repowarden 4.10.2 → 4.11.0-next.21

package/ci/tickets/registre.sh

@@ -4,20 +4,8 @@
 # Chargé par ci/tickets.sh (après hooks/lib/common.sh et hooks/lib/tickets.sh).
 # shellcheck disable=SC2154 # statuts, réglages et compteurs définis dans les autres modules
 
-# Registre des branches d'un ticket : repère invisible dans les commentaires
-# du bot. GitHub ne lie une branche au ticket qu'à sa création, et une branche
-# liée supprimée y perd son nom : le registre garde le nom de chaque branche.
-REPERE="repowarden:branche"
-
-repere() { printf '<!-- %s %s -->' "$REPERE" "$1"; }
-
-# REPLY = branches inscrites sur le ticket $1 (séparées par des espaces)
-branches_inscrites_r() {
-    local corps
-    corps="$(gh issue view "$1" --json comments -q '.comments[].body' 2>/dev/null || true)"
-    REPLY="$(grep -oE "<!-- $REPERE [^ ]+ -->" <<<"$corps" | awk '{ printf "%s ", $3 }' || true)"
-    REPLY="${REPLY% }"
-}
+# Registre (REPERE, repere, branches_inscrites_r) : hooks/lib/tickets.sh,
+# partagé avec repowarden ticket.
 
 # Inscrit la branche $2 sur le ticket $1, une seule fois ($3 : origine, ex. PR #7).
 # Une seconde branche pour le même ticket est inscrite et signalée.
@@ -34,7 +22,7 @@ inscrire_branche() {
         _tr tk.branch_registered "$b"
     fi
     [ -z "$origine" ] || _T="$_T ($origine)"
-    gh issue comment "$n" --body "$_T"$'\n\n'"$(repere "$b")" >/dev/null
+    commenter "$n" "$_T"$'\n\n'"$(repere "$b")"
     INSCRITES=$((INSCRITES + 1))
 }
 
@@ -65,19 +53,23 @@ nettoyer_branche() {
         notice_t tk.branch_deleted "$branche" "$n"
     else
         _tr tk.branch_kept "$branche" "${avance:-?}" "${prs:--}"
-        gh issue comment "$n" --body "$_T" >/dev/null
+        commenter "$n" "$_T"
     fi
 }
 
 # Ticket $1 validé : sa branche naît de la branche d'intégration, liée au
-# ticket (panneau « Development »). Rien si elle existe déjà, ou si une PR
-# ouverte cite déjà le ticket (travail commencé hors de sa branche).
+# ticket (panneau « Development »). Rien si une PR ouverte cite déjà le ticket
+# (travail commencé hors de sa branche) ; si elle existe déjà, jamais recréée :
+# faite avant la validation, elle n'est pas liée et son lien est inscrit.
 creer_branche() {
     local n="$1" titre labels branche pr head body
     # Travail déjà mergé ou en production : plus de branche à (re)créer
     travail_termine "$(etiquettes "$n")" && return 0
     branche_du_ticket_r "$n"
-    [ -z "$REPLY" ] || return 0
+    if [ -n "$REPLY" ]; then
+        ticket_note_unlinked_branch "$n" "$REPLY" || true
+        return 0
+    fi
     while IFS=$'\t' read -r pr head; do
         [ -n "$pr" ] || continue
         body="$(gh pr view "$pr" --json body -q .body)"
@@ -97,6 +89,6 @@ creer_branche() {
         -f oid="$(gh api "repos/$GH_REPO/git/ref/heads/$INTEGRATION" -q .object.sha)" \
         -f name="$branche" >/dev/null
     _tr tk.branch_created "$branche" "$INTEGRATION" "$n" "$branche"
-    gh issue comment "$n" --body "$_T"$'\n\n'"$(repere "$branche")" >/dev/null
+    commenter "$n" "$_T"$'\n\n'"$(repere "$branche")"
     notice_t tk.branch_notice "$branche" "$n"
 }

package/ci/tickets/release.sh

@@ -1,20 +1,31 @@
 # shellcheck shell=bash
-# Suivi des tickets, préversion et release (ci/tickets.sh release) : tickets
-# prévenus, ou passés en done et fermés.
+# Suivi des tickets, préversion, release ou livraison sans nouvelle version
+# (ci/tickets.sh release) : tickets prévenus, ou passés en done et fermés.
 # Chargé par ci/tickets.sh (après hooks/lib/common.sh et hooks/lib/tickets.sh).
 # shellcheck disable=SC2154 # statuts, réglages et compteurs définis dans les autres modules
 
