@theholocron/cli 4.9.0 → 4.10.1

package/README.md

@@ -72,9 +72,49 @@ Additional `repo` fields recognised by `holocron setup`:
 | ----------------- | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `repo.teams`      | `Array<string \| { slug, permission }>` | GitHub teams granted repo access. String shorthand defaults to `push` (Write). `holocron setup` also writes `.github/CODEOWNERS` for teams with `push`/`maintain`/`admin`. |
 | `repo.topics`     | `string[]`                              | GitHub topics set on the repository.                                                                                                                                       |
-| `repo.protection` | `"balanced" \| "strict" \| "none"`      | Branch-protection preset applied by `holocron setup`.                                                                                                                      |
+| `repo.protection` | `"balanced" \| "strict" \| "none"`      | Branch-protection preset applied by `holocron setup`. For `"strict"`, the required status checks are derived from the task manifest — see below.                           |
 | `repo.properties` | `RepoProperties`                        | Org-level custom property values synced to the GitHub dashboard.                                                                                                           |
 
+### Required status checks (`protection: "strict"`)
+
+`holocron setup` builds the branch-protection required-check list from the
+manifest, not a hand-maintained array:
+
+- `"DCO"` (hard-prepended), then
+- every `{ required: true }` task's workflow check context (`Lint / Conclusion`,
+  `Test / Conclusion`, `Typecheck / Conclusion`, `audit / Conclusion`), walked
+  in CI order, then
+- the top-level `extraRequiredChecks` (codecov gates, a bundle-build check, …).
+
+```ts
+export default defineConfig({
+  tasks: [
+    { name: "lint", required: true },
+    { name: "test", required: true },
+    { name: "typecheck", required: true },
+  ],
+  extraRequiredChecks: ["codecov/patch", "codecov/project"],
+  repo: { name: "acme/app", protection: "strict" },
+  providers: { source: "github" },
+});
+```
+
+### Git hooks
+
+```ts
+export default defineConfig({
+  hooks: true, // or { prePush: true }
+  repo: { protection: "strict" },
+  providers: { source: "github" },
+});
+```
+
+`holocron setup` writes `.husky/pre-push` (runs `holocron ci` before every
+push) and sets `package.json#scripts.prepare` to `husky`. On by default for
+`protection: "strict"`; `false` / `{ prePush: false }` opts out. `holocron
+setup --hooks` / `--no-hooks` override per run. Bypass one push with `git push
+--no-verify`.
+
 ### Task scripts
 
 `holocron sync` reconciles `package.json#scripts` from the `tasks` manifest
@@ -93,6 +133,21 @@ Writes `"holocron": "<holocronScript ?? 'holocron'>"` plus one
 `"<task>": "holocron run <task>"` per runnable task. `syncScripts: false`
 opts out entirely.
 
+### `holocron ci`
+
+```bash
+holocron ci [--all] [--filter <pkg>] [--dry-run]
+```
+
+Runs the merge-gating checks locally, in CI order, exiting non-zero on the
+first failure — the "will my PR be green?" pre-flight, and what the
+`pre-push` hook runs. Default scope is every `{ required: true }` task
+(falling back to every `ci: true` task when nothing is marked required).
+`--all` forces the full set; `--filter` is a `turbo --filter=` passthrough.
+Order comes from the `CI_ORDER` constant in `@theholocron/astromech`
+(`typecheck → lint → test → build → …`). Tasks with no local equivalent
+(`audit`, `codeql`, `deploy`) are reported as enforced-in-CI, never failures.
+
 ### Lint parity
 
