@windyroad/risk-scorer 0.1.4-preview.26 → 0.1.4

package/hooks/git-push-gate.sh

@@ -110,7 +110,16 @@ fi
 
 # Match gh pr merge. Should go via npm run release:watch instead.
 if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*gh pr merge(\s|$)'; then
-    risk_gate_deny "Use \`npm run release:watch\` instead of \`gh pr merge\`. It merges the release PR, watches the publish pipeline, and surfaces the production URL when live -- or tells you what failed and how to fix it."
+    # Check if the project has a release:watch script
+    if [ -f "package.json" ] && python3 -c "
+import json, sys
+pkg = json.load(open('package.json'))
+sys.exit(0 if 'release:watch' in pkg.get('scripts', {}) else 1)
+" 2>/dev/null; then
+        risk_gate_deny "Use \`npm run release:watch\` instead of \`gh pr merge\`. It merges the release PR, watches the publish pipeline, and surfaces the production URL when live -- or tells you what failed and how to fix it."
+    else
+        risk_gate_deny "Direct \`gh pr merge\` is blocked (no release:watch script found). Create a release:watch npm script that: (1) finds and merges the release PR with \`gh pr merge\`, (2) waits for the CI workflow with \`gh run list\`, and (3) watches it with \`gh run watch --exit-status\`. Then run \`npm run release:watch\` to release."
+    fi
     exit 0
 fi
 

package/hooks/test/git-push-gate.bats

@@ -0,0 +1,82 @@
+#!/usr/bin/env bats
+# Tests for git-push-gate.sh — gh pr merge block and release:watch guidance
+
+setup() {
+  HOOKS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
+  HOOK="$HOOKS_DIR/git-push-gate.sh"
+
+  TEST_SESSION="bats-push-gate-$$-${BATS_TEST_NUMBER}"
+  # Ensure a clean risk dir
+  RDIR="${TMPDIR:-/tmp}/claude-risk-${TEST_SESSION}"
+  rm -rf "$RDIR"
+  mkdir -p "$RDIR"
+
+  # Create a temp project dir for package.json detection
+  TEST_PROJECT_DIR="$(mktemp -d)"
+}
+
+teardown() {
+  rm -rf "$RDIR"
+  rm -rf "$TEST_PROJECT_DIR"
+}
+
+# Helper: build a PreToolUse Bash input with a given command
+build_input() {
+  local cmd="$1"
+  cat <<ENDJSON
+{
+  "session_id": "$TEST_SESSION",
+  "tool_name": "Bash",
+  "tool_input": {
+    "command": "$cmd"
+  }
+}
+ENDJSON
+}
+
+@test "gh pr merge is blocked with release:watch guidance when script exists" {
+  # Create a package.json with release:watch
+  cat > "$TEST_PROJECT_DIR/package.json" <<'PKG'
+{ "scripts": { "release:watch": "bash scripts/release-watch.sh" } }
+PKG
+
+  INPUT=$(build_input "gh pr merge 4 --merge")
+  run bash -c "cd '$TEST_PROJECT_DIR' && echo '$INPUT' | '$HOOK'"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"permissionDecision"* ]]
+  [[ "$output" == *"deny"* ]]
+  [[ "$output" == *"release:watch"* ]]
+}
+
+@test "gh pr merge tells agent to create release:watch when script missing" {
+  # Create a package.json WITHOUT release:watch
+  cat > "$TEST_PROJECT_DIR/package.json" <<'PKG'
+{ "scripts": { "test": "echo test" } }
+PKG
+
+  INPUT=$(build_input "gh pr merge 4 --merge")
+  run bash -c "cd '$TEST_PROJECT_DIR' && echo '$INPUT' | '$HOOK'"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"permissionDecision"* ]]
+  [[ "$output" == *"deny"* ]]
+  # Should tell agent to create the script
+  [[ "$output" == *"no release:watch script"* ]]
+  [[ "$output" == *"gh pr merge"* ]]
+  [[ "$output" == *"gh run watch"* ]]
+}
+
+@test "gh pr merge tells agent to create release:watch when no package.json" {
+  local empty_dir="$(mktemp -d)"
+
+  INPUT=$(build_input "gh pr merge 4 --merge")
+  run bash -c "cd '$empty_dir' && echo '$INPUT' | '$HOOK'"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"permissionDecision"* ]]
+  [[ "$output" == *"deny"* ]]
+  # Should tell agent to create the script
+  [[ "$output" == *"no release:watch script"* ]]
+  [[ "$output" == *"gh pr merge"* ]]
+  [[ "$output" == *"gh run watch"* ]]
+
+  rm -rf "$empty_dir"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.1.4-preview.26",
+  "version": "0.1.4",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "bin": {
     "windyroad-risk-scorer": "./bin/install.mjs"