+# TAG : release (vX.Y.Z) ou préversion (vX.Y.Z-next.N) ; sans TAG,
+# DELIVERED_SHA : commit livré sur la branche principale sans nouvelle version
+# (livraison sans fix ni feat), les tickets livrés sont fermés tout de même
 cmd_release() {
-    local n
+    local n tag="${TAG:-}" sha="${DELIVERED_SHA:-}"
+    if [ -n "$tag" ]; then
+        if [[ "$tag" == *-* ]]; then _tr tk.prerelease "$tag"; else _tr tk.released "$tag"; fi
+    elif [ -n "$sha" ]; then
+        _tr tk.delivered "${MAIN:-main}" "${sha:0:7}"
+    else
+        echo "ci/tickets.sh release : TAG ou DELIVERED_SHA requis" >&2
+        return 2
+    fi
+    local msg="$_T"
     while IFS= read -r n; do
         [ -n "$n" ] || continue
-        if [[ "$TAG" == *-* ]]; then
-            _tr tk.prerelease "$TAG"
-            gh issue comment "$n" --body "$_T" >/dev/null
+        if [[ "$tag" == *-* ]]; then
+            commenter "$n" "$msg"
         else
-            _tr tk.released "$TAG"
             statut "$n" "$S_DONE"
-            gh issue close "$n" --comment "$_T" >/dev/null
+            pied_r "$msg"
+            gh issue close "$n" --comment "$REPLY" >/dev/null
             nettoyer_branche "$n"
         fi
     done < <(gh issue list --state open --label "$S_PREPROD" --limit 500 --json number -q '.[].number')

package/ci/tickets.sh

@@ -12,8 +12,9 @@
 #   ci/tickets.sh push      premier push sur la branche d'un ticket : PR
 #                           brouillon ouverte, ticket en cours
 #   ci/tickets.sh revue     corrections demandées en revue → en cours
-#   ci/tickets.sh release   release publiée : tickets en préprod → done (fermés),
-#                           ou prévenus de la préversion
+#   ci/tickets.sh release   release publiée, ou livraison sur la branche
+#                           principale sans nouvelle version : tickets en
+#                           préprod → done (fermés) ; ou prévenus de la préversion
 #   ci/tickets.sh adopter   mise en route (tickets init) : tickets existants
 #                           rangés, branches des PR inscrites sur leurs tickets
 #
@@ -24,10 +25,10 @@
 # feat/12-sujet. « Closes #12 » fermerait le ticket dès le merge dans develop :
 # c'est la release qui le ferme.
 #
-# Variables : GH_TOKEN, GH_REPO, INTEGRATION ; pr : PR, ACTION, MERGED, DRAFT,
-# HEAD, BASE, HEAD_SHA, AUTHOR ; issue : ISSUE, ACTION, LABEL, STATE_REASON ;
+# Variables : GH_TOKEN, GH_REPO, INTEGRATION, APP_SLUG (pied des commentaires) ;
+# pr : PR, ACTION, MERGED, DRAFT, HEAD, BASE, HEAD_SHA, AUTHOR ; issue : ISSUE, ACTION, LABEL, STATE_REASON ;
 # push : PUSH_BRANCH, DELETED, PUSHER, SHA ; revue : PR, HEAD, REVIEW_STATE ;
-# release : TAG
+# release : TAG, ou DELIVERED_SHA et MAIN (livraison sans nouvelle version)
 set -euo pipefail
 
 REPOWARDEN_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"

package/hooks/commit-msg

@@ -74,13 +74,6 @@ Expected format: <type>(<optional scope>): <description>
         refactor!: change the public API   (! = breaking change)
 
 Types:
-EOF
-        types_help
-        cat >&2 <<EOF
-
-👉 Tip: name your branch <type>/<topic> (e.g. feat/user) and the prefix
-   is added automatically: git commit -m "add sign-up"  (or use git cc)
-   Your message is not lost: git commit -e -F .git/COMMIT_EDITMSG
 EOF
     else
         cat >&2 <<EOF
@@ -93,9 +86,22 @@ Format attendu : <type>(<scope optionnel>): <description>
 
