Pre-commit Hook - Zenable Governance Platform

Overview

The Zenable pre-commit hook automatically checks your code against organizational policies before each commit, preventing policy violations from entering your codebase. This ensures consistent code quality and compliance across your entire development team.

Quick Start

Looking for better performance? Try prek, a drop-in replacement for pre-commit with faster execution. All commands in this guide work with prek by replacing pre-commit with prek.

Install UV

Don’t have UV? Install UV hereThen install pre-commit using UV:

uv tool install pre-commit

Configure pre-commit

Add to your .pre-commit-config.yaml:

---
repos:
 - repo: https://github.com/Zenable-io/ai-guardrails
   rev: v2.0.0 # Consider `pre-commit autoupdate --freeze` to safely lock and maintain this
   hooks:
     - id: zenable-check

Install the hook

Run this one-time setup in your repository:

pre-commit install

This installs the pre-commit hook into your local git repository.

All-in-one setup: After installing UV, you can run everything with:

uv tool install pre-commit && pre-commit install

How It Works

When you commit code, the pre-commit hook:

Intercepts the commit before it’s finalized
Checks changed files against your configured policies
Reports violations with specific line numbers and fix suggestions
Blocks the commit if violations are found (configurable)
Allows the commit once all issues are resolved

Example Workflow

When issues are found, the commit is blocked:

$ git commit -m "Add payment processing"
Zenable Conformance Check................................................Failed
- hook id: zenable-check
- exit code: 2

  ╭──────────────────────────────────────╮
  │          Welcome to Zenable          │
  │   Production-Grade AI Coding Tools   │
  ╰──────────────────────────────────────╯

  Checking files against requirements...

  Guardrails  ████████████████████████ 100%  1/1 files
  Complete

  AI Review   ████████████████████████ 100%  1/1 files
  Complete


  ╭────────────────────────────────────────────────────────────────────────────────╮
  │  1. src/payments.py                                                            │
  │  ✗ AIRecommendation-with-rag-high-quality: fail [security, inconsistency,      │
  │    complexity]                                                                 │
  │    Issue 1.1 [Line 3 | security]                                               │
  │  ╭──────────────────────────────────────────────────────────────────────────╮  │
  │  │ A real API key is hardcoded in the source file. Secrets should be stored │  │
  │  │ in environment variables or a secrets manager.                           │  │
  │  ╰──────────────────────────────────────────────────────────────────────────╯  │
  │    Issue 1.2 [Line 12 | inconsistency]                                         │
  │  ╭──────────────────────────────────────────────────────────────────────────╮  │
  │  │ Payment amounts are handled as floats here, but the product requirements │  │
  │  │ and the shared billing module use integer cents for all monetary values. │  │
  │  │ Convert to integer cents for consistency.                                │  │
  │  ╰──────────────────────────────────────────────────────────────────────────╯  │
  │    Issue 1.3 [Line 27 | complexity]                                            │
  │  ╭──────────────────────────────────────────────────────────────────────────╮  │
  │  │ This module calls the payment provider's API directly instead of going   │  │
  │  │ through the existing payments gateway layer, bypassing its retry and     │  │
  │  │ idempotency handling. Route the call through the gateway.                │  │
  │  ╰──────────────────────────────────────────────────────────────────────────╯  │
  ╰────────────────────────────────────────────────────────────────────────────────╯
  ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  Scope
    AI Review
      Enabled finding categories: bug, readability, performance, complexity, security, inconsistency, accessibility, mistake
    1 file(s) discovered, 1 scanned
      Include: src/payments.py
  ───────────────────────────────────────
  Result: FAIL
  1 checks run, 3 findings across 1 files

After fixing the issues, the commit succeeds:

$ git commit -m "Add payment processing"
Zenable Conformance Check................................................Passed

Common Use Cases

Security Policies

Prevent security vulnerabilities:

# ❌ Blocked by pre-commit
query = f"SELECT * FROM users WHERE id = {user_input}"  # SQL injection vulnerability
cursor.execute(query)

# ✅ Passes pre-commit
query = "SELECT * FROM users WHERE id = ?"
cursor.execute(query, (user_input,))

Code Quality

Enforce quality standards:

// ❌ Blocked by pre-commit
console.log(userData);  // Debug logging in production code

// ✅ Passes pre-commit
logger.debug(userData);  // Proper logging

Compliance Requirements

Ensure regulatory compliance:

# ❌ Blocked by pre-commit
def process_payment(card_number):
    log(f"Processing payment for {card_number}")  # PCI violation

# ✅ Passes pre-commit
def process_payment(card_number):
    log(f"Processing payment for {mask_card(card_number)}")

Troubleshooting

Hook not running?

Ensure the hook is installed:

# Check if hooks are installed
ls .git/hooks/pre-commit

# Reinstall if missing
pre-commit install

Bypassing the hook temporarily?

In emergencies, you can bypass:

git commit --no-verify -m "Emergency fix"

⚠️ Use sparingly - this defeats the purpose of policy enforcement

Important: You should expect that developer-local configurations can be worked around, either intentionally or unintentionally. For defense in depth, combine pre-commit hooks with server-side enforcement through our GitHub and GitLab reviewers to ensure comprehensive policy coverage.

Updating the Hook

Keep your policies current:

# Update to latest version
pre-commit autoupdate --freeze

# Commit the updated config
git add .pre-commit-config.yaml
git commit -m "Update Zenable pre-commit hook"

Best Practices

Start gradually - Begin with warnings before enforcing. Review our deployment guide for proven adoption strategies
Run manually first - Test with pre-commit run --all-files
Keep hooks fast - Use file filters to check only relevant files
Update regularly - Run pre-commit autoupdate monthly via scheduled pipelines
Document exceptions - Make policy exceptions visible and temporary
Provide context - Help developers understand why policies exist
Be Automation-first - See starting new projects to see how you can have pre-commit hooks automatically configured from the first commit

Comparison with Other Tools

Feature	Zenable Pre-commit	Traditional Linters	SAST Tools
Policy customization	✅ Natural language	❌ Code rules only	❌ Fixed rules
Setup complexity	Simple	Moderate	Complex
Speed	Fast	Fast	Slow
AI-powered fixes	✅	❌	❌
Cross-language	✅	❌ Per-language	✅
Policy-as-code	✅	❌	Partial

Next Steps

Configure the IDE integration for real-time feedback
Set up GitHub or GitLab integrations for pull request checks
Define custom policies for your organization
Explore advanced use cases

​Overview

​Quick Start

​How It Works

​Example Workflow

​Common Use Cases

​Security Policies

​Code Quality

​Compliance Requirements

​Troubleshooting

​Updating the Hook

​Best Practices

​Comparison with Other Tools

​Next Steps

Overview

Quick Start

How It Works

Example Workflow

Common Use Cases

Security Policies

Code Quality

Compliance Requirements

Troubleshooting

Updating the Hook

Best Practices

Comparison with Other Tools

Next Steps