[ptr727]

Summary

Fixes the finding the third Copilot round on the develop -> main promotion #3417 raised against catalog/snippets/hub_fetch_run.py, under the maintainer's ruling on it.

Where the API lookup of main's commit failed, the snippet fetched prose-gate.json and prose_lint.py from the moving main ref in separate requests. The two could then come from different commits, pairing a new vocabulary with an old parser. That happens when a commit lands between the requests or when the raw CDN serves one file from cache.

• A second lookup. lookup_via_git() runs git ls-remote https://github.com/ptr727/ProjectTemplate refs/heads/main under LOOKUP_TIMEOUT, with GIT_TERMINAL_PROMPT=0. resolve_main_commit() calls it only after the API lookup fails. It accepts exactly one <sha>\trefs/heads/main line, and every other shape returns a named cause.
• One commit for every file. Either resolved commit names the ref both files are fetched at, so the script and its data always pair. The provenance label names that commit.
• The documented fail-open stays. Where neither lookup resolves, one stderr line names both causes and the gate runs against main. The docstring says why: a hook with no network cannot fetch the gate at all, and the CI gate is the enforcement.
• Prose. GOVERNANCE.md "Running the Linters Locally (Known-Working Invocations)" and the husky and pre-commit snippet READMEs name the git ls-remote call beside the API lookup.

Tests

Constructed in tests/test_hub_fetch_run.py, with the network and git stubbed:

• test_git_fallback_pins_the_script_and_its_data_to_one_commit: a rate-limited API lookup with a resolving git ls-remote fetches both files at the git commit, in order, and prints nothing.
• test_git_fallback_is_not_run_when_the_api_resolves, and test_lookup_only_for_the_prose_gate asserting no git call for another script.
• test_fallback_causes_print_a_line_and_the_gate_still_runs asserts the git cause in the one line, and both files fetched at main.
• GitLookupTests covers the accepted line, the command, timeout, and prompt setting, and each failure shape. Those are a non-zero exit, a missing git, a timeout, and unexpected output (empty, a short hash, two lines, upper case).

Local review

Three recorded passes at the frontier tier, the edit budget spent on the second round.

• The first pass found four, and 03665d5 fixes three. Those are a mypy redefinition of sha, and a Windows wait on a remote helper's stderr pipe after a timeout. The third is a GOVERNANCE.md sentence whose "those" bound only to uv. The fourth is declined below.
• The second pass found two, both fixed in 9b49229: the network-calls sentence left out the script fetches, and one docstring line ran past 100 columns.
• The third pass covers the head and found two introduced findings, open under the spent budget:
  • tests/test_hub_fetch_run.py:196, introduced: DATA_PATH repeats a path the test at line 370 spells locally and hub.COMPANIONS holds. Declined. A test pins the literal path rather than reading the module's own constant. A rename in the snippet then fails the test instead of passing with it.
  • tests/test_hub_fetch_run.py:2, introduced: the module docstring's subject list does not name the git ls-remote fallback. Declined as style. The list stays true, since the fallback feeds the provenance path it names.

Declined from the first pass: a host's global url.insteadOf can rewrite https://github.com/ to SSH. There ls-remote can prompt for a key or a host key on the terminal. That host configuration is the maintainer's own, the prompt is visible rather than silent, and it is reached only after the API lookup fails. GOVERNANCE.md "Trust Boundaries and Hardening Effort" rules out hardening for it.

Verification

• uv run --no-project --with-requirements tests/requirements.txt python -m unittest discover -s tests -> Ran 2860 tests, OK (skipped=7).
• uvx ruff@latest format --check ., uvx ruff@latest check, and uvx mypy@latest -> clean.
• python3 scripts/build_dist.py --check -> Generated skill distributions are current.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: ptr727/ProjectTemplate
• Branch: fix/hub-fetch-run-pin-companion-sha
• File: .coderabbit.yaml
• Commit: 9b49229
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 729cfacd-3098-4115-9331-8af2fc877467

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ptr727]

A recorded local strict-review pass covers head 9b4922901f2887e29cff3b9fcff368a9ef37d009, the content this pull request carries at that commit against develop, and it recorded 2 findings.

[Copilot]

🟢 Approval recommended

The reviewed changes have no approval-blocking issues; one minor documentation nit remains.

No open issues 🎉

What changed in this PR

This pull request ensures the prose gate script and companion data are fetched from the same resolved commit, using a validated git ls-remote fallback when the GitHub API lookup fails.

Changes:

• Adds bounded, non-interactive Git commit resolution with strict output validation.
• Pins both prose-gate files and their provenance to one commit.
• Preserves fail-open behavior when neither lookup resolves.
• Expands fallback, failure, timeout, and environment tests.
• Updates governance and hook documentation.

File	Summary
tests/​test_hub_fetch_run.py	Adds coverage for fallback resolution, commit pinning, validation, failures, timeouts, and subprocess configuration.
GOVERNANCE.md	Documents API and Git lookup behavior for downstream hooks.
catalog/​snippets/​pre-commit/​README.md	Documents the Git fallback for pre-commit users.
catalog/​snippets/​husky/​README.md	Documents the Git fallback for Husky users.
catalog/​snippets/​hub_fetch_run.py	Adds Git-based commit resolution and commit-pinned fetching for the prose gate files.

_{Review effort: Lite}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.78%. Comparing base (20e8270) to head (9b49229).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #3420   +/-   ##
========================================
  Coverage    80.78%   80.78%           
========================================
  Files           23       23           
  Lines         8848     8848           
========================================
  Hits          7148     7148           
  Misses        1700     1700           

Flag	Coverage Δ
python-3.13	80.78% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ptr727]

Answer to the headline of the Copilot round on 9b492290, "one minor documentation nit remains". The round names no nit in a thread or in its body, so nothing locates it. The documentation nit on record for this head is the module docstring of tests/test_hub_fetch_run.py not naming the git ls-remote fallback. It is Listed in the body under "Local review", declined as style because the list stays true.