Integrate OX CLI with Git Hooks

You can integrate the OX CLI with Git hooks to automatically scan your code before committing or pushing changes. Unlike manual scans, Git hooks run automatically as part of your Git workflow, helping identify security issues without requiring developers to remember to run scans.

OX CLI supports two types of Git hook installations:

Installation type	Use when	Description
Repository Git hooks	You want to enable automatic scanning for a specific repository.	Installs Git hooks only in the selected repository. This option is useful when different repositories require different Git hook configurations.
Global Git hooks	You want to enable automatic scanning in all repositories on your machine.	Installs Git hooks once by using Git's global core.hooksPath configuration. This option is useful when you want the same scanning behavior across all repositories.

Before you begin

Make sure that:

• The OX CLI is installed.

• The CLI is authenticated using one of the supported authentication methods.

Manage repository Git hooks

Repository Git hooks apply only to the current repository.

Task	Command	Description
Install a pre-push hook	ox-cli install-git-hook --type pre-push	Installs the default Git hook that scans before pushing changes.
Install a pre-commit hook	ox-cli install-git-hook --type pre-commit	Installs a Git hook that scans before each commit.
Uninstall a pre-push hook	ox-cli uninstall-git-hook --type pre-push	Removes the installed pre-push hook.
Replace an existing hook	ox-cli install-git-hook --type pre-push --force	Replaces an existing non-OX Git hook.

Global Git hooks

Global Git hooks apply to all repositories on your machine.

Global Git hook behavior

Global Git hooks differ from repository Git hooks in the following ways:

Behavior	Description
Target directory	The CLI ignores any target directory that you specify.
--force	Not supported for global Git hooks.
Existing hooks	Existing global hooks are preserved. OX installs its hook alongside existing hooks and chains their execution.

Manage global Git hooks

Task	Command	Description
Install a global pre-push hook	ox-cli install-git-hook --global --type pre-push	Installs the default global Git hook.
Install a global pre-commit hook	ox-cli install-git-hook --global --type pre-commit	Installs a global Git hook that scans before each commit.
Uninstall a global pre-push hook	ox-cli uninstall-git-hook --global --type pre-push	Removes the installed global pre-push hook.

Limitations

Global Git hooks have the following limitations:

• Repositories that define their own core.hooksPath aren't covered because Git gives precedence to the repository-specific configuration. This is common with Husky, lefthook, and pre-commit. Install a repository Git hook for these repositories instead.

• A POSIX shell is required. On Windows, Git must be installed with Git Bash or another compatible shell.

• If the global hooks directory already contains an OX backup from a previous installation, uninstall the existing global Git hook before installing a new one.