 The `lint` task takes an optional `linters` array — one list that drives

package/dist/cli.mjs

@@ -284,6 +284,7 @@ function resolveConfig(raw) {
 		syncScripts: raw.syncScripts,
 		holocronScript: raw.holocronScript,
 		extraRequiredChecks: raw.extraRequiredChecks,
+		hooks: raw.hooks,
 		providers,
 		apps: raw.apps ?? [],
 		doctor: raw.doctor ?? {},
@@ -3374,12 +3375,12 @@ var alexrc_default = { allow: [
 ] };
 //#endregion
 //#region src/templates/configs/alexjs/create-config.ts
-const { workflowHeader: workflowHeader$6 } = createHeader({ source: "packages/cli/src/templates/configs/alexjs/create-config.ts" });
+const { workflowHeader: workflowHeader$7 } = createHeader({ source: "packages/cli/src/templates/configs/alexjs/create-config.ts" });
 function createRcConfig() {
 	return JSON.stringify(alexrc_default, null, 2) + "\n";
 }
 function createIgnoreConfig() {
-	return `${workflowHeader$6()}${alexignore_default}`;
+	return `${workflowHeader$7()}${alexignore_default}`;
 }
 //#endregion
 //#region src/templates/configs/codecov/codecov.yml
@@ -3423,15 +3424,15 @@ async function readWorkspacePackages(repoRoot) {
 //#endregion
 //#region src/templates/configs/codecov/create-config.ts
 const { scaffoldHeader } = createHeader({ source: "packages/cli/src/templates/configs/codecov/create-config.ts" });
-function createConfig$4(packages) {
+function createConfig$5(packages) {
 	return `${scaffoldHeader()}${codecov_default.trimEnd()}${codecovComponentBlock(packages)}`;
 }
 //#endregion
 //#region src/templates/configs/devmoji/create-config.ts
-const { workflowHeader: workflowHeader$5 } = createHeader({ source: "packages/cli/src/templates/configs/devmoji/create-config.ts" });
-function createConfig$3() {
+const { workflowHeader: workflowHeader$6 } = createHeader({ source: "packages/cli/src/templates/configs/devmoji/create-config.ts" });
+function createConfig$4() {
 	return [
-		workflowHeader$5("cjs"),
+		workflowHeader$6("cjs"),
 		`/* eslint-disable */`,
 		`const { defineConfig } = require("@theholocron/devmoji-config");`,
 		`module.exports = defineConfig();`,
@@ -3443,9 +3444,9 @@ function createConfig$3() {
 var editorconfig_default = "root = true\n\n[*]\nend_of_line = lf\ncharset = utf-8\ntrim_trailing_whitespace = true\ninsert_final_newline = true\nindent_style = tab\nindent_size = 4\n\n[.gitattributes]\nindent_style = space\nindent_size = 2\n\n[*.{json,yml,yaml}]\nindent_style = space\nindent_size = 2\n\n[*.{md,mdx}]\ntrim_trailing_whitespace = false\n\n[.*{rc,ignore}]\nindent_style = space\nindent_size = 2\n";
 //#endregion
 //#region src/templates/configs/editorconfig/create-config.ts
-const { workflowHeader: workflowHeader$4 } = createHeader({ source: "packages/cli/src/templates/configs/editorconfig/create-config.ts" });
-function createConfig$2() {
-	return `${workflowHeader$4()}${editorconfig_default}`;
+const { workflowHeader: workflowHeader$5 } = createHeader({ source: "packages/cli/src/templates/configs/editorconfig/create-config.ts" });
+function createConfig$3() {
+	return `${workflowHeader$5()}${editorconfig_default}`;
 }
 //#endregion
 //#region src/templates/configs/editorconfig-checker/editorconfig-checker.json
@@ -3476,10 +3477,27 @@ var editorconfig_checker_default = {
 };
 //#endregion
 //#region src/templates/configs/editorconfig-checker/create-config.ts
-function createConfig$1() {
+function createConfig$2() {
 	return JSON.stringify(editorconfig_checker_default, null, 2) + "\n";
 }
 //#endregion
+//#region src/templates/configs/pre-push/pre-push
+var pre_push_default = "# Run the merge-gating checks locally before pushing — the same set CI runs.\n# Bypass once with:  git push --no-verify\n\n# CI runners (semantic-release, super-linter auto-commit, bots) push without a\n# built dev environment — the hook has nothing to add there.\n[ -n \"$CI\" ] && exit 0\n\n__HOLOCRON_SCRIPT__ ci\n";
+//#endregion
+//#region src/templates/configs/pre-push/create-config.ts
+const { workflowHeader: workflowHeader$4 } = createHeader({ source: "packages/cli/src/templates/configs/pre-push/create-config.ts" });
+/**
+* `.husky/pre-push` — runs `holocron ci` (the merge-gating checks, in CI order)
+* before every push. Installed by `holocron setup` when hooks are enabled
+* (default for `protection: "strict"`). `git push --no-verify` bypasses it.
+*
+* @param holocronScript - the command that invokes the CLI. Defaults to
+*   `pnpm exec holocron`; the source repo passes `node packages/cli/dist/cli.mjs`.
+*/
+function createConfig$1(holocronScript = "pnpm exec holocron") {
+	return `${workflowHeader$4("shebang")}${pre_push_default.replace("__HOLOCRON_SCRIPT__", holocronScript)}`;
+}
+//#endregion
 //#region src/templates/configs/prepare-commit-msg/prepare-commit-msg
 var prepare_commit_msg_default = "NAME=$(git config user.name)\nEMAIL=$(git config user.email)\n\nif [ -z \"$NAME\" ]; then\n	echo \"empty git config user.name\"\n	exit 1\nfi\n\nif [ -z \"$EMAIL\" ]; then\n	echo \"empty git config user.email\"\n	exit 1\nfi\n\ngit interpret-trailers --if-exists doNothing --trailer \\\n	\"Signed-off-by: $NAME <$EMAIL>\" \\\n	--in-place \"$1\"\n\nnpx devmoji -e\n";
