),
+                    types: Some(tags::TAG_SET_TEXT),
+                    ..Default::default()
+                },
+            },
             BuiltinHooks::TrailingWhitespace => BuiltinHook {
                 id: "trailing-whitespace".to_string(),
                 name: "trim trailing whitespace".to_string(),

crates/prek/src/hooks/builtin_hooks/pattern.rs

@@ -0,0 +1,182 @@
+use std::io::Write;
+use std::path::Path;
+
+use anyhow::{Context, Result};
+use clap::Parser;
+use memchr::memchr_iter;
+use regex_automata::{MatchKind, meta::Regex, util::syntax};
+use tokio::io::{AsyncBufReadExt, BufReader};
+
+use crate::hook::Hook;
+use crate::hooks::run_concurrent_file_checks;
+use crate::run::INTERNAL_CONCURRENCY;
+
+#[derive(Parser)]
+#[command(disable_help_subcommand = true)]
+#[command(disable_version_flag = true)]
+#[command(disable_help_flag = true)]
+struct Args {
+    #[arg(short = 'i', long)]
+    ignore_case: bool,
+    #[arg(short = 'm', long)]
+    multiline: bool,
+    #[arg(required = true, value_name = "PATTERN")]
+    patterns: Vec<String>,
+}
+
+#[derive(Clone, Copy)]
+enum MatchPolicy {
+    Deny,
+    Require,
+}
+
+#[derive(Clone, Copy)]
+enum ScanMode {
+    Lines,
+    Multiline,
+}
+
+struct Matcher {
+    regex: Regex,
+    scan_mode: ScanMode,
+}
+
+impl Matcher {
+    fn new(args: &Args) -> Result<Self> {
+        let syntax = syntax::Config::new()
+            // Enable case-insensitive matching for `-i` / `--ignore-case`.
+            .case_insensitive(args.ignore_case)
+            // Let `^` and `$` match line boundaries for `-m` / `--multiline`.
+            .multi_line(args.multiline)
+            // Let `.` match newlines for `-m` / `--multiline`.
+            .dot_matches_new_line(args.multiline)
+            // Compile byte-oriented patterns so arbitrary file bytes can match.
+            .utf8(false);
+        let regex = Regex::builder()
+            .configure(
+                Regex::config()
+                    // Return the earliest match, using pattern order to break ties.
+                    .match_kind(MatchKind::LeftmostFirst)
+                    // Allow empty matches at any byte offset, as byte regexes do.
+                    .utf8_empty(false),
+            )
+            .syntax(syntax)
+            .build_many(&args.patterns)
+            .context("Failed to compile regex patterns")?;
+
+        let scan_mode = if args.multiline {
+            ScanMode::Multiline
+        } else {
+            ScanMode::Lines
+        };
+
+        Ok(Self { regex, scan_mode })
+    }
+}
+
+pub(crate) async fn deny_pattern(hook: &Hook, filenames: &[&Path]) -> Result<(i32, Vec<u8>)> {
+    run(hook, filenames, MatchPolicy::Deny).await
+}
+
+pub(crate) async fn require_pattern(hook: &Hook, filenames: &[&Path]) -> Result<(i32, Vec<u8>)> {
+    run(hook, filenames, MatchPolicy::Require).await
+}
+
+async fn run(hook: &Hook, filenames: &[&Path], policy: MatchPolicy) -> Result<(i32, Vec<u8>)> {
+    let args = Args::try_parse_from(hook.entry.expect_direct().split_with_args(&hook.args)?)?;
+    let matcher = Matcher::new(&args)?;
+    let file_base = hook.project().relative_path();
+
+    run_concurrent_file_checks(
+        filenames.iter().copied(),
+        *INTERNAL_CONCURRENCY,
+        |filename| check_file(file_base, filename, &matcher, policy),
+    )
+    .await
+}
+
+async fn check_file(
+    file_base: &Path,
+    filename: &Path,
+    matcher: &Matcher,
+    policy: MatchPolicy,
+) -> Result<(i32, Vec<u8>)> {
+    match matcher.scan_mode {
+        ScanMode::Lines => check_lines(file_base, filename, &matcher.regex, policy).await,
+        ScanMode::Multiline => check_multiline(file_base, filename, &matcher.regex, policy).await,
+    }
+}
+
+async fn check_lines(
+    file_base: &Path,
+    filename: &Path,
+    patterns: &Regex,
+    policy: MatchPolicy,
+) -> Result<(i32, Vec<u8>)> {
+    let file = fs_err::tokio::File::open(file_base.join(filename)).await?;
+    let mut reader = BufReader::new(file);
+    let mut matched = false;
+    let mut output = Vec::new();
+    let mut line = Vec::new();
+    let mut line_number = 0;
+
+    while reader.read_until(b'\n', &mut line).await? != 0 {
+        line_number += 1;
+        let contents = trim_line_ending(&line);
+        if patterns.is_match(contents) {
+            if matches!(policy, MatchPolicy::Require) {
+                return Ok((0, Vec::new()));
+            }
+
+            matched = true;
+            write!(output, "{}:{line_number}:", filename.display())?;
+            output.write_all(contents)?;
+            writeln!(output)?;
+        }
+        line.clear();
+    }
+
+    match policy {
+        MatchPolicy::Deny => Ok((i32::from(matched), output)),
+        MatchPolicy::Require => Ok(missing_match(filename)),
+    }
+}
+
+async fn check_multiline(
+    file_base: &Path,
+    filename: &Path,
+    patterns: &Regex,
+    policy: MatchPolicy,
+) -> Result<(i32, Vec<u8>)> {
+    let contents = fs_err::tokio::read(file_base.join(filename)).await?;
+    match policy {
+        MatchPolicy::Deny => {
+            let Some(matched) = patterns.find(&contents) else {
+                return Ok((0, Vec::new()));
+            };
+            let line_number = memchr_iter(b'\n', &contents[..matched.start()]).count() + 1;
+            let matched = &contents[matched.range()];
+            let mut output = Vec::new();
+            write!(output, "{}:{line_number}:", filename.display())?;
+            output.write_all(matched)?;
+            if !matched.ends_with(b"\n") {
+                writeln!(output)?;
+            }
+            Ok((1, output))
+        }
+        MatchPolicy::Require if patterns.is_match(&contents) => Ok((0, Vec::new())),
+        MatchPolicy::Require => Ok(missing_match(filename)),
+    }
+}
+
+fn missing_match(filename: &Path) -> (i32, Vec<u8>) {
+    (
+        1,
+        format!("{}: no pattern matched\n", filename.display()).into_bytes(),
+    )
+}
+
+fn trim_line_ending(line: &[u8]) -> &[u8] {
+    let line = line.strip_suffix(b"\n").unwrap_or(line);
+    line.strip_suffix(b"\r").unwrap_or(line)
+}