@windyroad/risk-scorer 0.19.6 → 0.19.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/hooks/git-push-gate.sh
CHANGED
|
@@ -1,7 +1,8 @@
|
|
|
1
1
|
#!/bin/bash
|
|
2
2
|
# PreToolUse hook for pipeline discipline:
|
|
3
3
|
# - Blocks bare `git push` and directs to npm run push:watch.
|
|
4
|
-
# - Gates `npm run push:watch` on push risk score
|
|
4
|
+
# - Gates `npm run push:watch` and `npm run merge:watch` on push risk score
|
|
5
|
+
# (TTL + drift + threshold), while letting those watchers wait on pending CI.
|
|
5
6
|
# - Gates `npx changeset` / `npm run changeset` on release + push risk (back-pressure).
|
|
6
7
|
# - Gates `npm run release:watch` on release risk score (TTL + drift + threshold).
|
|
7
8
|
# - Blocks `gh pr merge` of the changeset release PR and directs to
|
|
@@ -21,7 +22,13 @@ TOOL_NAME=$(_get_tool_name)
|
|
|
21
22
|
COMMAND=$(_get_command)
|
|
22
23
|
SESSION_ID=$(_get_session_id)
|
|
23
24
|
|
|
24
|
-
|
|
25
|
+
_watchers_own_ci_wait() {
|
|
26
|
+
[ -f package.json ] && node -e \
|
|
27
|
+
'const p = require(process.argv[1]); process.exit(p.windyroadRiskScorer?.watchersOwnCiWait === true ? 0 : 1)' \
|
|
28
|
+
"$PWD/package.json" 2>/dev/null
|
|
29
|
+
}
|
|
30
|
+
|
|
31
|
+
if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*(git push|npm run (push:watch|merge:watch|release:watch)|npx changeset|npm run changeset|gh pr merge)(\s|$)'; then
|
|
25
32
|
if ! _enter_hook_cwd; then
|
|
26
33
|
risk_gate_deny "Pipeline action blocked: the command checkout could not be validated. Run the command from an absolute Git working directory and rescore that checkout."
|
|
27
34
|
exit 0
|
|
@@ -40,8 +47,10 @@ if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*git push(\s|$)'; then
|
|
|
40
47
|
exit 0
|
|
41
48
|
fi
|
|
42
49
|
|
|
43
|
-
# Gate push
|
|
44
|
-
|
|
50
|
+
# Gate wait-capable push commands on push risk score (inherits three-band TTL
|
|
51
|
+
# via check_risk_gate, P090). A pending run is theirs to wait for; red or
|
|
52
|
+
# unreadable CI remains fail-closed.
|
|
53
|
+
if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*npm run (push:watch|merge:watch)(\s|$)'; then
|
|
45
54
|
if [ -n "$SESSION_ID" ]; then
|
|
46
55
|
RDIR=$(_risk_dir "$SESSION_ID")
|
|
47
56
|
# Risk-reducing/neutral bypass for push — session-scoped, drift-
|
|
@@ -77,8 +86,15 @@ if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*npm run push:watch(\s|$)'; then
|
|
|
77
86
|
# one-shot bypass markers and BEFORE the predicted-risk gate so
|
|
78
87
|
# incident workflows and clean-tree pushes are unaffected.
|
|
79
88
|
if ! check_ci_status "$SESSION_ID" "push"; then
|
|
80
|
-
|
|
81
|
-
|
|
89
|
+
if [ "$CI_GATE_CATEGORY" = "pending" ] && _watchers_own_ci_wait; then
|
|
90
|
+
:
|
|
91
|
+
elif [ "$CI_GATE_CATEGORY" = "pending" ]; then
|
|
92
|
+
risk_gate_deny "Push blocked: ${CI_GATE_REASON} This project has not declared wait-capable watchers with windyroadRiskScorer.watchersOwnCiWait=true."
|
|
93
|
+
exit 0
|
|
94
|
+
else
|
|
95
|
+
risk_gate_deny "Push blocked: ${CI_GATE_REASON}"
|
|
96
|
+
exit 0
|
|
97
|
+
fi
|
|
82
98
|
fi
|
|
83
99
|
if ! check_risk_gate "$SESSION_ID" "push"; then
|
|
84
100
|
if [ "$RISK_GATE_CATEGORY" = "threshold" ]; then
|
package/package.json
CHANGED