 Types :
 EOF
-        types_help
+    fi
+    types_help
+    echo >&2
+    # HEAD détachée (bisect, essai, rebase) : pas de branche dont tirer le
+    # préfixe, le conseil de nommage ne s'applique pas
+    if ! git symbolic-ref -q HEAD >/dev/null; then
+        echo_t hook.commit_msg.detached >&2
+        echo_t hook.commit_msg.kept >&2
+    elif [ "${REPOWARDEN_LANG:-}" = en ]; then
+        cat >&2 <<EOF
+👉 Tip: name your branch <type>/<topic> (e.g. feat/user) and the prefix
+   is added automatically: git commit -m "add sign-up"  (or use git cc)
+   Your message is not lost: git commit -e -F .git/COMMIT_EDITMSG
+EOF
+    else
         cat >&2 <<EOF
-
 👉 Astuce : nomme ta branche <type>/<sujet> (ex. feat/user) et le préfixe
    sera ajouté automatiquement : git commit -m "ajoute l'inscription"  (ou git cc)
    Ton message n'est pas perdu : git commit -e -F .git/COMMIT_EDITMSG

package/hooks/lib/commentaires.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Fonctions ajoutées sans commentaire : chaque nouvelle fonction doit dire,
+# juste au-dessus, ce qu'elle fait et pourquoi (docstring acceptée en Python).
+# Comme pour le code mort, seul le code ajouté compte : une fonction dont le
+# nom existait déjà dans le fichier n'est jamais signalée, même retouchée.
+# Avertissement seulement (pre-commit et CI), désactivable par skip = comments.
+# Langages : Shell (.sh, .bash, ou shebang sh/bash), Python, JavaScript/TypeScript.
+
+# Une ligne « fichier:ligne<TAB>nom » par fonction ajoutée sans commentaire
+# entre $1 (commit de base) et $2 (commit, ou vide pour le contenu stagé).
+comments_missing() {
+    local base="$1" new="$2" st a b f old lang added tmp
+    tmp="$(mktemp -d)"
+    while IFS=$'\t' read -r st a b; do
+        [ -n "$a" ] || continue
+        # Renommage ou copie : l'ancien chemin donne les fonctions existantes
+        if [ -n "$b" ]; then old="$a" f="$b"; else old="$a" f="$a"; fi
+        is_excluded "$f" && continue
+        case "${f##*/}" in
+            *.sh | *.bash) lang=shell ;;
+            *.py) lang=py ;;
+            *.js | *.jsx | *.mjs | *.cjs | *.ts | *.tsx) lang=js ;;
+            *.*) continue ;;
+            *) lang=shebang ;;
+        esac
+        git show "$new:$f" >"$tmp/new" 2>/dev/null || continue
+        if [ "$lang" = shebang ]; then
+            # Script sans extension (bin/…) : seul un shebang sh ou bash compte
+            IFS= read -r st <"$tmp/new" || true
+            [[ "$st" =~ ^#!.*[/\ ](ba)?sh([[:space:]]|$) ]] || continue
+            lang=shell
+        fi
+        git show "$base:$old" >"$tmp/base" 2>/dev/null || : >"$tmp/base"
+        if [ -n "$new" ]; then
+            git diff -U0 --no-color --no-ext-diff "$base" "$new" -- "$f"
+        else
+            git diff --cached -U0 --no-color --no-ext-diff "$base" -- "$f"
+        fi 2>/dev/null >"$tmp/diff"
+        # Numéros des lignes ajoutées ou modifiées, d'après les en-têtes @@
+        added="$(awk '/^@@/ {
+            split($3, a, ","); s = substr(a[1], 2); n = (a[2] == "" ? 1 : a[2])
+            for (i = 0; i < n; i++) printf " %d", s + i
+        }' "$tmp/diff") "
+        [ "$added" != " " ] || continue
+        awk -v lang="$lang" -v added="$added" -v f="$f" -v q="'" "$COMMENTS_AWK" "$tmp/base" "$tmp/new"
+    done < <(
+        if [ -n "$new" ]; then
