entropy-machines 0.1.1

package/lib/install-hooks.sh

@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+# install-hooks — put a shim in the repo's hooks directory that runs the
+# harness's checked-in hooks in hooks/.
+#
+#   lib/install-hooks.sh        (run with cwd anywhere inside the repo)
+#
+# ONE ROOT. The harness is vendored as plain tracked files inside the repo it
+# works on, so the hook bodies and the .git being written into are in the SAME
+# repository. There is no second repo to reconcile. Two paths still matter and
+# they are not the same directory:
+#
+#   ENTROPY_MACHINES_HOME   where hooks/ and lib/ actually are — the harness directory,
+#                  which may be the repo root or a subdirectory of it. Resolved
+#                  from this script's OWN path.
+#   ENTROPY_MACHINES_ROOT   the repo's MAIN checkout, resolved via --git-common-dir so
+#                  it is right even when this is run from a linked worktree
+#                  (see lib/roots.sh).
+#
+# It does NOT set core.hooksPath. A repo may already have it set, that setting
+# is shared by every worktree, and rewriting it from a script would change hook
+# resolution for whatever else is running in a sibling worktree at the time.
+# Instead we write into whatever directory git currently resolves — `git
+# rev-parse --git-path hooks` honours core.hooksPath if it is set and falls
+# back to the common .git/hooks if it is not.
+#
+# THE SHIM CARRIES ONE PATH BAKED IN, ABSOLUTE, AT INSTALL TIME: ENTROPY_MACHINES_HOME.
+# An installed shim lives inside .git/hooks and can no longer assume a hooks/
+# directory sits beside it, so it cannot find the harness relatively. It does
+# NOT bake the root: git guarantees a hook's cwd is a working tree of this
+# repo, so lib/roots.sh resolves the root correctly at hook time and a baked
+# copy could only ever go stale. The shim delegates to the WORKING-TREE copy of
+# the hook body (not a frozen copy of its contents), so it never needs
+# reinstalling when a hook's body changes — only when the harness MOVES.
+#
+# It VERIFIES afterwards, and says so. A setting that is quietly ignored is a
+# failure this project has already paid for once. An installer that prints
+# "installed" without checking is the same bug in a different costume. That is
+# also why it checks that the shim's BAKED-IN path actually resolves: a shim
+# that installs cleanly and points at a harness directory that does not exist
+# is "installed, verified, dead".
+
+set -euo pipefail
+
+. "$(dirname "$0")/roots.sh"
+
+ENTROPY_MACHINES_HOME=$(entropy_machines_home "$0")
+entropy_machines_require_root install-hooks   # sets+exports ENTROPY_MACHINES_ROOT or exits 2
+
+# cd to the main checkout so `git rev-parse --git-path hooks` below resolves
+# unambiguously no matter which subdirectory (or worktree) this was run from.
+cd "$ENTROPY_MACHINES_ROOT"
+
+HOOK_DIR="$(git rev-parse --git-path hooks)"
+case "$HOOK_DIR" in
+  /*) ;;
+  *) HOOK_DIR="$ENTROPY_MACHINES_ROOT/$HOOK_DIR" ;;
+esac
+
+mkdir -p "$HOOK_DIR"
+
+installed=0
+for src in "$ENTROPY_MACHINES_HOME"/hooks/*; do
+  [ -f "$src" ] || continue
+  name="$(basename "$src")"
+  dest="$HOOK_DIR/$name"
+  # Deliberately UNQUOTED heredoc delimiter: $ENTROPY_MACHINES_HOME must expand NOW,
+  # baked into the generated file. $0, $@ and the nested $(basename ...) are
+  # backslash-escaped so they survive into the shim literally and are
+  # evaluated at THAT script's run time, against the real hook path git
+  # passes it.
+  cat > "$dest" <<SHIM
+#!/usr/bin/env bash
+# Generated by lib/install-hooks.sh — do not edit.
+#
+# ENTROPY_MACHINES_HOME is baked in below, ABSOLUTE, because this file lives inside
+# .git/hooks and cannot assume a hooks/ or lib/ directory sits beside it (the
+# harness may be vendored in a subdirectory). Re-run lib/install-hooks.sh if
+# the harness moves. The repo root is NOT baked in — git guarantees a hook's
+# cwd is a working tree of this repo, so lib/roots.sh resolves it live.
+#
+# It delegates to the WORKING-TREE copy of hooks/$name in the harness, so
+# editing that file's body never requires reinstalling this shim.
