javi-forge 1.23.0 → 1.24.0

package/assets/hooks/manifest.json

@@ -1,17 +1,21 @@
 {
 	"pre-commit": {
-		"version": 1,
-		"sha256": "811f34ce57517e129554bc9c09801a66c0207332cd3e7f2950db43a40580e914",
+		"version": 2,
+		"sha256": "6155f375647d13a8e86aff74d1b17165e0781ce8c94f9f1304724a8a54948b00",
 		"historical": [
 			{
 				"sha256": "811f34ce57517e129554bc9c09801a66c0207332cd3e7f2950db43a40580e914",
 				"firstCommit": "5587b3b9b9ed3c86809c0a3d89a850dd2bce7e1a"
+			},
+			{
+				"sha256": "6155f375647d13a8e86aff74d1b17165e0781ce8c94f9f1304724a8a54948b00",
+				"firstCommit": "0779d746b23ad614a13181d60f1fe3aa034e91dd"
 			}
 		]
 	},
 	"pre-push": {
-		"version": 2,
-		"sha256": "3dad58303d81fc513a35339083438a78aa483fcd28e3377f006bd26e8ce76a6d",
+		"version": 3,
+		"sha256": "c396387a15c3c448d524f68597a993f6b4341ae06143d2d5907ad914823d0ad0",
 		"historical": [
 			{
 				"sha256": "7de58640aeef33085a49f31f1d9d0c8bacde0069d6d3265ae41aa8d3cd14d7a5",
@@ -20,6 +24,10 @@
 			{
 				"sha256": "3dad58303d81fc513a35339083438a78aa483fcd28e3377f006bd26e8ce76a6d",
 				"firstCommit": "a35e09d39a5394d6380499d1ed73fdf22f08c829"
+			},
+			{
+				"sha256": "c396387a15c3c448d524f68597a993f6b4341ae06143d2d5907ad914823d0ad0",
+				"firstCommit": "0779d746b23ad614a13181d60f1fe3aa034e91dd"
 			}
 		]
 	},

package/assets/hooks/pre-commit

@@ -1,15 +1,16 @@
 #!/bin/bash
-# Pre-commit: quick CI check via javi-forge
+# pre-commit: javi-forge hook dispatcher
+# Runs the sections enabled under hooks: in .javi-forge/ci.yaml.
+# Default: quick native CI gate (setup + lint + compile + gates — no tests, no coverage).
+# Requires javi-forge on PATH (npx fallback; offline npx fails -> hook fails closed).
 # To skip: git commit --no-verify
 set -e
-echo "PRE-COMMIT: Running quick check..."
-if command -v javi-forge &>/dev/null; then
-  javi-forge ci --quick --no-docker --no-security --no-ci-ghagga
+if command -v javi-forge >/dev/null 2>&1; then
+  javi-forge hooks run pre-commit
 else
-  npx javi-forge ci --quick --no-docker --no-security --no-ci-ghagga
+  npx javi-forge hooks run pre-commit
 fi || {
   echo ""
-  echo "Quick check FAILED — fix the issues above before committing."
-  echo "To skip: git commit --no-verify"
+  echo "pre-commit FAILED - fix the issues above."
   exit 1
 }

package/assets/hooks/pre-push

@@ -1,37 +1,16 @@
 #!/bin/bash
-# =============================================================================
-# PRE-PUSH: Native CI checks via javi-forge
-# =============================================================================
-# Runs the quick native gate (validate + coverage) with:
-#     javi-forge ci --quick --no-docker --no-security --no-ci-ghagga
-# This is deliberately NOT the full containerized run: the native path
-# sidesteps the pre-push container EACCES failure while keeping fail-closed
-# image-gate enforcement where it belongs — the ci gate layer REFUSES any
-# blocking image gate under --no-docker (see src/commands/ci.ts runGates).
-# Requires: npm install -g javi-forge (npx fallback used when absent).
-# To skip:  git push --no-verify
-# Target:   under ~180s. Elapsed time is reported below.
-# =============================================================================
-
+# pre-push: javi-forge hook dispatcher
+# Runs the sections enabled under hooks: in .javi-forge/ci.yaml.
+# Default: quick native CI gate (setup + lint + compile + gates — no tests, no coverage).
+# Requires javi-forge on PATH (npx fallback; offline npx fails -> hook fails closed).
+# To skip: git push --no-verify
 set -e
-
-_start=$SECONDS
-
-echo "PRE-PUSH: Running native CI checks (validate + coverage)..."
 if command -v javi-forge >/dev/null 2>&1; then
-    javi-forge ci --quick --no-docker --no-security --no-ci-ghagga
+  javi-forge hooks run pre-push
 else
-    npx javi-forge ci --quick --no-docker --no-security --no-ci-ghagga
+  npx javi-forge hooks run pre-push
 fi || {
-    _elapsed=$((SECONDS - _start))
-    echo ""
-    echo "CI FAILED after ${_elapsed}s — push aborted. Fix the issues above before pushing."
-    echo "To skip: git push --no-verify"
-    exit 1
+  echo ""
+  echo "pre-push FAILED - fix the issues above."
+  exit 1
 }
-
-_elapsed=$((SECONDS - _start))
-echo "PRE-PUSH: passed in ${_elapsed}s (target: 180s)"
-if [ "$_elapsed" -gt 300 ]; then
-    echo "  WARNING: pre-push took ${_elapsed}s, well over the 180s target."
-fi

