precommit
Installation
Entrypoint
Types
Precommit
- run()

precommit

No long description provided.

Installation

dagger install github.com/context-and-oss/cicd/src/composites/precommit@v5.1.5

Entrypoint

Return Type

Precommit

Example

dagger -m github.com/context-and-oss/cicd/src/composites/precommit@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \

func (m *MyModule) Example() *dagger.Precommit  {
	return dag.
			Precommit()
}

@function
def example() -> dagger.Precommit:
	return (
		dag.precommit()
	)

@func()
example(): Precommit {
	return dag
		.precommit()
}

Types

Precommit 🔗

Precommit wraps the stage-2 source gate with evidence aggregation and notification for the pre-commit pipeline.

run() 🔗

Run executes all stage-2 checks via a single dag.Stage2().Run call: quality (lint + test), security source scan, risk validation, and — behind the opt-in –require-intent — the change-intent gate. Evidence is aggregated and a Teams notification is posted if a webhook is provided. Returns the audit directory containing combined-evidence.json, findings.sarif, sbom.cdx.json.

Return Type

Directory !

Arguments

Name	Type	Default Value	Description
src	Directory !	-	Source directory to check.
commitSha	String !	-	Git commit SHA for evidence provenance.
branch	String !	-	Git branch name.
repoUrl	String !	-	Repository URL.
failOn	String !	"HIGH"	Minimum severity that fails the pipeline: CRITICAL\|HIGH\|MEDIUM\|LOW\|NONE
include	[String ! ]	-	Languages to include: go, node, python, dotnet (repeatable, optional).
sastRulesets	String !	"p/security-audit"	Semgrep rulesets for SAST (e.g. “p/security-audit,p/owasp-top-ten”). “auto” is rejected by the security module — see security/CLAUDE.md.
teamsWebhook	Secret	-	Teams incoming webhook URL for notifications.
runUrl	String	-	CI pipeline run URL shown in the Teams notification.
npmFeedUrl	String	-	Internal npm registry URL.
npmFeedRouting	String	-	How the npm feed is applied: “registry” (default) makes it the registry for every package; “npmrc” binds only its token and leaves routing to the project’s .npmrc, for a feed with no upstream to the public registry.
npmToken	Secret	-	Auth token for internal npm registry.
nugetFeedUrl	String	-	Internal NuGet feed URL.
nugetToken	Secret	-	Auth token for internal NuGet feed.
diff	File	-	Output of `git diff origin/main...HEAD`. Scopes the intent gate (coupling checks) and the risk infra scan to the files this change touches.
infraScope	String	"changed"	Which infrastructure files the risk scan evaluates: “changed” (only the ones in –diff) or “tree” (every one in the checkout). The default is right for a pull request gate and is why this is exposed rather than pinned: the scan should judge the change under review, and debt in a file the author did not touch is the previous run’s problem. A team whose infrastructure is rarely edited can ask for “tree” here and have every parseable file judged on every pull request. The commit pipeline does not offer the choice — it pins “tree”, because a push that has already merged has no author left to ask.
intentGlobs	[String ! ]	-	Glob patterns for intent artifacts. Uses built-in defaults when omitted.
minCoverage	Float	"0"	Minimum coverage percentage gate (0 disables). See quality.Check.
coverageMinLines	Integer	"0"	Skip coverage gate for a language when coverable lines are below this threshold.
testCmd	String	-	Consumer-owned test command for witnessed BYO test execution (quality.Test). When set, quality.Check runs lint-only and quality.Test runs the command; both evidence files feed the audit. When empty, existing behavior is unchanged.
testLegs	String	-	Witnessed test legs as a JSON array — one object per leg with the keys label, language (go\|node\|python\|dotnet), cmd, and optionally coveragePath and toolchainImage. The polyglot form of testCmd: one command, container and coverage report per language instead of one for the whole repository. Mutually exclusive with testCmd. See quality.Test.
coveragePath	String	-	Path of the coverage report the test command writes — absolute, or relative to the source root. Applies to testCmd only; a leg names its own. See quality.Test.
baseline	File	-	Baseline coverage document for the ratchet: a prior combined-evidence.json / evidence envelope, or a bare {“coverageByLanguage”: {…}} map (sniffed).
tolerance	Float !	1	Allowed per-language coverage drop (percentage points) before the ratchet trips.
coverageGate	String !	"gate"	Ratchet mode: “gate” fails the envelope on a tripped ratchet, “warn” only warns.
licenseGate	String !	"warn"	License policy mode: “gate” fails the envelope on a license outside the allowlist, “warn” reports without enforcing.
licenseAllow	[String ! ]	-	Licence categories and individual licences the policy permits. Empty uses cicd’s default policy (permissive, notice, unencumbered). Naming a category replaces the defaults; naming a licence keeps them and allows that declaration as well. “unknown” is not an allowable category — allow the declarations you have read, by their exact text: globally when it is an SPDX expression (BlueOak-1.0.0), or scoped to one package when it is not (example-sdk=SEE LICENSE IN LICENSE).
vulnAccept	String	-	Vulnerability findings to accept, each as “=” — e.g. “CVE-2026-81871=the exporter only reaches the Dagger engine’s own telemetry endpoint on the runner”. The row leaves the severity counts, findings[] and the gate, and is disclosed in warnings[] with the reason given; it stays in the CycloneDX report. A reason is mandatory, patterns are refused, and an acceptance that matches nothing warns, so a stale one is visible rather than a standing permission. ONE PER LINE: the separator is a newline and never a comma, because a reason is prose that contains commas. See src/security/vulnallow.go.
licenseExclude	[String ! ]	-	Glob patterns whose license declarations are reported but not judged against the policy, e.g. “docs/**”. It narrows scope, never findings.
licenseFull	Boolean !	true	Read licenses from source headers and LICENSE files as well as from package metadata.
toolchainImage	String	-	Toolchain container image override for the BYO test command (ADR-004). Applies to testCmd only; a leg names its own.
dependabotActionsPin	Boolean	-	Asserts diff is a pull_request whose actor is exactly dependabot[bot], enabling intent’s approved GitHub Actions pin-bump path in place of a human intent artifact. The caller must verify the actor itself; intent independently re-validates every diff hunk and never trusts this alone. Never set for commit/push execution (dependabot origin cannot be inferred after merge).
requireIntent	Boolean	-	Requires this change to carry a change-intent artifact (capsule, spec, *.intent.md, …) and fails the gate at –fail-on when it does not. Opt-in, and only offered here: pre-commit is where an author can still answer the question, since the artifact is part of the change under review. Left off, the audit records that intent was not checked rather than staying silent.
nodeProjectLimit	Integer !	4	Maximum independent Node projects; never truncates.
parallelism	Integer !	1	Maximum independent source check groups, and declared test legs, in flight, 1–4.
prepared	Container	-	Prepared state supplied by a caller-owned Dagger pipeline.
preparedLanguage	String	-	No description provided
preparedTestLabel	String	-	No description provided
preparedImage	String	-	No description provided