+export ENTROPY_MACHINES_HOME="$ENTROPY_MACHINES_HOME"
+set -euo pipefail
+HOOK="\$ENTROPY_MACHINES_HOME/hooks/\$(basename "\$0")"
+[ -x "\$HOOK" ] || exit 0
+exec "\$HOOK" "\$@"
+SHIM
+  chmod +x "$dest"
+  installed=$((installed + 1))
+done
+
+echo "install-hooks: wrote $installed shim(s) to $HOOK_DIR"
+echo "install-hooks: harness (ENTROPY_MACHINES_HOME) = $ENTROPY_MACHINES_HOME"
+echo "install-hooks: repo    (ENTROPY_MACHINES_ROOT) = $ENTROPY_MACHINES_ROOT"
+
+# --- verify, don't assume ---------------------------------------------------
+fail=0
+for src in "$ENTROPY_MACHINES_HOME"/hooks/*; do
+  [ -f "$src" ] || continue
+  name="$(basename "$src")"
+  if [ ! -x "$src" ]; then
+    echo "install-hooks: FAIL $ENTROPY_MACHINES_HOME/hooks/$name is not executable (chmod +x it and commit the mode)." >&2
+    fail=1
+  fi
+  if [ ! -x "$HOOK_DIR/$name" ]; then
+    echo "install-hooks: FAIL $HOOK_DIR/$name is missing or not executable." >&2
+    fail=1
+  fi
+
+  # Prove the INSTALLED FILE'S OWN baked-in path resolves, by reading it back
+  # off disk rather than trusting the variables still in memory from the write
+  # above. This catches a shim that installs cleanly, passes both checks
+  # above, and still points at a harness directory that does not exist (a
+  # stale install after the harness moved, or a shim copied between machines).
+  baked="$(sed -n 's/^export ENTROPY_MACHINES_HOME="\(.*\)"$/\1/p' "$HOOK_DIR/$name" 2>/dev/null | head -1)"
+  if [ -z "$baked" ]; then
+    echo "install-hooks: FAIL $HOOK_DIR/$name has no baked-in ENTROPY_MACHINES_HOME — cannot verify it resolves." >&2
+    fail=1
+  elif [ ! -x "$baked/hooks/$name" ]; then
+    echo "install-hooks: FAIL $HOOK_DIR/$name points at $baked/hooks/$name, which is missing or not executable." >&2
+    fail=1
+  fi
+done
+
+if [ "$fail" -ne 0 ]; then
+  exit 1
+fi
+
+echo "install-hooks: verified. Hooks resolve to $HOOK_DIR and each shim's"
+echo "               baked-in harness path resolves to an executable hook."
+
+# --- post-checkout needs a SHARED hooks dir, so check it is one -------------
+#
+# The checks above prove the shim exists, is executable, and its baked-in
+# harness path resolves. For post-checkout that is not enough to prove it will
+# ever RUN, because it has to fire inside a worktree that does not exist yet.
+#
+# git resolves hooks from core.hooksPath when it is set, and from
+# $GIT_COMMON_DIR/hooks when it is not. Both are shared by every worktree — but
+# only if core.hooksPath is ABSOLUTE. Set to a relative path, git resolves it
+# against each working tree's own root, so a brand-new worktree would look in
+# its own empty directory and post-checkout would silently never fire. The
+# install would still print "verified": installed, checked, dead.
+#
+# Not a hard failure: commit-msg and pre-commit install correctly in that
+# setup, and refusing the whole install to complain about one hook would be
+# worse than saying so loudly.
+if [ -f "$ENTROPY_MACHINES_HOME/hooks/post-checkout" ]; then
+  configured="$(git config --get core.hooksPath || true)"
+  if [ -n "$configured" ]; then
+    case "$configured" in
+      /*) ;;
+      *)
+        echo "install-hooks: WARNING — core.hooksPath is set to a RELATIVE path" >&2
+        echo "               ('$configured'). git resolves that against each working" >&2
+        echo "               tree's own root, so a new worktree will look in its own" >&2
+        echo "               empty directory and the post-checkout hook will NOT fire" >&2
+        echo "               for 'git worktree add'. worktree.linkPaths" >&2
+        echo "               will not be linked. Fix: set it to an absolute path," >&2
+        echo "               or unset it so hooks come from the shared .git/hooks." >&2
+        ;;
+    esac
+  fi
+fi
+
+echo "install-hooks: note — hooks are per-clone and per-worktree. Anyone who"
+echo "               never runs this has no hook; a CI job is the enforcement"
+echo "               that lives in the repo."