lefthook.yml

# @file lefthook.yml
# @description Git hooks configuration for geckoforge quality gates
# @update-policy Update when adding new validation rules or checks
# @version 0.4.1 - Added OPA policy checks

pre-commit:
  parallel: true
  commands:
    shellcheck:
      glob: "**/*.sh"
      run: |
        if command -v shellcheck >/dev/null 2>&1; then
          shellcheck {staged_files} || {
            echo "❌ ShellCheck failed"
            echo "Fix errors or add # shellcheck disable=SCXXXX with justification"
            exit 1
          }
        else
          echo "⚠️  shellcheck not installed - skipping"
        fi
    
    bash-syntax:
      glob: "**/*.sh"
      run: |
        for file in {staged_files}; do
          bash -n "$file" || {
            echo "❌ Bash syntax error in $file"
            exit 1
          }
        done
    
    nix-check:
      glob: "home/**/*.nix"
      run: |
        if command -v nix-instantiate >/dev/null 2>&1; then
          for file in {staged_files}; do
            nix-instantiate --parse "$file" > /dev/null || {
              echo "❌ Nix syntax error in $file"
              exit 1
            }
          done
        else
          echo "⚠️  nix-instantiate not available - skipping"
        fi
    
    xml-validate:
      glob: "profile/config.xml"
      run: |
        if command -v xmllint >/dev/null 2>&1; then
          xmllint --noout {staged_files} || {
            echo "❌ KIWI XML validation failed"
            exit 1
          }
        else
          echo "⚠️  xmllint not installed - skipping"
        fi
    
    anti-patterns:
      glob: "**/*.{sh,nix,md,xml}"
      run: tools/check-anti-patterns.sh
    
    opa-policy:
      glob: "**/*.{sh,nix,xml,service}"
      run: tools/opa-check.sh --staged
    
    executable-check:
      glob: "scripts/**/*.sh"
      run: |
        for file in {staged_files}; do
          if [ ! -x "$file" ]; then
            echo "❌ Script not executable: $file"
            echo "Run: chmod +x $file"
            exit 1
          fi
        done

pre-push:
  parallel: false
  commands:
    opa-full-check:
      run: tools/opa-check.sh --all
    
    validate-layers:
      run: tools/check-layer-assignments.sh
    
    docs-check:
      run: |
        today=$(date +%Y-%m-%d)
        month=$(date +%Y-%m)
        summary="docs/daily-summaries/$month/$today.md"
        
        if [ ! -f "$summary" ]; then
          echo "⚠️  Consider creating daily summary: $summary"
          echo "💡 Create with: touch $summary"
        fi