lefthook.yml

# ── ToopSet — Lefthook Hooks ──────────────────────────────────────────────────
# Pre-commit: fast, staged-only checks (formatting, security, quick lint).
# Pre-push:   heavier validation (typecheck, full lint, build, backend checks).
# Tests are excluded from both — they require a running PostgreSQL database.
# CI is the final safety layer.
# ──────────────────────────────────────────────────────────────────────────────
# Docs: https://github.com/evilmartians/lefthook

# Hide meta (hook header) and execution (command itself) from per-command output.
# Success/failure/summary still shown.
output:
  - meta
  - execution

pre-commit:
  parallel: true
  commands:
    # ── General hygiene ────────────────────────────────────────────────────────
    trailing-whitespace:
      glob: "*.{py,ts,tsx,js,jsx,css,md,yml,yaml,json,mjs,mts,html,toml,cfg,ini,txt,sh,bat}"
      run: for f in {staged_files}; do sed -i '' 's/[[:space:]]*$//' "$f"; done
      stage_fixed: true

    eof-newline:
      glob: "*"
      run: |
        for f in {staged_files}; do
          [ -s "$f" ] && tail -c1 "$f" | read -r _ || printf '\n' >> "$f"
        done
      stage_fixed: true

    merge-conflict:
      glob: "*"
      run: |
        conflicts=$(grep -lP '^<<<<<<< |^=======$|^>>>>>>> ' {staged_files} 2>/dev/null || true)
        if [ -n "$conflicts" ]; then
          echo "✗ Merge conflict markers in: $conflicts"
          exit 1
        fi

    detect-private-key:
      glob: "*"
      run: |
        keys=$(grep -lP 'BEGIN\s+(RSA|DSA|EC|OPENSSH)\s+PRIVATE\s+KEY' {staged_files} 2>/dev/null || true)
        if [ -n "$keys" ]; then
          echo "✗ Private key detected in: $keys"
          exit 1
        fi

    lf-line-endings:
      glob: "*"
      run: |
        for f in {staged_files}; do
          grep -lP '\r\n' "$f" 2>/dev/null && sed -i '' 's/\r$//' "$f" || true
        done
      stage_fixed: true

    # ── Backend: Ruff format + lint (staged only) ─────────────────────────────
    ruff-format:
      glob: "backend/**/*.py"
      run: ruff format {staged_files}
      stage_fixed: true

    ruff-check:
      glob: "backend/**/*.py"
      run: ruff check --fix {staged_files}
      stage_fixed: true

    # ── Frontend: Prettier + ESLint (staged only) ─────────────────────────────
    prettier:
      glob: "frontend/**/*.{js,ts,jsx,tsx,css,json,md,mjs,mts}"
      run: cd frontend && npx prettier --write --ignore-unknown $(printf '%s\n' {staged_files} | sed 's|^frontend/||')
      stage_fixed: true

    eslint:
      glob: "frontend/**/*.{ts,tsx,js,jsx}"
      run: cd frontend && npx eslint --fix $(printf '%s\n' {staged_files} | sed 's|^frontend/||')
      stage_fixed: true


# ── Pre-push (heavier — run before pushing) ──────────────────────────────────
# These catch issues that wouldn't be spotted by staged-only checks.
# If any fails, fix it locally before pushing.
pre-push:
  parallel: false
  commands:
    # ── Frontend ────────────────────────────────────────────────────────────────
    typecheck:
      run: cd frontend && npx tsc --noEmit

    eslint-full:
      run: cd frontend && npx eslint .

    build:
      run: cd frontend && npx next build

    # ── Backend ─────────────────────────────────────────────────────────────────
    ruff-check-full:
      glob: "backend/**/*.py"
      run: cd backend && ruff check .

    ruff-format-check:
      glob: "backend/**/*.py"
      run: cd backend && ruff format --check .

    mypy:
      glob: "backend/**/*.py"
      run: cd backend && mypy app

    # ── CI config validation ───────────────────────────────────────────────────
    yaml-validate:
      glob: ".github/**/*.yml"
      run: python3 -c "import yaml; yaml.safe_load(open('{staged_files}')); print('  ✓ YAML valid')"

    # ── Migration revision check (static, no DB) ───────────────────────────────────────────────────
    migration-check:
      glob: "backend/migrations/versions/*.py"
      run: cd backend && python3 -m scripts.check_revisions --strict

    # ── Main-branch-only checks ─────────────────────────────────────────────────
    dep-audit:
      run: |
        if [ "$(git rev-parse --abbrev-ref HEAD)" = "main" ]; then
          npx --prefix frontend pnpm audit --audit-level=high || true
        else
          echo "  ─ Skipping dep audit on feature branch"
        fi

    env-validate:
      run: |
        if [ "$(git rev-parse --abbrev-ref HEAD)" = "main" ]; then
          [ -f .env ] && echo "  ✓ .env found" || echo "  ⚠ .env missing"
          [ -f backend/.env ] && echo "  ✓ backend/.env found" || echo "  ⚠ backend/.env missing"
        else
          echo "  ─ Skipping env check on feature branch"
        fi