@soleur/opencode 0.0.0-stage → 3.354.2

package/scripts/grok-pre-push-gate.sh

@@ -0,0 +1,232 @@
+#!/usr/bin/env bash
+# Grok Build pre-push gate — local CI parity before `git push`.
+#
+# Mirrors the reproducible subset of .github/workflows/ci.yml required checks:
+#   Phase 1 — fast always-run jobs (seconds)
+#   Phase 2 — affected-tests.sh (the plugin gate; in this repo it delegates
+#             scripts/test-all.sh --affected — diff-selected suites + always-on
+#             ratchets; the FULL battery is the CI `test` aggregator's job, and
+#             is opt-in locally via `affected-tests.sh --full`)
+#   Phase 3 — web-platform next build (route-file validator; CI web-platform-build)
+#   Phase 4 — plugins/soleur/scripts/grok-fidelity-gate.sh (CI grok-fidelity)
+#
+# CI-only (cannot run here): CodeQL, CLA, e2e Playwright container, tenant-integration
+# (dev Supabase), dependency-review, skill-security-scan, creds-gated propagation probes.
+#
+# infra-validation.yml (suites under apps/web-platform/infra/) IS covered by this gate now,
+# indirectly: it invokes `bash scripts/test-all.sh --affected` with no TEST_GROUP, so
+# `want_infra` holds and test-all.sh runs run-registered-suites.sh as a nested suite whenever
+# the diff touches that directory — the affected selector carries the same infra edge, so
+# coverage is unchanged by the mode (#7103 R5(a), #8322).
+#
+# So do NOT "run it alongside this gate", which is what this comment used to say. That advice
+# predates the registration and is now actively harmful: both entry points default
+# TMPDIR=/var/tmp, so a concurrent second run reproduces the sibling-contention shape and can
+# self-inflict a false RED — while paying the ~25-minute affected-gate cost twice. Read test-all.sh's
+# epilogue, which states whether the runner actually ran, and invoke it separately only when
+# that line says it did not (#7014 is why the coverage status is stated here at all).
+#
+# Usage:
+#   bash plugins/soleur/scripts/grok-pre-push-gate.sh
+#   bash plugins/soleur/scripts/grok-pre-push-gate.sh --skip-build   # skip next build
+#
+# Inspect exit code explicitly — do not pipe through tail (see work SKILL.md §Phase 3).
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+# The affected gate is a plugin sibling — resolve it beside THIS script
+# (dirname $0), never through CLAUDE_PLUGIN_ROOT (ADR-179: env-directed roots
+# are a trust class; a sibling path cannot point anywhere else).
+GATE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/affected-tests.sh"
+cd "$REPO_ROOT"
+
+SKIP_BUILD=0
+for arg in "$@"; do
+  case "$arg" in
+    --skip-build) SKIP_BUILD=1 ;;
+    -h|--help)
+      sed -n '1,20p' "$0"
+      exit 0
+      ;;
+    *)
+      echo "Unknown arg: $arg (try --help)" >&2
+      exit 2
+      ;;
+  esac
+done
+
+step() {
+  echo ""
+  echo "========================================"
+  echo "==> $1"
+  echo "========================================"
+}
+
+run_step() {
+  local name="$1"
+  shift
+  step "$name"
+  # Capture rc — `if "$@"` is a boolean test and discards the exit code, so a step that
+  # reports 3 (test-all.sh's EXIT CONTRACT: zero suites failed, >= 1 suite terminated with a
+  # signal-shaped status) or 4 (REFUSED — nothing ran) would be re-labelled a failure.
+  # Non-zero either way: a step that was not measured is not a step that passed. What the
+  # distinct arms buy is that the MESSAGE names the cause that actually occurred.
+  # rc 6/7 pass-with-note applies ONLY to the affected gate — matched on the
+  # step name or the invoked script path (both, so a renamed label or a moved
+  # script path can't silently demote another step's 6/7 to a pass).
+  local _affected_step=0
+  if [[ "$name" == "affected-tests gate" ]] \
+     || { [[ -n "${2:-}" ]] \
+          && [[ "$2" == "${GATE:-}" || "$2" == *affected-tests.sh ]]; }; then
+    _affected_step=1
+  fi
+  local rc=0
+  "$@" || rc=$?