+            git diff --name-status -M --diff-filter=ACMR "$base" "$new"
+        else
+            git diff --cached --name-status -M --diff-filter=ACMR "$base"
+        fi 2>/dev/null
+    )
+    rm -rf "$tmp"
+}
+
+# Avertit des fonctions ajoutées sans commentaire, sans jamais bloquer : le
+# commentaire aide la relecture, son absence n'est pas une faute. REPLY = nombre.
+comments_check() {
+    local loc name n=0
+    while IFS=$'\t' read -r loc name; do
+        [ -n "$loc" ] || continue
+        n=$((n + 1))
+        attention_t cm.missing "$loc" "$name"
+    done < <(comments_missing "$1" "$2")
+    [ "$n" = 0 ] || info_t cm.summary "$n"
+    REPLY="$n"
+}
+
+# Programme awk de comments_missing : lit le fichier de base (noms des
+# fonctions existantes) puis le nouveau, et signale les fonctions nouvelles
+# dont aucune ligne de commentaire ne précède la déclaration
+# shellcheck disable=SC2016 # programme awk, rien à développer
+COMMENTS_AWK='
+# Nom de la fonction déclarée par la ligne l (vide sinon), selon le langage
+function nom(l) {
+    if (lang == "shell") {
+        if (l ~ /^[ \t]*function[ \t]+[A-Za-z_]/) {
+            sub(/^[ \t]*function[ \t]+/, "", l); sub(/[ \t(){}].*$/, "", l); return l
+        }
+        if (l ~ /^[ \t]*[A-Za-z_][A-Za-z0-9_:.@-]*[ \t]*\(\)/) {
+            sub(/^[ \t]*/, "", l); sub(/[ \t]*\(\).*$/, "", l); return l
+        }
+    } else if (lang == "py") {
+        if (l ~ /^[ \t]*(async[ \t]+)?def[ \t]+[A-Za-z_]/) {
+            sub(/^[ \t]*(async[ \t]+)?def[ \t]+/, "", l); sub(/[^A-Za-z0-9_].*$/, "", l); return l
+        }
+    } else {
+        if (l ~ /^[ \t]*(export[ \t]+(default[ \t]+)?)?(async[ \t]+)?function[ \t]*\*?[ \t]*[A-Za-z_$]/) {
+            sub(/^[ \t]*(export[ \t]+(default[ \t]+)?)?(async[ \t]+)?function[ \t]*\*?[ \t]*/, "", l)
+            sub(/[^A-Za-z0-9_$].*$/, "", l); return l
+        }
+        if (l ~ /^[ \t]*(export[ \t]+)?(const|let|var)[ \t]+[A-Za-z_$][A-Za-z0-9_$]*[ \t]*(:[^=]*)?=[ \t]*(async[ \t]+)?(function[^A-Za-z0-9_$]|function$|\([^)]*\)[^=]*=>|[A-Za-z_$][A-Za-z0-9_$]*[ \t]*=>)/) {
+            sub(/^[ \t]*(export[ \t]+)?(const|let|var)[ \t]+/, "", l); sub(/[^A-Za-z0-9_$].*$/, "", l); return l
+        }
+    }
+    return ""
+}
+# Directive d outil (shellcheck, eslint, noqa…) : n explique rien, on regarde au-dessus
+function directive(l) {
+    return l ~ /^[ \t]*(#|\/\/)[ \t]*(shellcheck|noqa|type:|pylint:|eslint|@ts-|prettier-)/
+}
+# Commentaire juste au-dessus de la ligne i (décorateurs et directives sautés),
+# ou docstring en tête du corps pour Python
+function commentee(i,   j, s) {
+    for (j = i - 1; j > 0 && (L[j] ~ /^[ \t]*@/ || directive(L[j])); j--) ;
+    if (j > 0 && L[j] !~ /^#!/ && L[j] ~ /^[ \t]*(#|\/\/|\/\*|\*)/) return 1
+    if (lang != "py") return 0
+    # Fin de la signature (deux-points en fin de ligne), puis première ligne non vide
+    for (j = i; j <= N && j < i + 20 && L[j] !~ /:[ \t]*(#.*)?$/; j++) ;
+    for (j++; j <= N && L[j] ~ /^[ \t]*$/; j++) ;
+    s = "^[ \t]*[rRuUbBfF]*[\"" q "]"
+    return j <= N && L[j] ~ s
+}
+FILENAME == ARGV[1] { n = nom($0); if (n != "") ancien[n] = 1; next }
+{ L[FNR] = $0; N = FNR }
+END {
+    for (i = 1; i <= N; i++) {
+        if (index(added, " " i " ") == 0) continue
+        n = nom(L[i])
+        if (n == "" || (n in ancien) || commentee(i)) continue
+        print f ":" i "\t" n
+    }
+}'

