neon_sakura 0.1.4

data/scripts/git-hooks/pre-commit

@@ -0,0 +1,123 @@
+#!/bin/bash
+
+# neon_sakura pre-commit hook
+# Runs Rubocop and Brakeman security checks before commits
+
+echo "🔍 Running pre-commit checks..."
+
+# Check if we're in a Rails app
+if [ ! -f "Gemfile" ]; then
+  echo "❌ Not a Rails application, skipping checks"
+  exit 0
+fi
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+# Function to run command and check exit status
+run_check() {
+  local check_name="$1"
+  local command="$2"
+  local success_msg="$3"
+  local failure_msg="$4"
+
+  echo -e "${YELLOW}Running $check_name...${NC}"
+
+  if eval "$command" > /dev/null 2>&1; then
+    echo -e "${GREEN}✅ $success_msg${NC}"
+    return 0
+  else
+    echo -e "${RED}❌ $failure_msg${NC}"
+    return 1
+  fi
+}
+
+# Track if any checks failed
+failed_checks=0
+
+# 1. Rubocop - Ruby code style and quality
+if ! run_check "Rubocop" "bundle exec rubocop --fail-fast" "Ruby code style checks passed" "Ruby code style issues found"; then
+  echo -e "${RED}Fix Rubocop issues with: bundle exec rubocop -a${NC}"
+  failed_checks=$((failed_checks + 1))
+fi
+
+# 2. Stylelint - CSS linting
+if command -v yarn &> /dev/null && [ -f "package.json" ]; then
+  if ! run_check "Stylelint" "yarn lint:css" "CSS style checks passed" "CSS style issues found"; then
+    echo -e "${RED}Fix CSS style issues with: yarn lint:css:fix${NC}"
+    failed_checks=$((failed_checks + 1))
+  fi
+else
+  echo -e "${YELLOW}⚠️  Stylelint skipped (yarn not installed or package.json missing)${NC}"
+fi
+
+# 3. Brakeman - Security vulnerability scanner
+if ! run_check "Brakeman" "bundle exec brakeman -q --no-pager" "Security scan passed" "Security vulnerabilities found"; then
+  echo -e "${RED}Review security issues with: bundle exec brakeman${NC}"
+  failed_checks=$((failed_checks + 1))
+fi
+
+# 4. Bundle Audit - Check for gem vulnerabilities
+if ! run_check "Bundle Audit" "bundle exec bundle-audit check --update" "Gem security check passed" "Vulnerable gems found"; then
+  echo -e "${RED}Update vulnerable gems or check: bundle exec bundle-audit check${NC}"
+  failed_checks=$((failed_checks + 1))
+fi
+
+# 5. Pending Migrations - Check for unapplied migrations
+pending_migrations=$(bundle exec rails db:migrate:status 2>/dev/null | grep "^\s*down" | wc -l)
+if [ "$pending_migrations" -gt 0 ]; then
+  echo -e "${RED}❌ $pending_migrations pending migration(s) found${NC}"
+  echo -e "${RED}Run: bundle exec rails db:migrate${NC}"
+  failed_checks=$((failed_checks + 1))
+else
+  echo -e "${GREEN}✅ No pending migrations${NC}"
+fi
+
+# 6. Secrets Detection - Scan for API keys/passwords
+secrets_check() {
+  # Check for common secret patterns in staged files
+  local patterns=(
+    "api[_-]?key\s*[:=]\s*['\"][^'\"]{10,}['\"]"
+    "secret[_-]?key\s*[:=]\s*['\"][^'\"]{10,}['\"]"
+    "password\s*[:=]\s*['\"][^'\"]{8,}['\"]"
+    "token\s*[:=]\s*['\"][^'\"]{10,}['\"]"
+    "access[_-]?token\s*[:=]\s*['\"][^'\"]{10,}['\"]"
+    "private[_-]?key"
+    "-----BEGIN.*PRIVATE KEY-----"
+  )
+
+  # Get staged files
+  staged_files=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(rb|yml|yaml|env|json)$' || true)
+
+  if [ -n "$staged_files" ]; then
+    for pattern in "${patterns[@]}"; do
+      if echo "$staged_files" | xargs git show :0 2>/dev/null | grep -iE "$pattern" > /dev/null 2>&1; then
+        return 1
+      fi
+    done
+  fi
+  return 0
+}
+
+if ! secrets_check; then
+  echo -e "${RED}❌ Potential secrets detected in staged files${NC}"
+  echo -e "${RED}Review your changes for API keys, passwords, or tokens${NC}"
+  failed_checks=$((failed_checks + 1))
+else
+  echo -e "${GREEN}✅ No secrets detected${NC}"
+fi
+
+# Exit with error if any checks failed
+if [ $failed_checks -gt 0 ]; then
+  echo ""
+  echo -e "${RED}❌ $failed_checks check(s) failed. Commit aborted.${NC}"
+  echo -e "${YELLOW}Fix the issues above and try committing again.${NC}"
+  exit 1
+fi
+
+echo ""
+echo -e "${GREEN}🎉 All pre-commit checks passed!${NC}"
+exit 0

