chore(lefthook): add lockfile integrity and dependency change checks

[ryoppippi]

Summary

Add pre-push checks to ensure dependency changes are properly validated:

• lockfile-sync-check: Verify package.json/pnpm-workspace.yaml changes are reflected in pnpm-lock.yaml
• lint-all-on-lockfile-change: Run full lint when lockfile changes
• test-all-on-lockfile-change: Run full test suite when lockfile changes

Why

Ensures that dependency changes don't break the build and that lockfile stays in sync with package manifests.

---

Summary by cubic

Add pre-push lefthook checks to keep the pnpm lockfile in sync and validate dependency changes. This blocks pushes when manifests and the lockfile diverge, and runs full lint/tests on lockfile changes.

• New Features
  • lockfile-sync-check: verify pnpm-lock.yaml matches all package.json files and pnpm-workspace.yaml using pnpm install --lockfile-only --frozen-lockfile
  • lint-all-on-lockfile-change: run pnpm lint when pnpm-lock.yaml changes
  • test-all-on-lockfile-change: run pnpm test when pnpm-lock.yaml changes

^{Written for commit d65855f. Summary will update on new commits.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/StackOneHQ/stackone-ai-node/@stackone/ai@277

commit: a8fd5f8

[Copilot]

Pull request overview

This PR adds three pre-push Git hooks to validate dependency changes and ensure the lockfile stays synchronized with package manifests. The checks aim to prevent broken builds by running comprehensive tests and linting when dependencies are modified.

• Adds lockfile synchronization verification for package.json and pnpm-workspace.yaml changes
• Triggers full linting when pnpm-lock.yaml is modified
• Triggers full test suite execution when pnpm-lock.yaml is modified

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The combination of --lockfile-only and --frozen-lockfile flags is contradictory. The --lockfile-only flag tells pnpm to update the lockfile, while --frozen-lockfile requires that the lockfile must not be modified. This command will fail.

For verifying that package.json/pnpm-workspace.yaml changes are reflected in pnpm-lock.yaml, you should use only --frozen-lockfile (which will fail if the lockfile is out of sync) or consider using pnpm install --frozen-lockfile --dry-run to verify without making changes.

Suggested change

	run: pnpm install --lockfile-only --frozen-lockfile
	run: pnpm install --frozen-lockfile --dry-run

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="lefthook.yaml">

<violation number="1" location="lefthook.yaml:24">
P2: Glob pattern should include workspace `package.json` files. In this monorepo, changes to `examples/package.json` won&#39;t trigger this lockfile sync check. Consider using `&#39;{**/package.json,pnpm-workspace.yaml}&#39;` to catch all package manifest changes.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Glob pattern should include workspace package.json files. In this monorepo, changes to examples/package.json won't trigger this lockfile sync check. Consider using '{**/package.json,pnpm-workspace.yaml}' to catch all package manifest changes.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At lefthook.yaml, line 24:

<comment>Glob pattern should include workspace `package.json` files. In this monorepo, changes to `examples/package.json` won&#39;t trigger this lockfile sync check. Consider using `&#39;{**/package.json,pnpm-workspace.yaml}&#39;` to catch all package manifest changes.</comment>

<file context>
@@ -20,3 +20,12 @@ pre-push:
     - name: knip
       run: pnpm run lint:knip
+    - name: lockfile-sync-check
+      glob: &#39;{package.json,pnpm-workspace.yaml}&#39;
+      run: pnpm install --lockfile-only --frozen-lockfile
+    - name: lint-all-on-lockfile-change
</file context>

Suggested change

	glob: '{package.json,pnpm-workspace.yaml}'
	glob: '{**/package.json,pnpm-workspace.yaml}'