> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/get-started/add-pre-receive-hooks.md).

# Add Prisma Cloud Code Security Scanner as a Pre-Receive Hook

Install Prisma Cloud Application Security scanner (Prisma Cloud scanner) as a pre-receive hook into your workflows using Checkov CLI to automate the scanning of your code for Infrastructure-as-Code (IaC) misconfigurations, Software Composition Analysis (SCA) issues and Secrets vulnerabilities. Pre-receive hooks are server-side hooks in version control systems (VCS) that are triggered on the server when receiving a push or a specific action is performed, and these hooks enable you to enforce checks or actions before accepting any changes into the VCS.

Installing the Prisma Cloud code scanner allows you to identify issues and take remediation steps before accepting the code into your repositories. This mitigates the risk of introducing potential issues downstream.

The terminology and implementation of pre-receive hooks may vary across different version control systems such as GitHub and GitLab.

The Prisma Cloud Application Security pre-receive hook is supported on the following systems:

* [Local Host](#local-host)
* [GitHub Enterprise Server](#github-enterprise-server)
* [GitLab Self-Managed](#github-self-managed)

## Install Prisma Cloud Scanner as a Pre-Receive Hook on a Local Host

Installing Prisma Cloud scanner as a pre-receive hook on your local host enables early detection of security vulnerabilities before the code is committed to your version control system, reducing downstream impact and enhancing security.

1. Before you begin:
   * Install [Python](https://www.python.org/downloads/) v3.9 - v3.13
   * Install [Docker](https://docs.docker.com/get-docker/)
   * Install [Checkov](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/connect-code-and-build-providers/ci-cd-runs/add-checkov.md)
   * Verify *Administrator* access to the VCS server and console
2. Clone the following repository: <https://github.com/bridgecrewio/checkov-pre-receive-hooks>.
3. Navigate to the local folder housing the cloned repository and run the following command to build the image from the `Dockerfile.dev` file:

   ```shell
   docker build -f Dockerfile.dev -t pre-receive.dev
   ```
4. Add executable permissions to the `checkov-pre-receive.sh` file:

   ```shell
   chmod +x prisma-pre-receive.sh
   ```
5. Run a data container with a generated SSH key:

   ```shell
   docker run --name data pre-receive.dev /bin/true
   ```
6. Copy the script to the data container:

   ```shell
   docker cp prisma-pre-receive.sh data:/home/git/test.git/hooks/pre-receive
   ```

   See [Pre-receive Hook Script](#pre-receive-hook-script) for more information.
7. Run an application container to execute the hook:

   ```shell
   docker run -d -p 52311:22 --volumes-from data pre-receive.dev
   ```
8. Copy the generated SSH key to your local machine:

   ```shell
   docker cp data:/home/git/.ssh/id_ed25519
   ```
9. Test the hook: Make a commit in a local repository and run the following command:

   ```shell
   git remote add test git@127.0.0.1:test.git
   $ GIT_SSH_COMMAND="ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -p 52311 -i ../id_ed25519" git push -u test main
   ```

## Install Prisma Cloud Scanner as a Pre-Receive Hook on GitHub Enterprise Server

To install the Prisma Cloud Scanner as a pre-receive hook on GitHub Enterprise Server, refer to [GitHub Docs](https://docs.github.com/en/enterprise-server@3.8/admin/policies/enforcing-policy-with-pre-receive-hooks/managing-pre-receive-hooks-on-the-github-enterprise-server-appliance). You will need the [Pre-receive Hook Script](#pre-receive-hook-script) for the installation.

## Install Prisma Cloud Scanner as a Pre-Receive Hook on GitLab Self-Managed

To install the Prisma Cloud Scanner as a pre-receive hook on GitLab Self-Managed refer to [GitLab Self-Managed Docs](https://docs.gitlab.com/ee/administration/server_hooks.html). You will need the [Pre-receive Hook Script](#pre-receive-hook-script) for the installation.

**Customize Flags**: Customize “CHECKOV\_OPTIONAL\_FLAGS” by adding flags to suit your specific requirements. See [here](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html) for a comprehensive list of flags.

## Pre-Receive Hook Script

Use this script to run the Prisma Cloud Scanner as a pre-receive hook.

```bash
#!/usr/bin/env bash

# This script is used to run Prisma Cloud Application Security using Checkov CLI in a pre-receive hook.

# Use the prisma api url and key pair for your tenant
PRISMA_API_URL='https://api.prismacloud.io'
BC_API_KEY='<access_key_id>::<secret_access_key>'

# Current repository name may be available as an environment variable depending on the SCM.
# Check documentation for your specific provider.
REPO_ID='org/repo'


CHECKOV_COMMAND='checkov -d'

# required flags
CHECKOV_FLAGS="--skip-results-upload --repo-id ${REPO_ID} --prisma-api-url ${PRISMA_API_URL} --bc-api-key ${BC_API_KEY}"

# add other, optional flags https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html
CHECKOV_OPTIONAL_FLAGS='--framework secrets --enable-secret-scan-all-files --compact'

TEMPDIR=`mktemp -d`

oldrev=$1
newrev=$2
refname=$3

while read oldrev newrev refname; do

    # get list of changed files
    files=`git diff --name-only ${oldrev} ${newrev}`

    # get list of objects to check
    objects=`git ls-tree --full-name -r ${newrev}`

    for file in ${files}; do
        object=`echo -e "${objects}" | egrep "(\s)${file}\$" | awk '{ print $3 }'`

        if [ -z ${object} ];
        then
            continue;
        fi

        mkdir -p "${TEMPDIR}/`dirname ${file}`" &>/dev/null
        git cat-file blob ${object} > ${TEMPDIR}/${file}

    done;
done

# run checkov
${CHECKOV_COMMAND} ${TEMPDIR} ${CHECKOV_FLAGS} ${CHECKOV_OPTIONAL_FLAGS}
exit_code=$?

# cleanup
rm -rf ${TEMPDIR} &> /dev/null

exit $exit_code
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/application-security/get-started/add-pre-receive-hooks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.