timothy
1df08e86bb
Build ErsatzTV Image / CI image pin matches docker/ci (pull_request) Successful in 5s
Build ErsatzTV Image / API docs in sync (OpenAPI + endpoint index) (pull_request) Successful in 10s
Build ErsatzTV Image / Docs update reminder (pull_request) Successful in 8s
Build ErsatzTV Image / Formatting (changed .cs conform to .editorconfig) (pull_request) Successful in 9s
Build ErsatzTV Image / decisions.md append-only (pull_request) Successful in 33s
Build ErsatzTV Image / Functional E2E (curl contracts) (pull_request) Successful in 14m51s
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 19m1s
Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 19m3s
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped
A file in the pushed diff that still has uncommitted working-tree/index changes means the pushed commit doesn't match what you built/reviewed — the #416 index/worktree trap, where a --no-renames review fix lived only in the working tree and shipped without being committed (CI, the push, and the reviewer each saw a different tree). New fail-open pre-push hook blocks that precisely (only files in the branch's diff vs origin/main), after the H11 rebase check. Escape: ETV_ALLOW_DIRTY_PUSH=1. Documented in decisions.md. Refs #416
29 lines
1.9 KiB
Plaintext
Executable File
29 lines
1.9 KiB
Plaintext
Executable File
# H6 merge-consent backstop (ersatztv#303): gate a direct push to main on the linked issue's
|
|
# ## Done-when checklist. Read git's pre-push ref lines FIRST (before the web checks below, which
|
|
# may consume stdin) and forward them. Fail-open: no creds / not main / docs-only -> allow.
|
|
_prepush_refs="$(cat)"
|
|
printf '%s\n' "$_prepush_refs" | ./.claude/hooks/prepush-donewhen.sh || exit 1
|
|
|
|
# Git exports GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE while running hooks. In a worktree
|
|
# (or any subdir), an explicit GIT_DIR makes nested `git` commands mislocate the working
|
|
# tree — notably `check:api`'s `git diff --exit-code` (run from web/) silently reports "no
|
|
# diff" and lets drift through. Unset them so nested git rediscovers the repo normally.
|
|
unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE
|
|
|
|
# H11 (ersatztv#311): refuse to push a branch that is BEHIND origin/main — rebase, don't merge
|
|
# main in (a merge drags in files you never touched, e.g. legacy-BOM .cs, and trips the format
|
|
# hook on code that isn't yours). Fail-open; escape with ETV_SKIP_REBASE_CHECK=1.
|
|
./.claude/hooks/prepush-rebase-check.sh || exit 1
|
|
|
|
# H13 (ersatztv#416 session): refuse to push when a file in the pushed diff still has uncommitted
|
|
# working-tree/index changes — the pushed commit wouldn't match what you built/reviewed (the #416
|
|
# index/worktree trap: a review fix left in the working tree shipped without being committed).
|
|
# Runs before the slow CI-parity checks so it fails fast. Fail-open; escape ETV_ALLOW_DIRTY_PUSH=1.
|
|
./.claude/hooks/prepush-clean-worktree-check.sh || exit 1
|
|
|
|
# CI-parity checks: catch "green locally, red in CI" before the push leaves the machine.
|
|
# check:api guards the generated OpenAPI types (v1.json / v1.d.ts drift); the full
|
|
# lint/typecheck/build catch a staged change that breaks an UNstaged file (lint-staged
|
|
# only sees staged files).
|
|
cd web && npm run check:api && npm run lint && npm run typecheck && npm run build
|