+  if (( rc == 0 )); then
+    echo "[ok] $name"
+  elif (( rc == 3 )); then
+    # Worded WITHOUT promising [KILLED] lines. exit 3 is test-all.sh's contract
+    # (reached here via the affected-tests gate step — the gate maps a runner's
+    # 3 to its own rc 1, so this arm fires only for a step returning a bare 3);
+    # run_step drives ten steps and the others emit no [KILLED] lines, so the
+    # old wording asserted evidence that would not be there.
+    echo "[UNRESOLVED] $name — exited 3 without reporting a failure; if this step delegates to test-all.sh see its EXIT CONTRACT block" >&2
+    exit 3
+  elif (( rc == 4 )); then
+    # Same class as the rc=3 arm above, and the arm that arm exists to prevent: rc=4 is
+    # test-all.sh's REFUSED — NOTHING RAN — not a red diff, so routing it to [FAIL] names a
+    # cause that did not occur. Latent rather than live: the only step that can produce 4 is
+    # the test-all step, and under --affected both full-gate refusals are exempt — what CAN
+    # still produce 4 is a DEGRADED affected run (undecidable diff, missing index, or a diff
+    # touching the runner/index itself) that then meets sibling contention, or a gutted
+    # declarations index. It is arm'd anyway because the mislabel would be silent.
+    echo "[REFUSED] $name — exited 4: the run was declined before any suite started, so this says nothing about your diff." >&2
+    echo "  If this step is test-all.sh: affected mode degraded to the full battery and met a" >&2
+    echo "  sibling run or a subagent context — resolve the printed reason= and re-run, or wait" >&2
+    echo "  for the sibling. An AFFECTED_UNRESOLVED print names the refusal directly." >&2
+    exit 4
+  elif (( rc == 6 || rc == 7 )) && (( _affected_step )); then
+    # SCOPED to the affected-gate step: rc 6/7 are affected-tests.sh's
+    # pass-with-note verdicts (ADR-292, block-vs-pass decision). On any OTHER
+    # step 6/7 is an ordinary failure — a random suite exiting 6 must never
+    # read as a CI deferral.
+    if (( rc == 6 )); then
+      # AFFECTED_GATE_BUDGET_DEFERRED: the wall-clock budget expired AND a CI
+      # test workflow was detected, which the contract makes the authoritative
+      # gate. Pass WITH a note — the local evidence is partial, the push is
+      # allowed, and the CI `test` context remains the merge blocker.
+      echo "[note] $name — exited 6 (budget-deferred): the detected CI test workflow is the authoritative gate; local coverage is partial." >&2
+    else
+      # rc 7 no-suite verdict: the gate found nothing to run and disclosed it.
+      # Disclosed non-coverage, never a silent pass and never labelled one.
+      echo "[note] $name — exited 7: no test suite detected; the gate disclosed the gap rather than running tests." >&2
+    fi
+  else
+    echo "[FAIL] $name" >&2
+    exit 1
+  fi
+}
+
+echo "grok-pre-push-gate: starting local CI parity (repo: $REPO_ROOT)"
+
+# --- Phase 0: pre-launch capacity probe (#7545) — ADVISORY, never a gate ---
+#
+# Answers "can this box absorb the gate I am about to start?" in ~3 s
+# (measured p50 on a 16-core box with ~640 pids; it walks /proc once). Phase 2
+# below runs `affected-tests.sh` — which in THIS repo delegates to
+# `test-all.sh --affected` (the diff-selected set plus the always-on ratchets,
+# roughly half the ~45-min serial battery on the measured baseline, #8322). The probe still earns its place: an affected run can DEGRADE to the
+# full battery (undecidable diff, runner/index touched, FORCE_ALL), and on a
+# contended box that run's REDs may be interleaving rather than regressions.
+#
+# `timeout` is not optional: on the loaded box this probe exists to diagnose, an
+# unbounded /proc walk can block the push gate with no marker at all.
+#
+# NOT run through run_step, and the `|| true` is deliberate: a capacity verdict
+# must never gate a push. It is a STATEMENT the operator reads, not a decision
+# the script makes — see the ADR-133 2026-08-19 addendum for why the blocking
+# form was cut. Its exit code is discarded so that a broken or missing probe
+# also cannot gate the push.
+echo "--- capacity (advisory, does not gate) ---"
+_cap_out="$(timeout 60 bash scripts/test-all.sh --capacity 2>&1 || true)"
+printf '%s\n' "$_cap_out"
+# ABSENCE IS ITS OWN OUTCOME. `|| true` on a bare call made a probe that died
+# before emitting indistinguishable from a healthy quiet box — the exact
+# vanishing answer the lib-stub arm exists to prevent, one layer out.