package/hooks/lib/common.sh

@@ -218,6 +218,30 @@ header_valid() {
     [ "$REPLY" -le 72 ]
 }
 
+# Bots de mise à jour des dépendances : leurs titres (« bump <paquet> from X
+# to Y ») dépassent souvent 72 caractères ; seul leur format est exigé.
+BOTS='^[0-9]*\+?(dependabot|renovate)\[bot\]@'
+
+# Règle des en-têtes de commit, commune au pre-push et à la CI : même verdict,
+# même message, que le commit soit vu avant le push ou après.
+# REPLY = clé du message de refus de l'en-tête $1 (e-mail de l'auteur $2),
+# vide si l'en-tête est admis
+commit_subject_problem_r() {
+    if [[ "$1" =~ ^(fixup|squash|amend)! ]]; then
+        REPLY=ci.check.3
+    elif [[ "$1" =~ ^(Merge|Revert) ]]; then
+        REPLY=""
+    elif ! [[ "$1" =~ $CC_PATTERN ]]; then
+        REPLY=ci.check.4
+    elif [[ "$2" =~ $BOTS ]]; then
+        REPLY=""
+    elif authored_length "$1" && [ "$REPLY" -gt 72 ]; then
+        REPLY=ci.check.5
+    else
+        REPLY=""
+    fi
+}
+
 # REPLY = titre de PR conforme déduit de la branche $1 :
 #   feat/ajout-panier → « feat: ajout panier », hotfix/crash → « fix: crash »,
 #   release/1.2.0 → « chore(release): 1.2.0 », develop → livraison sur main
@@ -310,7 +334,6 @@ EOF
 