data/scripts/git-hooks/pre-push

@@ -0,0 +1,127 @@
+#!/bin/bash
+
+# neon_sakura pre-push hook
+# Runs database consistency and asset compilation checks before pushing
+
+echo "🚀 Running pre-push checks..."
+
+# Check if we're in a Rails app
+if [ ! -f "Gemfile" ]; then
+  echo "❌ Not a Rails application, skipping checks"
+  exit 0
+fi
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+# Function to run command and check exit status
+run_check() {
+  local check_name="$1"
+  local command="$2"
+  local success_msg="$3"
+  local failure_msg="$4"
+
+  echo -e "${YELLOW}Running $check_name...${NC}"
+
+  if eval "$command" > /dev/null 2>&1; then
+    echo -e "${GREEN}✅ $success_msg${NC}"
+    return 0
+  else
+    echo -e "${RED}❌ $failure_msg${NC}"
+    return 1
+  fi
+}
+
+# Track if any checks failed
+failed_checks=0
+
+# 1. Database Consistency - Check schema.rb matches migrations
+check_schema_consistency() {
+  # Check if schema.rb is up to date with migrations
+  local schema_version=""
+  local migration_version=""
+
+  # Get version from schema.rb
+  if [ -f "db/schema.rb" ]; then
+    schema_version=$(grep "ActiveRecord::Schema\[.*\]\.define.*version:" db/schema.rb | grep -o "version: [0-9_]*" | cut -d' ' -f2 | tr -d '_')
+  fi
+
+  # Get latest migration version
+  if [ -d "db/migrate" ]; then
+    migration_version=$(ls db/migrate/*.rb 2>/dev/null | tail -1 | grep -o "[0-9]\{14\}" | head -1)
+  fi
+
+  if [ -n "$schema_version" ] && [ -n "$migration_version" ]; then
+    if [ "$schema_version" = "$migration_version" ]; then
+      return 0
+    else
+      return 1
+    fi
+  fi
+
+  # If we can't determine versions, assume they're consistent
+  return 0
+}
+
+if ! check_schema_consistency; then
+  echo -e "${RED}❌ Schema.rb doesn't match latest migration${NC}"
+  echo -e "${RED}Run: bundle exec rails db:migrate${NC}"
+  failed_checks=$((failed_checks + 1))
+else
+  echo -e "${GREEN}✅ Database schema is consistent${NC}"
+fi
+
+# 2. Asset Compilation - Ensure assets compile successfully
+if [ -f "config/application.rb" ]; then
+  # Check if we're using asset pipeline (Propshaft)
+  if grep -q "propshaft" Gemfile 2>/dev/null; then
+    # Test asset compilation in a temporary directory
+    temp_dir=$(mktemp -d)
+    export SECRET_KEY_BASE=dummy_key_for_asset_compilation
+
+    if bundle exec rails assets:precompile RAILS_ENV=development > "$temp_dir/assets.log" 2>&1; then
+      echo -e "${GREEN}✅ Assets compile successfully${NC}"
+      # Clean up precompiled assets
+      bundle exec rails assets:clobber > /dev/null 2>&1
+    else
+      echo -e "${RED}❌ Asset compilation failed${NC}"
+      echo -e "${RED}Check: cat $temp_dir/assets.log${NC}"
+      failed_checks=$((failed_checks + 1))
+    fi
+
+    # Clean up
+    rm -rf "$temp_dir"
+    unset RAILS_ENV SECRET_KEY_BASE
+  else
+    echo -e "${GREEN}✅ No asset pipeline detected, skipping asset compilation check${NC}"
+  fi
+else
+  echo -e "${YELLOW}⚠️  Not a Rails application, skipping asset compilation check${NC}"
+fi
+
+# 3. Additional checks that are good for pre-push
+echo -e "${YELLOW}Running additional pre-push checks...${NC}"
+
+# Check for TODO/FIXME comments in staged files (warning only)
+todo_count=$(git diff --cached --name-only | xargs grep -i "TODO\|FIXME" 2>/dev/null | wc -l)
+if [ "$todo_count" -gt 0 ]; then
+  echo -e "${YELLOW}⚠️  $todo_count TODO/FIXME comment(s) found in staged files${NC}"
+else
+  echo -e "${GREEN}✅ No TODO/FIXME comments in staged files${NC}"
+fi
+
+# Exit with error if any critical checks failed
+if [ $failed_checks -gt 0 ]; then
+  echo ""
+  echo -e "${RED}❌ $failed_checks critical check(s) failed. Push aborted.${NC}"
+  echo -e "${YELLOW}Fix the issues above and try pushing again.${NC}"
+  echo -e "${YELLOW}To skip these checks: git push --no-verify${NC}"
+  exit 1
+fi
+
+echo ""
+echo -e "${GREEN}🎉 All pre-push checks passed!${NC}"
+exit 0