package/ci-local/README.md

@@ -174,7 +174,7 @@ Developer workflow:
 │   ├── commit-msg    # Valida mensaje sin AI attribution
 │   └── pre-push      # CI simulation en Docker
 └── docker/
-    └── *.Dockerfile  # Se generan automáticamente
+    └── *.Dockerfile  # Incluidos para cada stack (fallback: se regeneran si faltan)
 
 lib/                  # Dependencia requerida (copiar junto con .ci-local/)
 ├── common.sh         # Funciones compartidas (Bash)
@@ -193,7 +193,7 @@ Editar `lib/common.sh` (detección de stack) o `setup_ci_commands()` en `ci-loca
 
 ### Docker image custom
 
-Editar los Dockerfiles en `.ci-local/docker/` después de la primera ejecución.
+Editar los Dockerfiles en `.ci-local/docker/` (incluidos por stack).
 
 ## FAQ
 

package/ci-local/ci-local.ps1

@@ -177,7 +177,6 @@ RUN apt-get update && apt-get install -y git curl unzip && rm -rf /var/lib/apt/l
 RUN useradd -m -s /bin/bash runner
 USER runner
 WORKDIR /home/runner/work
-ENV GRADLE_USER_HOME=/home/runner/.gradle
 ENTRYPOINT ["/bin/bash", "-c"]
 '@
         }
@@ -207,8 +206,7 @@ ENTRYPOINT ["/bin/bash", "-c"]
 @'
 FROM golang:1.23-bookworm@sha256:167053a2bb901972bf2c1611f8f52c44d5fe7e762e5cab213708d82c421614db
 RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
-RUN go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.62.0 && \
-    mv /root/go/bin/golangci-lint /usr/local/bin/
+RUN go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.62.0 && mv /root/go/bin/golangci-lint /usr/local/bin/
 RUN useradd -m -s /bin/bash runner
 USER runner
 WORKDIR /home/runner/work

package/ci-local/ci-local.sh

@@ -174,7 +174,6 @@ RUN apt-get update && apt-get install -y git curl unzip && rm -rf /var/lib/apt/l
 RUN useradd -m -s /bin/bash runner
 USER runner
 WORKDIR /home/runner/work
-ENV GRADLE_USER_HOME=/home/runner/.gradle
 ENTRYPOINT ["/bin/bash", "-c"]
 DOCKERFILE
             ;;
@@ -204,8 +203,7 @@ DOCKERFILE
             cat > "$docker_dir/$DOCKERFILE" << 'DOCKERFILE'
 FROM golang:1.23-bookworm@sha256:167053a2bb901972bf2c1611f8f52c44d5fe7e762e5cab213708d82c421614db
 RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
-RUN go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.62.0 && \
-    mv /root/go/bin/golangci-lint /usr/local/bin/
+RUN go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.62.0 && mv /root/go/bin/golangci-lint /usr/local/bin/
 RUN useradd -m -s /bin/bash runner
 USER runner
 WORKDIR /home/runner/work

package/ci-local/docker/elixir.Dockerfile

@@ -0,0 +1,6 @@
+FROM ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b
+RUN apt-get update && apt-get install -y git curl && rm -rf /var/lib/apt/lists/*
+RUN useradd -m -s /bin/bash runner
+USER runner
+WORKDIR /home/runner/work
+ENTRYPOINT ["/bin/bash", "-c"]

package/ci-local/docker/go.Dockerfile

@@ -0,0 +1,7 @@
+FROM golang:1.23-bookworm@sha256:167053a2bb901972bf2c1611f8f52c44d5fe7e762e5cab213708d82c421614db
+RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+RUN go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.62.0 && mv /root/go/bin/golangci-lint /usr/local/bin/
+RUN useradd -m -s /bin/bash runner
+USER runner
+WORKDIR /home/runner/work
+ENTRYPOINT ["/bin/bash", "-c"]

package/ci-local/docker/java-gradle.Dockerfile

@@ -0,0 +1,7 @@
+ARG JAVA_VERSION=21
+FROM eclipse-temurin:${JAVA_VERSION}-jdk-noble
+RUN apt-get update && apt-get install -y git curl unzip && rm -rf /var/lib/apt/lists/*
+RUN useradd -m -s /bin/bash runner
+USER runner
+WORKDIR /home/runner/work
+ENTRYPOINT ["/bin/bash", "-c"]