 Allowed exceptions: $allowed
   (change: git config repowarden.allowedBranches "main develop release/*")
-Disable for this repository: git config repowarden.skip branch-name
 EOF
     else
         cat >&2 <<EOF
@@ -333,7 +356,6 @@ EOF
 
 Exceptions autorisées : $allowed
   (modifier : git config repowarden.allowedBranches "main develop release/*")
-Désactiver pour ce dépôt : git config repowarden.skip branch-name
 EOF
     fi
 }
@@ -341,7 +363,7 @@ EOF
 # Vrai si l'élément est désactivé (repowarden.skip, git config ou .repowarden.conf).
 # Valeurs : true|all, ou liste séparée par espaces/virgules parmi
 # pre-commit prepare-commit-msg commit-msg pre-push post-checkout
-# branch-name protect-branch secrets format tests, ou un langage (node, python…)
+# branch-name protect-branch secrets sensitive-files format tests, ou un langage (node, python…)
 skipped() {
     local v
     cfg_r skip

package/hooks/lib/i18n/en.sh

@@ -50,11 +50,13 @@ _msg_en() {
         cc.refs_prompt_ticket) _M="References (\"-\" for none) [%s]: " ;;
         cc.refs_prompt) _M="References (e.g. %s; Enter for none): " ;;
         tk.cli.no_ticket) _M="Branch %s has no ticket: this work will not be linked to any ticket (not blocking)." ;;
+        tk.cli.explain) _M="Ticket: the GitHub issue each change starts from (branch type/<n>-topic, PR citing it); its lifecycle: https://simdevwarden.github.io/repowarden/en/tickets/" ;;
         tk.cli.propose) _M="Start it from a ticket: repowarden ticket nouveau \"<title>\"." ;;
         tk.cli.propose_cc) _M="Start it from a ticket: repowarden ticket nouveau \"<title>\" (or answer yes in git cc)." ;;
         tk.cli.silence) _M="Project without ticket tracking? git config repowarden.skip tickets to stop seeing this." ;;
         tk.cli.fetch) _M="Branch of ticket #%s…" ;;
         tk.cli.switched) _M="On branch %s (ticket #%s)." ;;
+        tk.cli.unlinked) _M="Branch %s was created before validation: GitHub cannot link it to ticket #%s afterwards, its link is written on the ticket." ;;
         tk.cli.created_branch) _M="Branch %s created from %s, linked to ticket #%s." ;;
         tk.cli.not_validated) _M="Ticket #%s not validated yet: its branch will be created automatically on validation (\"%s\" label)." ;;
         tk.cli.closed) _M="Ticket #%s is closed: no branch to create." ;;
@@ -62,6 +64,7 @@ _msg_en() {
         tk.cli.issue_created) _M="Ticket #%s created, awaiting validation. Its branch will be created on validation; then: repowarden ticket %s" ;;
         tk.cli.issue_created_branch) _M="Ticket #%s created." ;;
         tk.cli.title_required) _M="Ticket title required: repowarden ticket nouveau \"<title>\"" ;;
+        tk.cli.bad_type) _M="Unknown ticket type: %s (types: %s)" ;;
         tk.cli.current) _M="Branch %s: ticket #%s." ;;
         tk.cli.no_ticket_here) _M="No ticket for this branch." ;;
         cc.ticket_offer) _M="No ticket for this branch. Create one now (title: the description)? [y/N]: " ;;
@@ -119,7 +122,7 @@ _msg_en() {
         help.code-mort) _M="Usage: repowarden code-mort [base]\n\nDead code introduced by your branch (like CI): only added/changed lines\nsince base (commits, staged/uncommitted, new files). Default: merge-base\nwith origin/main. See docs/code-mort.md (proven vs candidates)." ;;
         help.ticket) _M="Usage: repowarden ticket <n>                          branch for ticket (created, linked if needed)\n       repowarden ticket                              ticket of current branch\n       repowarden ticket nouveau \"<title>\" [--type fix] [--description \"…\"]\n       repowarden ticket comment <n> \"<text>\"         add comment\n       repowarden ticket label <n> <label> [--remove] manage labels\n\nTicket first: taking <n> assigns to you and switches to its branch\n(created from develop if needed). \"nouveau\" creates a ticket (\"à valider\"\nif tracking is managed). Needs gh connected (https://cli.github.com)." ;;
         help.tickets) _M="Usage: repowarden tickets init [--repo owner/name] [--sans-validation-auto]\n       repowarden tickets sync\n\nSets up ticket tracking: labels, issue template, workflow; classifies\nexisting tickets; records PR branches. sync checks out local branches for\ntickets assigned to you (auto with ticketSync=auto, manual by default)." ;;
-        help.pr) _M="Usage: repowarden pr label <n> <label> [--remove]\n       repowarden pr checks <n>\n\nlabel adds or removes a label from PR #<n>; checks shows its checks\n(name, conclusion, status, link).\nExamples:\n  repowarden pr label 123 \"ready-for-review\"\n  repowarden pr label 123 \"needs-changes\" --remove\n  repowarden pr checks 123" ;;
+        help.pr) _M="Usage: repowarden pr label <n> <label> [--remove]\n       repowarden pr checks <n>\n\nlabel adds or removes a label from PR #<n>; checks lists its failed\njobs (with their link) and pending ones, then the verdict; exit 1 if a job fails.\nExamples:\n  repowarden pr label 123 \"ready-for-review\"\n  repowarden pr label 123 \"needs-changes\" --remove\n  repowarden pr checks 123" ;;
         help.run) _M="Usage: repowarden run rerun <run-id|--failed|--workflow <name>>\n       repowarden run list [--workflow <name>] [--limit N]\n\nrerun restarts a GitHub Actions workflow. list shows recent runs\n(default limit 20).\nExamples:\n  repowarden run rerun --failed\n  repowarden run list --workflow \"CI\" --limit 10" ;;
