.git/hooks/pre-commit is far too slow
#128
Comments
|
Grype updates its database at the first run or every 5 days. The size is approximately 1GB. I think this pre-hook should be removed. There isn't much benefit in running a potentially outdated CVE check locally, especially considering that the GitHub Action always performs a check against the latest version. |
github-merge-queue bot
pushed a commit
that referenced
this issue
Sep 21, 2023
## Description There is not much benefit in running a potentially outdated CVE check locally, especially considering that the GitHub Action always performs a check against the latest version. - Fixes #128 ## Context Grype [updates its database](https://github.com/anchore/grype#data-staleness) at the first run or every 5 days. The size is approximately 1GB. It may take minutes for the scan dependencies git hook to complete. This is not a good user experience. ## Type of changes - [x] Refactoring (non-breaking change) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would change existing functionality) - [x] Bug fix (non-breaking change which fixes an issue) ## Checklist - [x] I am familiar with the [contributing guidelines](../docs/CONTRIBUTING.md) - [x] I have followed the code style of the project - [ ] I have added tests to cover my changes - [x] I have updated the documentation accordingly - [ ] This PR is a result of pair or mob programming --- ## Sensitive Information Declaration To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including [PII (Personal Identifiable Information) / PID (Personal Identifiable Data)](https://digital.nhs.uk/data-and-information/keeping-data-safe-and-benefitting-the-public) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter. - [x] I confirm that neither PII/PID nor sensitive data are included in this PR and the codebase changes.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Is there an existing issue for this?
Current Behavior
make configinstalls a precommit hook to run a few tasks on commit. It's far too slow to be useful.Most of that time was spent in the
scan-vulnerabilities.shscript.Expected Behavior
git commitneeds to be quick: if I'm not editing my commit message within a few seconds, I've probably forgotten the details of what I've just done. It's an enforced context switch. That prompts me to do commits less often, which means they're individually bigger. That creates knock-on problems.If we want to run
scan-vulnerabilities.shon the development machine, I suspect the right place to do it is on pre-push, rather than pre-commit.Steps To Reproduce
make config(doing whatever you need to get that working)time .git/hooks/pre-commitOutput
No response
Code of Conduct
Sensitive Information Declaration
The text was updated successfully, but these errors were encountered: