@starci/hfs 4.7.26 → 4.7.28

package/sync/hygiene.mjs

@@ -3,7 +3,9 @@
 // .starcistacks must not be a plaintext secret (only *.enc is sealed). It is also the secrets guard of the commit: every staged file, in
 // any tree, is read from the index and judged with the one secret judgement of `starci app check` (scripts/hfs/rules/secrets.mjs: a secret by
 // being, an .enc that is no sops envelope, a line that matches a secret pattern), so no plaintext secret reaches the history whatever
-// .gitignore says (`git add -f`, a path tracked before a rule tightened). There is no override. At an HFS app root (hfs.json) it also
+// .gitignore says (`git add -f`, a path tracked before a rule tightened). There is no override. It also
+// refuses every bypass marker the index holds (R303: an inline disable, a type-check escape, a skipped test, a failure swallowed in a hook or
+// workflow; scripts/lib/bypass-markers.mjs), so a bypass fails at the commit and not only at the release. At an HFS app root (hfs.json) it also
 // refuses a back-end logic file the index adds without its unit spec beside it (BE_UNIT_SPEC_NOT_STAGED,
 // scripts/hfs/rules/staged-specs.mjs over the coverage scope; a constants-only file has nothing to test), naming the file. The pre-commit hook judges the staged files;
 // scripts/gates/hfs-sync.mjs judges every tracked file.
@@ -17,6 +19,8 @@ import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { secretFileFindings } from '../runtime/scripts/hfs/rules/secrets.mjs';
 import { stagedSpecFindings } from '../runtime/scripts/hfs/rules/staged-specs.mjs';
+import { HFS_BYPASS_MARKER, bypassMessage } from '../runtime/scripts/hfs/rules/bypass-markers.mjs';
+import { bypassesIn } from '../runtime/scripts/lib/bypass-markers.mjs';
 import { loadSlotManifest } from '../runtime/scripts/hfs/slots.mjs';
 import { runGit } from '../runtime/scripts/api/git/lib.mjs';
 import { loadTypescript } from '../runtime/scripts/lib/package-at.mjs';
@@ -48,7 +52,7 @@ function ignoredAmong(cwd, files) {
 }
 
 /** Violations among `files` (repository-relative, '/'-separated): [{ file, code, message }]. `ignored` is a Set of ignored paths. */
-function hygieneFindings(files, ignored) {
+export function hygieneFindings(files, ignored) {
   const findings = [];
   for (const file of files) {
     if (file.startsWith(WORK) && ignored.has(file)) {
@@ -104,12 +108,20 @@ function secretGuardFindings(cwd, files, alreadyRefused = new Set()) {
   });
 }
 
-/** Findings for `files`: the guarded trees, then the secret guard over every file. */
+/** The bypass markers (R303) of `files` read from the index: an inline disable, a type-check escape, a skipped test or a swallowed failure fails at the commit. */
+function bypassGuardFindings(cwd, files) {
+  return files.flatMap(file => {
+    const text = stagedText(cwd, file);
+    return text === null ? [] : bypassesIn(file, text).map(hit => ({ file, code: HFS_BYPASS_MARKER, message: bypassMessage(file, hit) }));
+  });
+}
+
+/** Findings for `files`: the guarded trees, then the secret guard and the bypass guard over every file. */
 export function judge(cwd, files) {
   const guarded = files.filter(GUARDED);
   const findings = hygieneFindings(guarded, ignoredAmong(cwd, guarded.filter(file => file.startsWith(WORK))));
   const refused = new Set(findings.filter(finding => finding.code === 'HFS_PLAINTEXT_SECRET').map(finding => finding.file));
-  return { checked: files.length, findings: [...findings, ...secretGuardFindings(cwd, files, refused)] };
+  return { checked: files.length, findings: [...findings, ...secretGuardFindings(cwd, files, refused), ...bypassGuardFindings(cwd, files)] };
 }
 
 // The scripts/housekeeping/ledger-hygiene.mjs of the checkout under judgment: the root git names for `cwd`, which carries

package/templates/app/hooks/husky/pre-commit

@@ -1,15 +1,16 @@
 {{header}}
-# Commit gate (L0 only): work hygiene and the secrets guard of the staged files, eslint of the staged files of each side,
-# stylelint over the staged CSS of fe, a prettier check of the staged files. Types and the targeted specs belong to the op gate.
-npx starci app hygiene
+# Commit gate (L0 only): work hygiene, the secrets guard and the bypass guard (no inline disable, type-check escape, skipped test or
+# swallowed failure: HFS_BYPASS_MARKER) of the staged files, managed files equal to their render, eslint of the staged files of each
+# side, stylelint over the staged CSS of fe, a prettier check of the staged files. Every step ends the hook when it fails: none can be
+# skipped. Types and the targeted specs belong to the op gate.
+npx starci app hygiene || exit $?
+npx starci app sync --check || exit $?
 # NUL-delimited paths keep filenames intact; bounded batches fit the Windows command line.
 git diff --cached --name-only --diff-filter=ACMR -z --relative=be -- '*.ts' '*.mts' '*.cts' '*.js' '*.mjs' '*.cjs' |
   xargs -0 -n 50 sh -c 'if [ "$#" -gt 0 ]; then cd be && npx eslint -- "$@"; fi' sh || exit $?
 git diff --cached --name-only --diff-filter=ACMR -z --relative=fe -- '*.ts' '*.tsx' '*.mts' '*.cts' '*.js' '*.jsx' '*.mjs' '*.cjs' |
   xargs -0 -n 50 sh -c 'if [ "$#" -gt 0 ]; then cd fe && npx eslint --max-warnings=0 --no-warn-ignored -- "$@"; fi' sh || exit $?
-styles=$(git diff --cached --name-only --diff-filter=ACMR --relative=fe -- '*.css') || exit $?
-if [ -n "$styles" ]; then
-  (cd fe && npx stylelint $styles)
-fi
+git diff --cached --name-only --diff-filter=ACMR -z --relative=fe -- '*.css' |
+  xargs -0 -n 50 sh -c 'if [ "$#" -gt 0 ]; then cd fe && npx stylelint "$@"; fi' sh || exit $?
 git diff --cached --name-only --diff-filter=ACMR -z |
   xargs -0 -n 50 sh -c 'if [ "$#" -gt 0 ]; then npx prettier --check --ignore-unknown -- "$@"; fi' sh || exit $?