feat!: disable osv-scanner pre-commit hook by default - #27
Conversation
`make scan` resolves every dependency against the osv.dev API. On a mid-sized Go project that is roughly a minute of network round-trips on any commit touching go.mod, go.sum, or requirements.txt — slow enough that it discourages small, frequent commits. Vulnerability scanning is a better fit for CI, where it runs on a schedule and on every pull request without sitting in the commit path. Projects that have no CI-side scan can opt back in per-project with `osv-scanner.enable = true`. Also swap the README and example snippets to disable `lint` instead, so they still demonstrate turning a default hook off, and show osv-scanner as the opt-in example. BREAKING CHANGE: the osv-scanner pre-commit hook no longer runs by default. Projects relying on it as their only vulnerability scan must either add a CI-side scan or set `osv-scanner.enable = true` in `preCommitHooks`.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe default ChangesVulnerability scanning hook configuration
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to This change disables the osv-scanner pre-commit hook by default and documents how projects can opt back in; no actionable merge-blocking risk remains after normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
3 participants
What
Disable the
osv-scannerpre-commit hook by default and document how to opt back in.Refs opendefensecloud/solution-arsenal#669
Why
make scanresolves every dependency against the osv.dev API, adding roughly aminute to any commit that touches
go.mod,go.sum, orrequirements.txt—slow enough that it discourages small, frequent commits. Vulnerability scanning
belongs in CI, where it runs on a schedule and on every pull request without
blocking a commit.
Testing
Manual: entered the dev shell in
example/, confirmed theosv-scannerhook isno longer installed by default and that setting
osv-scanner.enable = trueinpreCommitHooksbrings it back.Notes for reviewers
Breaking change for consumers relying on the hook running automatically.
Upgrade path: projects without a CI-side scan opt back in per-project:
The README/example snippets were also flipped — they now use
lintas the"disable a default hook" example and
osv-scanneras the "enable a hook that'soff by default" example.
Checklist
Tests added/updatedn/aSummary by CodeRabbit
New Features
Documentation