+if ! grep -q 'CAPACITY_' <<<"$_cap_out"; then
+  echo "[contention] BANNER CAPACITY_UNKNOWN reason=probe_failed_or_timed_out"
+fi
+
+# --- Phase 1: fast CI jobs (ci.yml always-run, no secrets) ---
+run_step "readme-counts" bash scripts/sync-readme-counts.sh --check
+run_step "adr-ordinals" bash scripts/check-adr-ordinals.sh
+run_step "service-role-allowlist-gate" bash apps/web-platform/scripts/service-role-allowlist-gate.sh
+run_step "lint-bot-synthetic-statuses" bash scripts/lint-bot-synthetic-statuses.sh
+run_step "lint-bot-synthetic-completeness" bash scripts/lint-bot-synthetic-completeness.sh
+run_step "lint-conversations-update-callsites" bash scripts/lint-conversations-update-callsites.sh
+run_step "tc-document-sha-guard" bash apps/web-platform/scripts/check-tc-document-sha.sh
+
+if git rev-parse --verify origin/main >/dev/null 2>&1; then
+  git fetch --no-tags --quiet origin main 2>/dev/null || true
+  merge_base="$(git merge-base origin/main HEAD)"
+  run_step "rule-body-lint" python3 scripts/lint-rule-bodies.py --check --base "$merge_base"
+else
+  echo "SKIP rule-body-lint (no origin/main ref)"
+fi
+
+# lockfile-sync (ci.yml): regenerate under npm@11 and diff; restore on failure.
+step "lockfile-sync"
+if command -v npm >/dev/null 2>&1; then
+  npm_major="$(npm --version | cut -d. -f1)"
+  if [[ "$npm_major" != "11" ]]; then
+    echo "WARNING: npm $(npm --version) — CI pins npm@11 for lockfile-sync; install npm@11 for exact parity" >&2
+  fi
+  (cd apps/web-platform && npm install --package-lock-only)
+  if git diff --exit-code apps/web-platform/package-lock.json; then
+    echo "[ok] lockfile-sync"
+  else
+    git checkout -- apps/web-platform/package-lock.json
+    echo "[FAIL] lockfile-sync — package-lock.json out of sync with package.json" >&2
+    echo "Fix: cd apps/web-platform && npx --yes npm@11 install --package-lock-only && commit" >&2
+    exit 1
+  fi
+else
+  echo "SKIP lockfile-sync (npm not on PATH)" >&2
+fi
+
+# --- Phase 2: affected test gate (#8322, #9307) ---
+# `affected-tests.sh` — the plugin-generic gate; in THIS repo its capability
+# probe resolves scripts/test-all.sh and delegates `--affected`: the suites
+# this diff can move, plus every always-on repo-global ratchet — roughly half
+# the ~45-min battery, and exempt from the full-gate refusals unless the
+# selection DEGRADES to full — so the SOLEUR_ALLOW_FULL_GATE=1 hatch this step
+# previously carried is gone rather than merely unneeded. The full battery
+# remains the CI `test` required check's job (and `test-all.sh --full` or
+# `affected-tests.sh --full` locally). An undecidable diff degrades the
+# delegated run to the full battery on its own — the runner's
+# AFFECTED_FALLBACK line says so.
+run_step "affected-tests gate" bash "$GATE"
+
+# --- Phase 3: next build / route validator (CI web-platform-build) ---
+# Local APPROXIMATION of the CI job: since #8136 `web-platform-build` builds the Dockerfile's
+# `builder` stage from the apps/web-platform context (which is what catches a reference above
+# the app root — release 34773058045); a bare `next build` on a full checkout cannot see that
+# class. The context check itself lives in test/docker-context-import-containment.test.ts.
+if [[ "$SKIP_BUILD" -eq 0 ]]; then
+  step "web-platform-build"
+  if [[ -f apps/web-platform/package-lock.json ]]; then
+    (cd apps/web-platform && npm ci --ignore-scripts && npm run build)
+    echo "[ok] web-platform-build"
+  else
+    echo "SKIP web-platform-build (no package-lock.json)" >&2
+  fi
+else
+  echo "SKIP web-platform-build (--skip-build)"
+fi
+
+# --- Phase 4: Grok fidelity (CI grok-fidelity required check) ---
+export GROK_FIDELITY_SKIP_BUDGET=1
+run_step "grok-fidelity-gate" bash plugins/soleur/scripts/grok-fidelity-gate.sh
+
+echo ""
+echo "grok-pre-push-gate: PASS — safe to git push"