|
| 1 | +#!/usr/bin/env python3 |
| 2 | +# SPDX-License-Identifier: Apache-2.0 |
| 3 | + |
| 4 | +"""Install local STRIX git hooks for public-surface and upstream safety checks.""" |
| 5 | + |
| 6 | +from __future__ import annotations |
| 7 | + |
| 8 | +import argparse |
| 9 | +import os |
| 10 | +import stat |
| 11 | +import subprocess |
| 12 | +import sys |
| 13 | +from pathlib import Path |
| 14 | + |
| 15 | + |
| 16 | +ROOT = Path(__file__).resolve().parents[1] |
| 17 | +HOOK_NAMES = ("pre-commit", "pre-push") |
| 18 | + |
| 19 | + |
| 20 | +def default_git_dir() -> Path: |
| 21 | + output = subprocess.check_output(["git", "rev-parse", "--git-dir"], cwd=ROOT, text=True).strip() |
| 22 | + git_dir = Path(output) |
| 23 | + if not git_dir.is_absolute(): |
| 24 | + git_dir = ROOT / git_dir |
| 25 | + return git_dir |
| 26 | + |
| 27 | + |
| 28 | +def hook_body(name: str) -> str: |
| 29 | + if name == "pre-commit": |
| 30 | + return """#!/bin/sh |
| 31 | +set -eu |
| 32 | +
|
| 33 | +repo_root="$(git rev-parse --show-toplevel)" |
| 34 | +cd "$repo_root" |
| 35 | +
|
| 36 | +python_cmd="${PYTHON:-python3}" |
| 37 | +if ! command -v "$python_cmd" >/dev/null 2>&1; then |
| 38 | + python_cmd=python |
| 39 | +fi |
| 40 | +
|
| 41 | +"$python_cmd" scripts/verify_public_surface.py |
| 42 | +
|
| 43 | +if git diff --cached --name-only | grep -Eq '(^|/)strix-release-authority\\.json$'; then |
| 44 | + echo "Refusing to commit local STRIX release authority state." >&2 |
| 45 | + exit 1 |
| 46 | +fi |
| 47 | +""" |
| 48 | + if name == "pre-push": |
| 49 | + return """#!/bin/sh |
| 50 | +set -eu |
| 51 | +
|
| 52 | +repo_root="$(git rev-parse --show-toplevel)" |
| 53 | +cd "$repo_root" |
| 54 | +
|
| 55 | +python_cmd="${PYTHON:-python3}" |
| 56 | +if ! command -v "$python_cmd" >/dev/null 2>&1; then |
| 57 | + python_cmd=python |
| 58 | +fi |
| 59 | +
|
| 60 | +"$python_cmd" scripts/verify_public_surface.py |
| 61 | +
|
| 62 | +while read local_ref local_oid remote_ref remote_oid; do |
| 63 | + case "$remote_ref" in |
| 64 | + refs/heads/main|refs/heads/master) |
| 65 | + if [ "${STRIX_ALLOW_MAIN_PUSH:-}" != "1" ]; then |
| 66 | + echo "Direct push to protected branch blocked by local STRIX hook." >&2 |
| 67 | + echo "Push a PR branch, or set STRIX_ALLOW_MAIN_PUSH=1 for an intentional maintainer release." >&2 |
| 68 | + exit 1 |
| 69 | + fi |
| 70 | + ;; |
| 71 | + esac |
| 72 | +done |
| 73 | +""" |
| 74 | + raise ValueError(f"unknown hook: {name}") |
| 75 | + |
| 76 | + |
| 77 | +def install_hooks(git_dir: Path, force: bool) -> list[Path]: |
| 78 | + hooks_dir = git_dir / "hooks" |
| 79 | + hooks_dir.mkdir(parents=True, exist_ok=True) |
| 80 | + |
| 81 | + written: list[Path] = [] |
| 82 | + for name in HOOK_NAMES: |
| 83 | + hook_path = hooks_dir / name |
| 84 | + if hook_path.exists() and not force: |
| 85 | + raise SystemExit(f"{hook_path} already exists; pass --force to replace it") |
| 86 | + |
| 87 | + hook_path.write_text(hook_body(name), encoding="utf-8") |
| 88 | + current_mode = hook_path.stat().st_mode |
| 89 | + hook_path.chmod(current_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH) |
| 90 | + written.append(hook_path) |
| 91 | + |
| 92 | + return written |
| 93 | + |
| 94 | + |
| 95 | +def parse_args() -> argparse.Namespace: |
| 96 | + parser = argparse.ArgumentParser(description=__doc__) |
| 97 | + parser.add_argument("--git-dir", type=Path, help="Override the target .git directory") |
| 98 | + parser.add_argument("--force", action="store_true", help="Replace existing local hooks") |
| 99 | + return parser.parse_args() |
| 100 | + |
| 101 | + |
| 102 | +def main() -> int: |
| 103 | + args = parse_args() |
| 104 | + git_dir = args.git_dir if args.git_dir is not None else default_git_dir() |
| 105 | + written = install_hooks(git_dir, args.force) |
| 106 | + for hook_path in written: |
| 107 | + print(hook_path) |
| 108 | + return 0 |
| 109 | + |
| 110 | + |
| 111 | +if __name__ == "__main__": |
| 112 | + try: |
| 113 | + raise SystemExit(main()) |
| 114 | + except subprocess.CalledProcessError as exc: |
| 115 | + print(f"git command failed: {exc}", file=sys.stderr) |
| 116 | + raise SystemExit(1) from exc |
0 commit comments