 //#endregion
@@ -4319,6 +4337,7 @@ async function runSetup(input) {
 	const steps = [];
 	const repo = config.repo;
 	const effectivePreset = repo?.protection;
+	const hooksEnabled = input.hooks ?? (typeof config.hooks === "boolean" ? config.hooks : typeof config.hooks === "object" ? config.hooks.prePush !== false : effectivePreset === "strict");
 	print(style.header(`Holocron setup — ${config.name}${dryRun ? " (dry-run)" : ""}`));
 	print(style.dim(`  config: ${input.loaded.filepath}`));
 	print("");
@@ -4454,21 +4473,42 @@ async function runSetup(input) {
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write .editorconfig", dryRun, async () => {
-			await source.writeRepoFile(".editorconfig", createConfig$2());
+			await source.writeRepoFile(".editorconfig", createConfig$3());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write .editorconfig-checker.json", dryRun, async () => {
-			await source.writeRepoFile(".editorconfig-checker.json", createConfig$1());
+			await source.writeRepoFile(".editorconfig-checker.json", createConfig$2());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write devmoji.config.cjs", dryRun, async () => {
-			await source.writeRepoFile("devmoji.config.cjs", createConfig$3());
+			await source.writeRepoFile("devmoji.config.cjs", createConfig$4());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write .husky/prepare-commit-msg", dryRun, async () => {
 			await source.writeRepoFile(".husky/prepare-commit-msg", createConfig());
 		}));
 		print(formatStep(steps[steps.length - 1]));
+		if (hooksEnabled) {
+			steps.push(await runStep("source", "write .husky/pre-push", dryRun, async () => {
+				await source.writeRepoFile(".husky/pre-push", createConfig$1(config.holocronScript));
+				return "runs `holocron ci` before push — bypass with `git push --no-verify`";
+			}));
+			print(formatStep(steps[steps.length - 1]));
+			if (config.syncScripts !== false) {
+				steps.push(await runStep("source", "set package.json prepare script", dryRun, async () => {
+					return await ensurePrepareScript(input.context.repoRoot) ? "prepare = \"husky\"" : "already set";
+				}));
+				print(formatStep(steps[steps.length - 1]));
+			}
+		} else {
+			steps.push({
+				capability: "source",
+				step: "write .husky/pre-push",
+				status: "skip",
+				message: "git hooks disabled"
+			});
+			print(formatStep(steps[steps.length - 1]));
+		}
 		{
 			const hasTestWorkflow = (config.tasks ?? []).map((e) => typeof e === "string" ? e : e.name).includes("test");
 			const packages = await readWorkspacePackages(input.context.repoRoot);
@@ -4480,7 +4520,7 @@ async function runSetup(input) {
 				message: "no test workflow configured"
 			});
 			else steps.push(await runStep("source", "write codecov.yml", dryRun, async () => {
-				const content = existing != null ? mergeCodecovComponents(existing, packages) : createConfig$4(packages);
+				const content = existing != null ? mergeCodecovComponents(existing, packages) : createConfig$5(packages);
 				await source.writeRepoFile("codecov.yml", content);
 				return packages.length > 0 ? `${packages.length} components` : "no components";
 			}));
@@ -4854,6 +4894,27 @@ async function runSetup(input) {
 		summary
 	};
 }
+/**
+* Ensure `package.json#scripts.prepare` is `"husky"` so git hooks register on
+* install. Merge-only: leaves every other script untouched. Returns `true` when
+* it wrote a change, `false` when already set or there is no `package.json`.
+*/
+async function ensurePrepareScript(repoRoot) {
+	const pkgPath = join(repoRoot, "package.json");
+	let content;
+	try {
+		content = await readFile(pkgPath, "utf8");
+	} catch {
+		return false;
+	}
+	const pkg = JSON.parse(content);
+	const scripts = pkg.scripts ?? {};
+	if (scripts.prepare === "husky") return false;
+	scripts.prepare = "husky";
+	pkg.scripts = scripts;
+	await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+	return true;
+}
 //#endregion
 //#region src/commands/skills.ts
 /**
@@ -6834,6 +6895,9 @@ try {
 	}).command("setup", "Apply infra setup actions across every configured capability", (y) => y.option("repo", {
 		type: "string",
 		describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
+	}).option("hooks", {
+		type: "boolean",
+		describe: "Install git hooks (.husky/pre-push → holocron ci). Default: on for protection:'strict'. --no-hooks to skip."
 	}), async (argv) => {
 		const tokens = tokenContext(argv.token);
 		if (!tokens) return;
@@ -6847,7 +6911,8 @@ try {
 				...argv.repo ? { repo: argv.repo } : {},
 				...tokens,
 				org: resolveOrg(argv, loaded.resolved)
-			}
+			},
+			...argv.hooks !== void 0 ? { hooks: argv.hooks } : {}
 		})).summary.fail > 0) process.exitCode = 1;
 	}).command("skills", "Manage agent skills from the @theholocron/skills registry", (y) => y.command("install", "Copy skills from @theholocron/skills into .agents/ with agent symlinks", () => {}, async (argv) => {
 		await runSkillsInstall({