Use case

Catch issues before they're pushed

Run the gate locally as a pre-push hook; results before the pushInstall GateTest as a git pre-push hook so secrets, syntax errors, and obvious vulnerabilities are surfaced on your machine, at the moment you push — the last point where a leaked credential can still be pulled before anyone else clones it.

The problem

Some problems are far cheaper to catch before the push than after. A secret that lands in shared git history is compromised permanently, even if you delete it in the next commit — the value still sits in history, on every clone and fork.

A local pre-push hook moves that catch left to the last safe moment: your machine, before anything leaves it.

How GateTest does it

GateTest ships a pre-push hook that runs a fast suite as `git push` runs and prints every finding inline — a leaked secret or a syntax error is on your screen seconds after you typed the command, with the file and line.

The shipped hook is deliberately advisory: it surfaces findings without blocking developer flow (set GATETEST_SKIP=1 to skip it entirely), while the CI gate stays authoritative — the hook is for speed, CI is for enforcement.

install the pre-push hook

#!/bin/sh
# .git/hooks/pre-push (make it executable): a fast advisory scan before
# every push. A leaked secret or syntax error is shown inline, with file
# and line; '|| true' keeps the hook advisory, CI stays the gate.
npx -p @gatetest/cli gatetest --suite quick || true

Steps

1Install the GateTest pre-push hook in your repo.
2Push as normal — the hook runs a fast suite first.
3Findings appear inline; fix and re-push.
4Keep the CI gate as the authoritative enforcement layer.

Frequently asked questions

Should the pre-push hook block the push?

The hook GateTest ships does not block — it surfaces findings without interrupting developer flow, and relies on the CI gate as the hard enforcement layer. The hook is about fast local feedback; CI is the gate of record. If you want a blocking local gate, run the CLI in your own hook with its exit code honoured.

Why catch secrets before the push specifically?

Because once a secret is in shared git history it's compromised even if you delete it later — it persists in earlier commits and every clone. Seeing it at push time, before a teammate has pulled, is the difference between a quick force-push and rotating a live credential.