The Zenable pre-commit hook automatically checks your code against organizational policies before each commit, preventing policy violations from entering your codebase. This ensures consistent code quality and compliance across your entire development team.
Looking for better performance? Try prek, a drop-in replacement for pre-commit with faster execution. All commands in this guide work with prek by replacing pre-commit with prek.
1
Install UV
Don’t have UV? Install UV hereThen install pre-commit using UV:
uv tool install pre-commit
2
Configure pre-commit
Add to your .pre-commit-config.yaml:
---repos: - repo: https://github.com/Zenable-io/ai-native-python rev: v0.2.0 # Use `pre-commit autoupdate --freeze` to safely maintain this hooks: - id: zenable-check
3
Install the hook
Run this one-time setup in your repository:
pre-commit install
This installs the pre-commit hook into your local git repository.
All-in-one setup: After installing UV, you can run everything with:
$ git commit -m "Add new feature"Run a Zenable check on all changed files.................................Failed- hook id: zenable-check- exit code: 2================================================ Welcome to Zenable Production-Grade AI Coding Tools================================================Detecting files...========================================== CONFORMANCE CHECK COMPLETE==========================================Overall Result: FAILChecks Run: 3File: `/Users/jonzeolla/src/test-repo/feature.py`- Check `og_requests_no_timeout_autofix`: `fail` - Finding: The 'requests' call doesn't have a 'timeout'. Will automatically add 'timeout=60'. - Location: `/Users/jonzeolla/src/test-repo/feature.py:70:16-70:33` - Suggested fix: `requests.get(url, timeout=60)`- Check `og_python_catch_generic_exception`: `fail` - Finding: Avoid catching generic exceptions like 'Exception' or using a bare 'except:'. This can hide unexpected bugs and make debugging difficult. Be explicit about the exceptions you intend to handle (e.g., 'except ValueError:'). - Location: `/Users/jonzeolla/src/test-repo/feature.py:37:5-41:13`- Check `AIRecommendation-with-rag`: `fail` - Finding: The file contains hardcoded secrets (API_KEY, DATABASE_PASSWORD, SECRET_TOKEN) in plain text. Even though this is marked as an example file, these should be replaced with placeholder text or environment variable references to prevent accidental exposure. - Finding: The eval() function is used with user input in dangerous_calculator(), creating a critical code injection vulnerability. This should be removed or replaced with ast.literal_eval() for safe evaluation of literals only. - Finding: The pickle.loads() usage in load_user_data() creates a critical deserialization vulnerability that can lead to arbitrary code execution. This should be replaced with safer serialization methods like json. - Finding: The SQL injection vulnerability in get_user_unsafe() demonstrates dangerous string concatenation. Replace with parameterized queries using placeholders. - Finding: The infinite_recursion() function will cause a stack overflow and crash the program. Add a base case or remove this function entirely. - Finding: The bare except clause in process_data() silently swallows all exceptions including system exits and keyboard interrupts, making debugging impossible. Replace with specific exception types. - Finding: The unsafe_critical_section() function can cause deadlocks if an exception occurs between lock.acquire() and lock.release(). Use 'with lock:' instead. - Finding: The file modifies sys.path at module level which can cause import issues and unpredictable behavior across the application. Remove this modification.
After fixing the issues, the commit succeeds:
$ git commit -m "Add new feature"Run a Zenable check on all changed files.................................Passed
# ❌ Blocked by pre-commitquery = f"SELECT * FROM users WHERE id = {user_input}" # SQL injection vulnerabilitycursor.execute(query)# ✅ Passes pre-commitquery = "SELECT * FROM users WHERE id = ?"cursor.execute(query, (user_input,))
# Check if hooks are installedls .git/hooks/pre-commit# Reinstall if missingpre-commit install
Bypassing the hook temporarily?
In emergencies, you can bypass:
git commit --no-verify -m "Emergency fix"
⚠️ Use sparingly - this defeats the purpose of policy enforcement
Important: You should expect that developer-local configurations can be worked around, either intentionally or unintentionally. For defense in
depth, combine pre-commit hooks with server-side enforcement through our GitHub and GitLab reviewers to ensure
comprehensive policy coverage.
