# Set up your repository

Answer three questions and get one block of commands that installs the policies into your own git repository.

The repository builder needs JavaScript. You can still read every policy and its tier on the Git repositories page, and write the commands by hand from the command template below.

## Start screen

1. Where does your code live? Only GitHub gets the CI workflow. The git hooks work on any host.
   - GitHub: Adds the GitHub Actions gate
   - GitLab: Git hooks only
   - Other git host: Git hooks only
2. What worries you most? Pick as many as you like. Each answer adds one or two presets.
   - Leaked secrets: Keys and tokens in files (presets: secrets)
   - Skipped checks: Hooks and tests bypassed (presets: git-hygiene, test-integrity)
   - Destructive or risky shell: rm -rf, curl | sh, data leaving (presets: shell-containment)
   - The agent changing its rules: Its own config and permissions (presets: agent-config)
   - Packages and CI: Supply chain and workflows (presets: supply-chain, ci-pipeline)
   - Injected instructions: Hidden text and poisoned memory (presets: prompt-injection)
   - Insecure code and cloud: Hardening, IAM, containers (presets: code-hardening, cloud-iac)
   - Compliance: OWASP agentic top 10, EU AI Act (presets: owasp-agentic-top10, eu-ai-act)
3. How strict should it be? You can remove single policies on the next screen.
   - Only hard stops: Policies that refuse the commit (labels: commit)
   - Stops and warnings: Plus checks run by the agent's hooks (labels: commit, agent)
   - Everything: Including advice the agent reads (labels: commit, agent, advise)

## Share link

`#p=<comma-separated policy ids>&host=<github|gitlab|other>&ci=<0|1>` opens the result for those policies, with that host and the CI choice; `host` and `ci` are optional. Only ids from the catalog are read. The catalog commit and every sha256 in the commands come from this site's build, never from the link.

## Before you run it

You need chock on your machine. Read the commands first: they change files in your repository.

```bash
pipx install chock
```

## The command template

One line per policy, sorted by id. The builder fills in the catalog commit and each policy's sha256. They come from this site's build and never from a link.

Ask the user before running anything. The commands change files in a repository.

```bash
chock init .
chock add <id> --ref 1e60d211c1bb767152c6ab0167932da06ab3a10f --verify-sha <sha256> --skip-compile
chock sync --repo .   # or: chock sync --repo . --ci
# Next: review `git status`, then commit the files chock wrote.
```