automotive-hooks

Use the misra-check.sh pre-commit hook, which runs cppcheck with the MISRA addon when available, or falls back to grep-based checks for goto statements, dynamic memory allocation, pointer indirection depth, and prohibited standard library functions in staged C/C++ files.

The coverage-gate.sh pre-push hook parses Cobertura XML, JaCoCo XML, or LCOV reports and blocks the push when line coverage falls below 80%, branch below 70%, or function coverage below 90%. It searches common report locations automatically.

The dependency-audit.sh hook supports npm audit, pip-audit or safety for Python, OWASP Dependency-Check reports for Maven, and cargo-audit for Rust. It blocks pushes on critical and high severity vulnerabilities by default.

Yes, the pre-merge breaking-change-check.sh inspects public C/C++ headers, protobuf files, OpenAPI specs, and DBC/ARXML CAN definitions. Removed functions, fields, RPC methods, or API paths block the merge unless acknowledged in commit messages.

The autosar-naming.sh hook only checks files whose paths contain autosar, mcal, or rte identifiers. Files outside AUTOSAR-style directories are intentionally skipped to avoid false positives on non-AUTOSAR code.

Most hooks document git commit --no-verify as a bypass, though it is marked not recommended, especially for safety-critical MISRA checks. Some checks like ASPICE traceability and markdown lint only warn without blocking.