Skip to main content

vulkro init and vulkro install-hook

Two ways to wire Vulkro into your local git workflow so a scan runs before code leaves the machine.

vulkro init​

Scaffold a pre-commit hook that runs vulkro gate --base HEAD on staged files. The gate fails a commit ONLY on findings new vs HEAD, so pre-existing technical debt never blocks a commit.

vulkro init --pre-commit
FlagDescription
--pre-commitInstall a pre-commit hook that runs vulkro gate --base HEAD on staged files.
--forceOverwrite the target hook file if it already exists.

Exit codes: 0 installed, 2 error (not a git repo, hook already exists without --force, or a filesystem write failure).

vulkro install-hook​

Install or update git hooks that run Vulkro before a commit or push. It manages a marked block inside the hook file, so re-running is idempotent and it composes with an existing Husky or hand-written hook instead of refusing. With no selector, it installs both hooks.

vulkro install-hook              # install both pre-commit and pre-push
vulkro install-hook --pre-commit # just the pre-commit hook
vulkro install-hook --uninstall  # remove the vulkro-managed block
FlagDescription
--pre-commitManage the pre-commit hook (runs the new-findings gate against HEAD).
--pre-pushManage the pre-push hook (a fast high-confidence quick scan of src, the last gate before code leaves the machine).
--uninstallRemove the vulkro-managed block instead of installing it.
--forceReplace the whole hook file with just the vulkro block (the default composes with any existing content).

The generated hook keeps your code on the machine: your source, file paths, and findings are never sent anywhere. The pre-commit hook runs vulkro gate, which makes no outbound request at all; the pre-push hook runs a scan, whose path can send the usage heartbeat (at most once every 24 hours, on a background thread). Set VULKRO_OFFLINE=1 if the hook must be network-silent. Bypass it once with VULKRO_SKIP_HOOKS=1.

Exit codes: 0 hooks installed / updated / removed; 2 not in a git repo or a write failure. (The generated hook itself returns 1 on findings at commit or push time.)

Which one?​

  • init --pre-commit is a quick scaffold of a single pre-commit gate.
  • install-hook manages both pre-commit and pre-push, composes with existing hooks, and is idempotent to re-run.

Command reference​

Generated from vulkro help init on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

Set up a git pre-commit hook that blocks commits which introduce new findings.

Scaffold a pre-commit hook. `--pre-commit` writes a whole hook file (`.husky/pre-commit` when the project uses Husky, else `.git/hooks/pre-commit`) that runs `vulkro gate --base HEAD` on the staged tree, failing a commit ONLY on findings new versus HEAD so pre-existing debt never blocks a commit. Bypass one commit with `VULKRO_SKIP_PRECOMMIT=1`.

This is the simple whole-file scaffolder. For an idempotent, marked-block installer that composes with an existing hook and also manages the pre-push gate, use `vulkro install-hook` instead.

Exit codes: `0` hook installed (init is a scaffolder, not a scan, so it never reports findings); `2` not a git repo, hook already exists without `--force`, or a filesystem write failure.

Usage: vulkro init [OPTIONS]

Options:
      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

      --pre-commit
          Install a pre-commit hook that runs `vulkro gate --base HEAD` on staged files

      --force
          Force overwrite if the target hook file already exists

  -h, --help
          Print help (see a summary with '-h')
Last updated on