Example

dagger -m github.com/context-and-oss/cicd/src/composites/precommit@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \
 run --src DIR_PATH --commit-sha string --branch string --repo-url string --fail-on string --sast-rulesets string --coverage-gate string --license-gate string --license-full boolean --node-project-limit integer --parallelism integer

func (m *MyModule) Example(src *dagger.Directory, commitSha string, branch string, repoUrl string, failOn string, sastRulesets string, tolerance , coverageGate string, licenseGate string, licenseFull bool, nodeProjectLimit int, parallelism int) *dagger.Directory  {
	return dag.
			Precommit().
			Run(src, commitSha, branch, repoUrl, failOn, sastRulesets, tolerance, coverageGate, licenseGate, licenseFull, nodeProjectLimit, parallelism)
}

@function
def example(src: dagger.Directory, commitsha: str, branch: str, repourl: str, failon: str, sastrulesets: str, tolerance: , coveragegate: str, licensegate: str, licensefull: bool, nodeprojectlimit: int, parallelism: int) -> dagger.Directory:
	return (
		dag.precommit()
		.run(src, commitsha, branch, repourl, failon, sastrulesets, tolerance, coveragegate, licensegate, licensefull, nodeprojectlimit, parallelism)
	)

@func()
example(src: Directory, commitSha: string, branch: string, repoUrl: string, failOn: string, sastRulesets: string, tolerance: , coverageGate: string, licenseGate: string, licenseFull: boolean, nodeProjectLimit: number, parallelism: number): Directory {
	return dag
		.precommit()
		.run(src, commitSha, branch, repoUrl, failOn, sastRulesets, tolerance, coverageGate, licenseGate, licenseFull, nodeProjectLimit, parallelism)
}