         help.proteger) _M="Usage: repowarden proteger [--repo owner/name] [--checks \"repowarden,tests (ubuntu-latest)\"]\n       [--relecteurs N] [--codeowners] [--environnement NAME] [--approbateurs \"login …\"]\n       [--sans-tags] [--dry-run] [--verifier]\n\nProtects GitHub repo per .repowarden.conf: required PR, required checks,\nno force push/deletion, ruleset, squash merges, v* tags reserved to\nworkflows, optional human approvals. --verifier checks online rules\nwithout changes. Needs gh and admin rights." ;;
         help.migrer) _M="Usage: repowarden migrer [--pr] [--hooks]\n\nMigrates from repogarde to repowarden (docs/migration-v4.md): configs,\nworkflows, renames, lists manual steps left. Safe to rerun.\n  --pr     on chore/migration-repowarden-vN: commit, push and PR\n  --hooks  also move leftover lefthook hooks to .git/hooks-lefthook/" ;;
@@ -130,7 +133,6 @@ _msg_en() {
         # Hooks and language plugins
         hook.pre_commit.1) _M="Commit refused: branch name does not follow the convention." ;;
         hook.pre_commit.2) _M="Direct commit on '%s' forbidden. Create a branch: git switch -c feat/my-feature" ;;
-        hook.pre_commit.3) _M="  (disable for this repository: git config repowarden.skip protect-branch)" ;;
         hook.pre_commit.4) _M="Secret detection (gitleaks)" ;;
         hook.pre_commit.5) _M="Secret detected: commit refused." ;;
         hook.secrets.where) _M="  %s:%s (%s)" ;;
@@ -141,7 +143,9 @@ _msg_en() {
         hook.secrets.todo_3) _M="  3. Key that may have leaked elsewhere (already pushed, shared): revoke it at its provider." ;;
         hook.secrets.todo_4) _M="  False positive: add its fingerprint to .gitleaksignore:" ;;
         hook.secrets.failed) _M="gitleaks failed (code %s): commit refused, secret detection not done." ;;
-        hook.pre_commit.6) _M="gitleaks not installed, secret detection skipped (install: %s)." ;;
+        hook.pre_commit.6) _M="gitleaks not installed: secrets not checked before the commit, the CI (secrets check) will do it. Install: %s" ;;
+        hook.sensitive.found) _M="Sensitive file neither tracked nor ignored: git add . would publish it. Lines to add to .gitignore:" ;;
+        hook.sensitive.hint) _M="  (names compared, content never read; patterns: repowarden.sensitiveFiles; disable: git config repowarden.skip sensitive-files)" ;;
         hook.pre_commit.7) _M="Pre-commit OK" ;;
         hook.commit_msg.1) _M="First line too long (%s > 72 characters)." ;;
         hook.commit_msg.type_unknown) _M="Unknown type \"%s\". Did you mean: %s" ;;
@@ -149,13 +153,16 @@ _msg_en() {
         hook.commit_msg.desc_empty) _M="Missing description after \"%s\": describe the change in the imperative mood." ;;
         hook.commit_msg.kept) _M="  Your message is not lost: git commit -e -F .git/COMMIT_EDITMSG" ;;
         hook.commit_msg.dot) _M="Final period removed from the description (same rule as git cc)." ;;
+        hook.commit_msg.detached) _M="👉 Detached HEAD (bisect, trial): no prefix comes from a branch, write the full header (e.g. fix: correct the total)." ;;
         hook.pre_push.1) _M="Push refused: branch name does not follow the convention." ;;
         hook.pre_push.2) _M="Direct push to '%s' refused: it only changes through pull requests." ;;
         hook.pre_push.3) _M="  Create a branch: git switch -c feat/my-feature, then open a PR." ;;
-        hook.pre_push.4) _M="  (disable for this repository: git config repowarden.skip protect-branch)" ;;
         hook.pre_push.5) _M="%s: no changed file, nothing to test." ;;
         hook.pre_push.6) _M="Nothing to test (branch deletion only)." ;;
         hook.pre_push.7) _M="Pre-push OK" ;;
+        hook.pre_push.msg) _M="Push refused: commit message does not follow the convention (same rule as CI)." ;;
+        hook.pre_push.msg_fix) _M="  Fix: git rebase -i %s (reword), then push again." ;;
+        hook.pre_push.nothing) _M="Nothing to push." ;;
         hook.pre_push.workflow_scope) _M="gh token without the 'workflow' scope: GitHub will refuse a push touching .github/workflows/. Allow it (then sign in again): gh auth refresh -h github.com -s workflow" ;;
         hook.pre_push.lint.missing) _M="%s not installed, %s not checked (install: %s)." ;;
         hook.pre_push.lint.run) _M="%s: %s" ;;
@@ -287,6 +294,11 @@ _msg_en() {
         ci.fix_pr.2) _M="PR #%s retargeted: %s → %s (%s flow)" ;;
         ci.fix_pr.3) _M="Title follows the convention: %s" ;;
         ci.fix_pr.4) _M="Title \"%s\" replaced with \"%s\"" ;;
+        ci.verrous_pip.compile) _M="Lock file %s: re-running the command from its header" ;;
+        ci.verrous_pip.refused) _M="Lock file %s skipped: the output of its header command is not this file" ;;
+        ci.verrous_pip.compliant) _M="pip lock files match their header: no commit" ;;
+        ci.verrous_pip.committed) _M="Lock files regenerated and committed: %s" ;;
+        ci.verrous_pip.pushed) _M="Commit pushed to %s" ;;
         ci.version.1) _M="version announced by the delivery PR" ;;
         ci.version.2) _M="No feat, fix, perf or breaking change since %s: no version." ;;
         ci.version.3) _M="first version" ;;
@@ -420,6 +432,12 @@ _msg_en() {
         dc.knip_file) _M="file never imported" ;;
         dc.knip_export) _M="export never imported:" ;;
         dc.knip_dep) _M="dependency never imported:" ;;
+        # Functions added without a comment
+        cm.section) _M="Functions without a comment (new code only)" ;;
