Git Hooks

Picket can block commits and pushes when a Git hook scan reports findings.

picket hooks install pre-commit --repo .
picket hooks install all --repo . --config .gitleaks.toml

When no hook name is provided, picket hooks install installs pre-commit.

Hooks

Hook	Scanner command
pre-commit	picket git "$repo_root" --pre-commit --staged
pre-push	picket git "$repo_root" --log-opts "$range" for each pushed ref
pre-receive	picket git "$repo_root" --log-opts "$range" for each received ref
all	Installs pre-commit, pre-push, and pre-receive.

pre-receive works in normal and bare repositories. Deleted refs are ignored. New refs scan the new SHA; updated refs scan old..new.

What Users See

• pre-commit scans staged additions before Git creates the commit. A finding aborts the commit.
• pre-push scans commits that would update each remote ref. A finding aborts the push before the remote ref changes.
• pre-receive runs in the receiving repository after Git receives objects in quarantine and before it updates refs. A finding rejects the push.

A blocked operation prints the finding count followed by at most 20 rule, path, line, and abbreviated commit entries. Secret values and source-line evidence are not printed. Terminal control and direction-changing characters in displayed fields are replaced before output.

For example, a staged finding starts with Picket blocked the commit: 1 finding in staged changes.

Scanner and configuration failures also block the operation. Their message says that Picket could not complete the scan, rather than reporting a secret finding. Resolve the scanner failure before retrying so a failed scan cannot be mistaken for a clean result.

Options

Option	Description
--repo <path>	Repository, nested worktree path, or bare repository where hooks should be installed. Defaults to ..
--force	Overwrite an existing unmanaged hook. Managed Picket hooks can be updated without --force.
--command <path>	Command written into the hook script. Defaults to picket.
-c, --config <path>	Gitleaks-compatible config path to pass to hook scans.
-b, --baseline-path <path>	Gitleaks-compatible baseline path to pass to hook scans.
--max-target-megabytes <n>	Maximum file size in decimal megabytes for content rules.
--redact[=n]	Redaction percentage used when matching a redacted baseline. Hook summaries always omit secret values. Defaults to 100.

Generated hooks are POSIX shell scripts in the effective hook directory reported by Git. This is normally .git/hooks for a worktree and hooks for a bare repository. Picket honors core.hooksPath, including repository-relative and absolute paths. The scripts include a managed marker so Picket can update its own hooks safely.

Use an absolute --command path when Git runs from a desktop client, IDE, service account, or server environment that may not have picket on PATH. A missing scanner command is an operational failure and blocks the operation.

Security Defaults

Installed hooks use --redact=100 by default. The concise rejection summary omits secret values at every redaction setting.

Picket refuses to overwrite an existing unmanaged hook unless --force is supplied. If a repository already has custom hook logic, merge the generated Picket command into that hook manually or reinstall with --force after preserving the previous behavior.

Use CI or pre-receive when scanning must be enforced centrally. Git’s --no-verify option skips local pre-commit and pre-push hooks; it does not skip a server-side pre-receive hook.