lefthook.yml

# Canonical lefthook config for GrayCodeAI Go repos.
# Source of truth: .shared-templates/lefthook.yml.tmpl
#
# Install lefthook:
#   brew install lefthook        (macOS)
#   go install github.com/evilmartians/lefthook@latest
#   npm install -g lefthook      (cross-platform)
#
# Activate hooks in this repo (one time, done automatically by `make setup`):
#   lefthook install
#
# Skip hooks for a single commit (use sparingly):
#   LEFTHOOK=0 git commit -m "..."

# ---------------------------------------------------------------------------
# pre-commit — runs before commit creation, on staged files only.
# ---------------------------------------------------------------------------
pre-commit:
  parallel: true
  commands:

    fmt:
      glob: "*.go"
      run: |
        if ! command -v gofumpt >/dev/null 2>&1; then
          echo "lefthook: gofumpt not installed (go install mvdan.cc/gofumpt@latest) — skipping"
          exit 0
        fi
        gofumpt -w {staged_files}
      stage_fixed: true

    imports:
      glob: "*.go"
      run: |
        if ! command -v goimports >/dev/null 2>&1; then
          echo "lefthook: goimports not installed (go install golang.org/x/tools/cmd/goimports@latest) — skipping"
          exit 0
        fi
        goimports -w {staged_files}
      stage_fixed: true

    lint:
      glob: "*.go"
      run: |
        if ! command -v golangci-lint >/dev/null 2>&1; then
          echo "lefthook: golangci-lint not installed — skipping (install: https://golangci-lint.run/usage/install/)"
          exit 0
        fi
        # Lint the directories holding staged files. Running golangci-lint on
        # named files fails with "named files must all be in one directory"
        # when staged .go files span multiple packages. The dirs are fed via
        # xargs so they arrive as separate arguments regardless of shell.
        STAGED=$(git diff --cached --name-only --diff-filter=ACMR | grep '\.go$' || true)
        if [ -n "$STAGED" ]; then
          echo "$STAGED" | xargs -n1 dirname | sort -u | xargs golangci-lint run --fix
        fi
      stage_fixed: true

    yaml-lint:
      glob: "*.{yml,yaml}"
      run: |
        # Quick syntax check via Python's yaml module (already on most systems).
        for f in {staged_files}; do
          python3 -c "import sys, yaml; yaml.safe_load(open(sys.argv[1]))" "$f" || exit 1
        done

    forbidden-strings:
      run: |
        # Catch obvious credential-shaped literals in staged additions.
        # Only does so for quoted value literals — not bare `==` comparison
        # guards like `if apiKey == ""`.
        bad=$(git diff --cached --diff-filter=AM -U0 -- {staged_files} \
          | grep -E '^\+' \
          | grep -Ei "(aws_secret|password|api[_-]?key)\s*:?=\s*[\"']|BEGIN [A-Z]+ PRIVATE KEY" \
          | grep -v 'example\|placeholder\|TODO\|x-release-please' || true)
        if [ -n "$bad" ]; then
          echo "lefthook: possible secret in staged changes:"
          echo "$bad"
          echo "If this is a false positive, bypass with: LEFTHOOK=0 git commit"
          exit 1
        fi

# ---------------------------------------------------------------------------
# pre-push — heavier checks, runs only on push (not every commit).
# ---------------------------------------------------------------------------
pre-push:
  commands:

    test:
      run: go test ./... -count=1 -timeout=120s

    vet:
      run: go vet ./...

    govulncheck:
      run: |
        if ! command -v govulncheck >/dev/null 2>&1; then
          echo "lefthook: govulncheck not installed — skipping"
          exit 0
        fi
        govulncheck ./...

    boundary-flux-client:
      run: bash scripts/check-flux-client-imports.sh

    boundary-flux-engine:
      run: bash scripts/check-flux-engine-boundary.sh

    boundary-support-repo:
      run: bash scripts/check-support-repo-coupling.sh

    boundary-ecosystem:
      run: bash scripts/check-ecosystem-boundaries.sh

    release-parity:
      run: |
        # Informational only — warns if go.mod versions have fallen behind the
        # sibling dev clones, but never blocks a push.
        bash scripts/check-module-release-parity.sh || true

# ---------------------------------------------------------------------------
# commit-msg — validate Conventional Commits and strip AI co-author trailers.
# ---------------------------------------------------------------------------
commit-msg:
  commands:

    conventional-commit:
      run: |
        msg=$(head -n1 "{1}")
        # Allow merge commits, revert commits, and release-please bot commits to bypass.
        case "$msg" in
          "Merge "*|"Revert "*|"chore(main): release"*) exit 0 ;;
        esac
        # Conventional commits regex.
        if ! echo "$msg" | grep -qE '^(feat|fix|perf|refactor|test|docs|build|ci|chore|revert|style)(\([a-z0-9 _-]+\))?!?: .{1,72}$'; then
          echo "lefthook: commit message does not follow Conventional Commits."
          echo "  format: <type>(<scope>): <summary>"
          echo "  example: feat(client): add streaming retry"
          echo "  full guide: https://www.conventionalcommits.org/"
          exit 1
        fi

    strip-co-authored-by:
      run: |
        # Strip Co-authored-by: trailers that AI tools (Claude, Cursor, etc.) add.
        # This enforces the rule that commits list only the human author.
        sed '/^[Cc]o-[Aa]uthored-[Bb]y:/d' "{1}" > "{1}.tmp" && mv "{1}.tmp" "{1}"

# ---------------------------------------------------------------------------
# prepare-commit-msg — strip AI co-author trailers after tools inject them.
# ---------------------------------------------------------------------------
prepare-commit-msg:
  commands:
    strip-co-authored-by:
      run: |
        sed '/^[Cc]o-[Aa]uthored-[Bb]y:/d' "{1}" > "{1}.tmp" && mv "{1}.tmp" "{1}"