+        cm.no_base) _M="No base: comment check skipped." ;;
+        cm.missing) _M="%s: function %s has no comment right above it" ;;
+        cm.summary) _M="%s function(s) added without a comment: one or two lines right above, saying what it does and why (warning, not blocking)." ;;
+        cm.none) _M="Every added function has a comment." ;;
         ci.section.commits) _M="Commit messages (Conventional Commits)" ;;
         ci.section.branch) _M="Branch name" ;;
         ci.section.secrets) _M="Secrets (gitleaks)" ;;
@@ -486,6 +504,10 @@ _msg_en() {
         st.repo_version_ok) _M="Version required by the project (%s): met" ;;
         st.repo_forge) _M="Platform: %s" ;;
         st.repo_rules) _M="GitHub rules up to date? repowarden proteger --verifier (read-only)" ;;
+        st.wf_owner) _M="%s:%s: repowarden called from another repository than the official one (%s); expected: %s" ;;
+        st.wf_branch) _M="%s:%s: repowarden called on a branch (@%s), broken as soon as it is deleted; expected: %s" ;;
+        st.wf_old) _M="%s:%s: repowarden called in an outdated major version (@%s); expected: %s" ;;
+        st.wf_fix) _M="fix the uses: lines reported above" ;;
         st.tools) _M="Tools present: %s · missing: %s (depending on the projects' languages)" ;;
         st.next) _M="Next step:" ;;
         st.ready) _M="All set: git cc to commit, repowarden code-mort on a branch." ;;
@@ -541,6 +563,7 @@ _msg_en() {
         bot.ignored) _M="ignored (bot = off)" ;;
         bot.mode_invalid) _M="bot = %s: auto, pr or off expected" ;;
         bot.clone_failed) _M="clone failed: %s" ;;
+        bot.email_fallback) _M="Bot user %s not found: commits signed %s, linked to no account (set REPOWARDEN_BOT_EMAIL to fix the address)." ;;
         bot.prot_ok) _M="up to date" ;;
         bot.prot_stale) _M="⚠ outdated: repowarden proteger" ;;
         bot.prot_applied) _M="✔ applied" ;;
@@ -633,6 +656,7 @@ _msg_en() {
         tk.pr_backmerge_empty) _M="PR closed automatically: \`%s\` brings no content to \`%s\`. The back-merge is done automatically after a release, only when there is something to bring back." ;;
         tk.pr_delivery_manual) _M="PR closed automatically: the \`%s\` → \`%s\` delivery is opened by the release workflow; a PR opened by hand would never get a deployment approval. Run *Actions → release → Run workflow* on \`%s\` (or \`gh workflow run release.yml --ref %s\`), then **Approve and deploy** on the run." ;;
         tk.branch_registered) _M="Ticket branch: \`%s\`." ;;
+        tk.branch_unlinked) _M="Ticket branch: [\`%s\`](%s). Created before the ticket was validated: GitHub does not link an existing branch, so it does not show under *Development*; this comment keeps its link." ;;
         tk.branch_second) _M="Second branch for this ticket: \`%s\` (already: %s). One ticket, one branch: group the work, or open a separate ticket." ;;
         tk.adopted) _M="Existing tickets: %s sorted, %s branch(es) registered." ;;
         tk.init_adopt) _M="Existing tickets and branches" ;;
@@ -641,6 +665,8 @@ _msg_en() {
         tk.branch_kept) _M="Branch \`%s\` kept: %s commit(s) missing from the integration branch, open PR(s): %s. Delete it by hand if the work lives elsewhere." ;;
         tk.draft_opened) _M="Draft PR #%s opened for ticket #%s" ;;
         tk.draft_updated) _M="PR #%s (ticket #%s): title and description taken from the ticket" ;;
+        tk.pr_additions) _M="Ticket additions" ;;
+        tk.pr_design) _M="Design (summary)" ;;
         tk.created_body) _M="Ticket created automatically for PR #%s, which cited none. To be validated by a maintainer (\"validé\" label)." ;;
         tk.created) _M="Ticket #%s created for PR #%s and linked in its description: to be validated by a maintainer." ;;
         tk.init_labels) _M="Labels (statuses and validation)" ;;
@@ -654,6 +680,8 @@ _msg_en() {
         tk.init_next_wired) _M="Next: commit these files; require the \"ticket\" check (repowarden proteger --checks \"…,ticket\"). The tickets job of release.yml is already wired." ;;
         tk.prerelease) _M="Available in pre-release **%s**: to be tested before production." ;;
         tk.released) _M="Released in **%s**." ;;
+        tk.footer) _M="Posted by this repository's GitHub App ([repowarden docs](https://simdevwarden.github.io/repowarden/en/industrialisation/#github-app-for-workflows)): [%s](https://github.com/apps/%s)" ;;
+        tk.delivered) _M="Delivered to **%s**, without a new version (commit %s)." ;;
         # Ticket comment
         tk.comment.adding) _M="Adding comment to ticket #%s..." ;;
         tk.comment.added) _M="Comment added to ticket #%s." ;;
@@ -679,6 +707,11 @@ _msg_en() {
         run.listing.workflow) _M="Listing runs for workflow \"%s\"..." ;;
         # PR checks
         pr.checks.checking) _M="Checking checks for PR #%s..." ;;
+        pr.checks.failed) _M="Failed: %s  %s" ;;
+        pr.checks.pending) _M="Pending: %s" ;;
+        pr.checks.verdict) _M="PR #%s: %s passed, %s failed, %s pending." ;;
+        pr.checks.green) _M="All checks of PR #%s are green." ;;
+        pr.checks.none) _M="No check on PR #%s." ;;
         # AI agent guard (repowarden garde, repowarden agents)
         garde.format) _M="Unknown format \"%s\": claude or opencode." ;;
         garde.no_jq) _M="repowarden garde: jq missing, action not checked (install jq: https://jqlang.org)." ;;