Template
mrcharles
8bff9567b7
Machine-optimal global AGENTS.md (symlinked at ~/.config/AGENTS.md, picked up by every crush lane) covering the alpha/beta/uat/prod doctrine (prod = human release only), strict SDLC (red/green TDD, adversarial review, code/tests/docs/ticket sync), gitea-redmine-discourse cross-linking, and the 2026-08-31 rulings (no JOURNAL.md, sparse STATUS.md, rolling table HUD). Global enforcement layer: repo-scoped ticket-gate (crush PreToolUse, all lanes) + universal git pre-commit/pre-push (core.hooksPath) that delegate to repo-local check-rules.sh and chain installed .git/hooks.
58 lines
2.4 KiB
Bash
Executable File
58 lines
2.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# hooks/global/pre-push — GLOBAL git hook (core.hooksPath for every
|
|
# repo on this host). Runs universal checks always, delegates to the
|
|
# repo's own enforcement when present, and chains the repo's installed
|
|
# .git/hooks/<name> so copy-installed hooks keep working.
|
|
#
|
|
# Layers, in order:
|
|
# 1. Universal: staged conflict markers, secret-looking material,
|
|
# :latest image tags in staged compose/Dockerfiles.
|
|
# 2. Repo-local: scripts/check-rules.sh --fast (if the repo ships it)
|
|
# 3. Repo chain: .git/hooks/pre-push (if present)
|
|
# Bypass: --no-verify in genuine emergencies ONLY, and note it in the
|
|
# repo JOURNAL the same day.
|
|
set -uo pipefail
|
|
# pre-push receives refs on stdin; drain it so delegating hooks inherit a clean fd
|
|
cat >/dev/null 2>&1 || true
|
|
|
|
REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || exit 0)"
|
|
FAIL=0
|
|
|
|
# --- 1. Universal checks on staged content -------------------------------
|
|
while IFS= read -r -d '' f; do
|
|
# skip binary-looking blobs
|
|
case "$f" in
|
|
*.png|*.jpg|*.jpeg|*.gif|*.ico|*.woff|*.woff2|*.ttf|*.db|*.zip|*.gz) continue ;;
|
|
esac
|
|
[ -f "$REPO_ROOT/$f" ] || continue
|
|
|
|
if grep -nE '^(<<<<<<<|=======|>>>>>>>)' "$REPO_ROOT/$f" >/dev/null 2>&1; then
|
|
echo "FAIL conflict markers staged in $f" >&2; FAIL=1
|
|
fi
|
|
case "$f" in
|
|
*Dockerfile*|*docker-compose*|*compose*.y*ml)
|
|
if grep -nE 'image:[[:space:]]*[A-Za-z0-9._/-]+:latest' "$REPO_ROOT/$f" >/dev/null 2>&1; then
|
|
echo "FAIL :latest image tag in $f (pin digests or versions)" >&2; FAIL=1
|
|
fi ;;
|
|
esac
|
|
if grep -nE '(sk-[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|-----BEGIN (RSA|EC|OPENSSH) PRIVATE KEY-----)' "$REPO_ROOT/$f" >/dev/null 2>&1; then
|
|
echo "FAIL secret-looking material staged in $f (secrets live ONLY in ~/.creds)" >&2; FAIL=1
|
|
fi
|
|
done < <(git diff --cached --name-only -z 2>/dev/null)
|
|
|
|
# --- 2. Repo-local rule engine, when adopted -----------------------------
|
|
if [ -x "$REPO_ROOT/scripts/check-rules.sh" ]; then
|
|
if ! (cd "$REPO_ROOT" && bash scripts/check-rules.sh --quiet); then
|
|
echo "FAIL repo-local check-rules.sh (fast)" >&2; FAIL=1
|
|
fi
|
|
fi
|
|
|
|
# --- 3. Chain the repo's own installed hook ------------------------------
|
|
if [ -x "$REPO_ROOT/.git/hooks/pre-push" ]; then
|
|
if ! "$REPO_ROOT/.git/hooks/pre-push"; then
|
|
echo "FAIL repo .git/hooks/pre-push" >&2; FAIL=1
|
|
fi
|
|
fi
|
|
|
|
exit "$FAIL"
|