package/ci-local/docker/java-maven.Dockerfile

@@ -0,0 +1,7 @@
+ARG JAVA_VERSION=21
+FROM eclipse-temurin:${JAVA_VERSION}-jdk-noble
+RUN apt-get update && apt-get install -y git curl unzip && rm -rf /var/lib/apt/lists/*
+RUN useradd -m -s /bin/bash runner
+USER runner
+WORKDIR /home/runner/work
+ENTRYPOINT ["/bin/bash", "-c"]

package/ci-local/docker/java.Dockerfile

@@ -0,0 +1,7 @@
+ARG JAVA_VERSION=21
+FROM eclipse-temurin:${JAVA_VERSION}-jdk-noble
+RUN apt-get update && apt-get install -y git curl unzip && rm -rf /var/lib/apt/lists/*
+RUN useradd -m -s /bin/bash runner
+USER runner
+WORKDIR /home/runner/work
+ENTRYPOINT ["/bin/bash", "-c"]

package/ci-local/docker/python.Dockerfile

@@ -0,0 +1,7 @@
+FROM python:3.12-slim@sha256:401f6e1a67dad31a1bd78e9ad22d0ee0a3b52154e6bd30e90be696bb6a3d7461
+RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+RUN pip install --no-cache-dir pytest ruff pylint poetry
+RUN useradd -m -s /bin/bash runner
+USER runner
+WORKDIR /home/runner/work
+ENTRYPOINT ["/bin/bash", "-c"]

package/ci-local/docker/rust.Dockerfile

@@ -0,0 +1,7 @@
+FROM rust:1.83-slim@sha256:540c902e99c384163b688bbd8b5b8520e94e7731b27f7bd0eaa56ae1960627ab
+RUN apt-get update && apt-get install -y git pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*
+RUN rustup component add clippy rustfmt
+RUN useradd -m -s /bin/bash runner
+USER runner
+WORKDIR /home/runner/work
+ENTRYPOINT ["/bin/bash", "-c"]

package/dist/lib/docker.js

@@ -38,6 +38,14 @@ export function getDockerfileContent(stack) {
                 "RUN apt-get update && apt-get install -y git curl unzip && rm -rf /var/lib/apt/lists/*",
                 "RUN useradd -m -s /bin/bash runner",
                 "USER runner",
+                // No GRADLE_USER_HOME override (audit R4-001): on noble the
+                // `ubuntu` user owns uid 1000, so `useradd -m runner` lands at
+                // uid 1001 and /home/runner is 0750 runner:runner. Pinning
+                // GRADLE_USER_HOME=/home/runner/.gradle hard-fails the TS
+                // runtime path, which runs as the HOST uid (ENV-1, typically
+                // 1000) and cannot create that dir. Without the env both paths
+                // work off $HOME: shell path (--user runner) → /home/runner;
+                // host-uid path → getpwuid(1000) → /home/ubuntu.
                 "WORKDIR /home/runner/work",
                 'ENTRYPOINT ["/bin/bash", "-c"]',
             ].join("\n");
@@ -143,10 +151,22 @@ export async function ensureImage(options) {
             path.join(path.dirname(fileURLToPath(import.meta.url)), "../../ci-local/docker");
         dockerfilePath = path.join(dockerDir, `${stack}.Dockerfile`);
         contextDir = dockerDir;
-        // Write Dockerfile if it doesn't exist yet (first run)
         if (!(await fs.pathExists(dockerfilePath))) {
-            await fs.ensureDir(dockerDir);
-            await fs.writeFile(dockerfilePath, getDockerfileContent(stack), "utf-8");
+            if (dockerfilesDir) {
+                // Caller-provided generation dir (dev / project-local flow):
+                // first-run generation is expected — write the canonical content.
+                await fs.ensureDir(dockerDir);
+                await fs.writeFile(dockerfilePath, getDockerfileContent(stack), "utf-8");
+            }
+            else {
+                // PKG-002: the package bundles a Dockerfile for EVERY stack, so a
+                // miss here means a corrupted/incomplete install. Writing into the
+                // install dir would EACCES on root-owned global installs and mask
+                // the real problem — fail closed with a clear message instead.
+                throw new Error(`bundled Dockerfile "${stack}.Dockerfile" is missing from ` +
+                    `"${dockerDir}" — the javi-forge installation looks corrupted; ` +
+                    "reinstall the package (or pass an explicit dockerfilesDir)");
+            }
         }
     }
     // Staleness check: compare Dockerfile hash with the one embedded in the image label

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.23.0",
+	"version": "1.24.0",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {