javi-forge 1.37.0 → 1.37.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/assets/hooks/manifest.json +6 -2
- package/assets/hooks/pre-push +206 -8
- package/package.json +1 -1
|
@@ -14,8 +14,8 @@
|
|
|
14
14
|
]
|
|
15
15
|
},
|
|
16
16
|
"pre-push": {
|
|
17
|
-
"version":
|
|
18
|
-
"sha256": "
|
|
17
|
+
"version": 4,
|
|
18
|
+
"sha256": "ffe1b5dd0931617df3c9fea37947dac84dffd11c490c39590459e861b404148d",
|
|
19
19
|
"historical": [
|
|
20
20
|
{
|
|
21
21
|
"sha256": "7de58640aeef33085a49f31f1d9d0c8bacde0069d6d3265ae41aa8d3cd14d7a5",
|
|
@@ -28,6 +28,10 @@
|
|
|
28
28
|
{
|
|
29
29
|
"sha256": "c396387a15c3c448d524f68597a993f6b4341ae06143d2d5907ad914823d0ad0",
|
|
30
30
|
"firstCommit": "0779d746b23ad614a13181d60f1fe3aa034e91dd"
|
|
31
|
+
},
|
|
32
|
+
{
|
|
33
|
+
"sha256": "ffe1b5dd0931617df3c9fea37947dac84dffd11c490c39590459e861b404148d",
|
|
34
|
+
"firstCommit": "6b5799d9d9e8c528fad9dc1f7b641afbd3a60637"
|
|
31
35
|
}
|
|
32
36
|
]
|
|
33
37
|
},
|
package/assets/hooks/pre-push
CHANGED
|
@@ -4,13 +4,211 @@
|
|
|
4
4
|
# Default: quick native CI gate (setup + lint + compile + gates — no tests, no coverage).
|
|
5
5
|
# Requires javi-forge on PATH (npx fallback; offline npx fails -> hook fails closed).
|
|
6
6
|
# To skip: git push --no-verify
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
else
|
|
11
|
-
npx javi-forge hooks run pre-push
|
|
12
|
-
fi || {
|
|
7
|
+
fail_pre_push() {
|
|
8
|
+
message=$1
|
|
9
|
+
status=${2:-1}
|
|
13
10
|
echo ""
|
|
14
|
-
echo "pre-push FAILED -
|
|
15
|
-
exit
|
|
11
|
+
echo "pre-push FAILED - $message"
|
|
12
|
+
exit "$status"
|
|
13
|
+
}
|
|
14
|
+
|
|
15
|
+
hash_required_file() {
|
|
16
|
+
target=$1
|
|
17
|
+
if [ -L "$target" ] || [ ! -f "$target" ]; then
|
|
18
|
+
return 1
|
|
19
|
+
fi
|
|
20
|
+
git hash-object --no-filters "$target"
|
|
21
|
+
}
|
|
22
|
+
|
|
23
|
+
hash_optional_file() {
|
|
24
|
+
target=$1
|
|
25
|
+
if [ -L "$target" ]; then
|
|
26
|
+
return 1
|
|
27
|
+
fi
|
|
28
|
+
if [ -f "$target" ]; then
|
|
29
|
+
git hash-object --no-filters "$target"
|
|
30
|
+
return $?
|
|
31
|
+
fi
|
|
32
|
+
if [ -e "$target" ]; then
|
|
33
|
+
return 1
|
|
34
|
+
fi
|
|
35
|
+
printf '%s\n' absent
|
|
16
36
|
}
|
|
37
|
+
|
|
38
|
+
# Git exports repository-local targeting variables to hooks. Preserve every
|
|
39
|
+
# path needed for this repository before clearing the complete Git-owned set.
|
|
40
|
+
if ! repository_root=$(git rev-parse --show-toplevel) || [ -z "$repository_root" ]; then
|
|
41
|
+
fail_pre_push "Could not resolve the repository root."
|
|
42
|
+
fi
|
|
43
|
+
if ! cd "$repository_root"; then
|
|
44
|
+
fail_pre_push "Could not return to the repository root."
|
|
45
|
+
fi
|
|
46
|
+
if ! git_dir=$(git rev-parse --absolute-git-dir) || [ -z "$git_dir" ]; then
|
|
47
|
+
fail_pre_push "Could not resolve the worktree Git directory."
|
|
48
|
+
fi
|
|
49
|
+
if ! common_dir=$(git rev-parse --path-format=absolute --git-common-dir) || [ -z "$common_dir" ]; then
|
|
50
|
+
fail_pre_push "Could not resolve the common Git directory."
|
|
51
|
+
fi
|
|
52
|
+
if ! index_path=$(git rev-parse --path-format=absolute --git-path index) || [ -z "$index_path" ]; then
|
|
53
|
+
fail_pre_push "Could not resolve the worktree index."
|
|
54
|
+
fi
|
|
55
|
+
if ! worktree_config_path=$(git rev-parse --path-format=absolute --git-path config.worktree) || [ -z "$worktree_config_path" ]; then
|
|
56
|
+
fail_pre_push "Could not resolve the worktree-local Git config."
|
|
57
|
+
fi
|
|
58
|
+
|
|
59
|
+
if ! git_local_env_vars=$(git rev-parse --local-env-vars); then
|
|
60
|
+
fail_pre_push "Could not discover Git-local environment variables."
|
|
61
|
+
fi
|
|
62
|
+
|
|
63
|
+
git_local_env_count=0
|
|
64
|
+
invalid_git_local_env_var=
|
|
65
|
+
saved_ifs=$IFS
|
|
66
|
+
IFS='
|
|
67
|
+
'
|
|
68
|
+
for git_local_env_var in $git_local_env_vars; do
|
|
69
|
+
git_local_env_count=$((git_local_env_count + 1))
|
|
70
|
+
case "$git_local_env_var" in
|
|
71
|
+
GIT_*) ;;
|
|
72
|
+
*) invalid_git_local_env_var=$git_local_env_var ;;
|
|
73
|
+
esac
|
|
74
|
+
case "$git_local_env_var" in
|
|
75
|
+
*[!A-Za-z0-9_]*) invalid_git_local_env_var=$git_local_env_var ;;
|
|
76
|
+
esac
|
|
77
|
+
if [ -n "$invalid_git_local_env_var" ]; then
|
|
78
|
+
break
|
|
79
|
+
fi
|
|
80
|
+
done
|
|
81
|
+
IFS=$saved_ifs
|
|
82
|
+
|
|
83
|
+
if [ "$git_local_env_count" -eq 0 ]; then
|
|
84
|
+
fail_pre_push "Git returned no Git-local environment variables."
|
|
85
|
+
fi
|
|
86
|
+
if [ -n "$invalid_git_local_env_var" ]; then
|
|
87
|
+
fail_pre_push "Invalid Git-local environment variable name: $invalid_git_local_env_var"
|
|
88
|
+
fi
|
|
89
|
+
|
|
90
|
+
# A bounded canary protects the metadata proven vulnerable in the incident.
|
|
91
|
+
common_config_path="$common_dir/config"
|
|
92
|
+
head_path="$git_dir/HEAD"
|
|
93
|
+
packed_refs_path="$common_dir/packed-refs"
|
|
94
|
+
|
|
95
|
+
if ! common_config_before=$(hash_required_file "$common_config_path"); then
|
|
96
|
+
fail_pre_push "Could not snapshot the common Git config."
|
|
97
|
+
fi
|
|
98
|
+
if ! head_before=$(hash_required_file "$head_path"); then
|
|
99
|
+
fail_pre_push "Could not snapshot HEAD."
|
|
100
|
+
fi
|
|
101
|
+
if ! index_before=$(hash_required_file "$index_path"); then
|
|
102
|
+
fail_pre_push "Could not snapshot the worktree index."
|
|
103
|
+
fi
|
|
104
|
+
if ! worktree_config_before=$(hash_optional_file "$worktree_config_path"); then
|
|
105
|
+
fail_pre_push "Could not snapshot the worktree-local Git config."
|
|
106
|
+
fi
|
|
107
|
+
if ! packed_refs_before=$(hash_optional_file "$packed_refs_path"); then
|
|
108
|
+
fail_pre_push "Could not snapshot packed refs."
|
|
109
|
+
fi
|
|
110
|
+
|
|
111
|
+
attached_ref=
|
|
112
|
+
ref_path=
|
|
113
|
+
ref_before=detached
|
|
114
|
+
if attached_ref=$(git symbolic-ref -q HEAD); then
|
|
115
|
+
if ! ref_path=$(git rev-parse --path-format=absolute --git-path "$attached_ref") || [ -z "$ref_path" ]; then
|
|
116
|
+
fail_pre_push "Could not resolve the attached HEAD ref."
|
|
117
|
+
fi
|
|
118
|
+
if ! ref_before=$(hash_optional_file "$ref_path"); then
|
|
119
|
+
fail_pre_push "Could not snapshot the attached HEAD ref."
|
|
120
|
+
fi
|
|
121
|
+
if ! ref_oid_before=$(git rev-parse --verify "$attached_ref"); then
|
|
122
|
+
fail_pre_push "Could not resolve the attached HEAD ref value."
|
|
123
|
+
fi
|
|
124
|
+
else
|
|
125
|
+
symbolic_ref_status=$?
|
|
126
|
+
if [ "$symbolic_ref_status" -ne 1 ]; then
|
|
127
|
+
fail_pre_push "Could not determine whether HEAD is attached."
|
|
128
|
+
fi
|
|
129
|
+
if ! ref_oid_before=$(git rev-parse --verify HEAD); then
|
|
130
|
+
fail_pre_push "Could not resolve detached HEAD."
|
|
131
|
+
fi
|
|
132
|
+
fi
|
|
133
|
+
|
|
134
|
+
# The scrub lives in a subshell: the hook retains its own targeting context for
|
|
135
|
+
# the post-test canary, while the dispatcher and every descendant start clean.
|
|
136
|
+
if (
|
|
137
|
+
scrub_ifs=$IFS
|
|
138
|
+
IFS='
|
|
139
|
+
'
|
|
140
|
+
for git_local_env_var in $git_local_env_vars; do
|
|
141
|
+
if ! unset "$git_local_env_var"; then
|
|
142
|
+
echo "pre-push: could not unset $git_local_env_var"
|
|
143
|
+
exit 1
|
|
144
|
+
fi
|
|
145
|
+
if declare -p "$git_local_env_var" >/dev/null 2>&1; then
|
|
146
|
+
echo "pre-push: $git_local_env_var remained set after unset"
|
|
147
|
+
exit 1
|
|
148
|
+
fi
|
|
149
|
+
done
|
|
150
|
+
IFS=$scrub_ifs
|
|
151
|
+
|
|
152
|
+
if ! cd "$repository_root"; then
|
|
153
|
+
echo "pre-push: could not return to the repository root after scrubbing"
|
|
154
|
+
exit 1
|
|
155
|
+
fi
|
|
156
|
+
|
|
157
|
+
if command -v javi-forge >/dev/null 2>&1; then
|
|
158
|
+
javi-forge hooks run pre-push
|
|
159
|
+
else
|
|
160
|
+
npx javi-forge hooks run pre-push
|
|
161
|
+
fi
|
|
162
|
+
); then
|
|
163
|
+
test_status=0
|
|
164
|
+
else
|
|
165
|
+
test_status=$?
|
|
166
|
+
fi
|
|
167
|
+
|
|
168
|
+
if ! cd "$repository_root"; then
|
|
169
|
+
fail_pre_push "Could not return to the repository root after tests."
|
|
170
|
+
fi
|
|
171
|
+
|
|
172
|
+
if ! common_config_after=$(hash_required_file "$common_config_path"); then
|
|
173
|
+
fail_pre_push "Could not verify the common Git config after tests."
|
|
174
|
+
fi
|
|
175
|
+
if ! head_after=$(hash_required_file "$head_path"); then
|
|
176
|
+
fail_pre_push "Could not verify HEAD after tests."
|
|
177
|
+
fi
|
|
178
|
+
if ! index_after=$(hash_required_file "$index_path"); then
|
|
179
|
+
fail_pre_push "Could not verify the worktree index after tests."
|
|
180
|
+
fi
|
|
181
|
+
if ! worktree_config_after=$(hash_optional_file "$worktree_config_path"); then
|
|
182
|
+
fail_pre_push "Could not verify the worktree-local Git config after tests."
|
|
183
|
+
fi
|
|
184
|
+
if ! packed_refs_after=$(hash_optional_file "$packed_refs_path"); then
|
|
185
|
+
fail_pre_push "Could not verify packed refs after tests."
|
|
186
|
+
fi
|
|
187
|
+
|
|
188
|
+
ref_after=detached
|
|
189
|
+
if [ -n "$attached_ref" ]; then
|
|
190
|
+
if ! ref_after=$(hash_optional_file "$ref_path"); then
|
|
191
|
+
fail_pre_push "Could not verify the attached HEAD ref after tests."
|
|
192
|
+
fi
|
|
193
|
+
if ! ref_oid_after=$(git rev-parse --verify "$attached_ref"); then
|
|
194
|
+
fail_pre_push "Could not resolve the attached HEAD ref value after tests."
|
|
195
|
+
fi
|
|
196
|
+
else
|
|
197
|
+
if ! ref_oid_after=$(git rev-parse --verify HEAD); then
|
|
198
|
+
fail_pre_push "Could not resolve detached HEAD after tests."
|
|
199
|
+
fi
|
|
200
|
+
fi
|
|
201
|
+
|
|
202
|
+
if [ "$common_config_before" != "$common_config_after" ] ||
|
|
203
|
+
[ "$head_before" != "$head_after" ] ||
|
|
204
|
+
[ "$index_before" != "$index_after" ] ||
|
|
205
|
+
[ "$worktree_config_before" != "$worktree_config_after" ] ||
|
|
206
|
+
[ "$packed_refs_before" != "$packed_refs_after" ] ||
|
|
207
|
+
[ "$ref_before" != "$ref_after" ] ||
|
|
208
|
+
[ "$ref_oid_before" != "$ref_oid_after" ]; then
|
|
209
|
+
fail_pre_push "Git metadata changed during pre-push tests."
|
|
210
|
+
fi
|
|
211
|
+
|
|
212
|
+
if [ "$test_status" -ne 0 ]; then
|
|
213
|
+
fail_pre_push "fix the issues above." "$test_status"
|
|
214
|
+
fi
|