diff options
Diffstat (limited to '.githooks/pre-commit')
| -rwxr-xr-x | .githooks/pre-commit | 28 |
1 files changed, 20 insertions, 8 deletions
diff --git a/.githooks/pre-commit b/.githooks/pre-commit index 32b492a..4a3bcc5 100755 --- a/.githooks/pre-commit +++ b/.githooks/pre-commit @@ -9,23 +9,23 @@ fail() { exit 1 } -echo "== [1/8] Build ==" +echo "== [1/9] Build ==" ./gradlew :app:compileDebugKotlin -q -echo "== [2/8] Tests ==" +echo "== [2/9] Tests ==" ./gradlew :app:testDebugUnitTest -q -echo "== [3/8] Static analysis: lint ==" +echo "== [3/9] Static analysis: lint ==" if ! ./gradlew :app:lintDebug -q; then fail "lint failed -- fix all lint ERRORS before committing (warnings are fine to accumulate, see CLAUDE.md)." fi -echo "== [4/8] Static analysis: detekt (code-quality auditor) ==" +echo "== [4/9] Static analysis: detekt (code-quality auditor) ==" if ! ./gradlew :app:detekt -q; then fail "detekt found new issues beyond the tracked baseline. Fix them, or if they're genuinely pre-existing debt being touched incidentally, regenerate the baseline with './gradlew :app:detektBaseline' and explain why in the commit message." fi -echo "== [5/8] Coverage must not decrease ==" +echo "== [5/9] Coverage must not decrease ==" ./gradlew :app:jacocoTestReport -q REPORT="app/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml" BASELINE_FILE=".coverage-baseline" @@ -59,7 +59,7 @@ else echo "pre-commit: coverage ${BASELINE}% -> ${CURRENT}%" fi -echo "== [6/8] WebView JavaScript justification ==" +echo "== [6/9] WebView JavaScript justification ==" STAGED_KT=$(git diff --cached --name-only --diff-filter=ACM -- '*.kt' || true) if [ -n "$STAGED_KT" ]; then for f in $STAGED_KT; do @@ -73,14 +73,14 @@ if [ -n "$STAGED_KT" ]; then done fi -echo "== [7/8] Manifest permission diff ==" +echo "== [7/9] Manifest permission diff ==" if git diff --cached --name-only | grep -q '^app/src/main/AndroidManifest.xml$'; then if git diff --cached -- app/src/main/AndroidManifest.xml | grep -qE '^\+.*<uses-permission'; then echo "pre-commit: WARNING -- AndroidManifest.xml adds a new <uses-permission>. Make sure the commit message says why." fi fi -echo "== [8/8] Secret scan ==" +echo "== [8/9] Secret scan ==" if [ -z "${SECRET_SCAN_OVERRIDE:-}" ]; then SECRET_HIT=$(git diff --cached -U0 -- . ':!*.lock' | grep -E '^\+' | grep -viE '^\+\+\+' | grep -E '(api[_-]?key|secret|password|token)["'\'' ]*[:=]["'\'' ]*[A-Za-z0-9_\-]{16,}' || true) if [ -n "$SECRET_HIT" ]; then @@ -91,4 +91,16 @@ else echo "pre-commit: secret scan skipped (SECRET_SCAN_OVERRIDE set)" fi +echo "== [9/9] Exported Room schemas are append-only ==" +# A schema JSON already committed describes a database version that exists on a phone. Room +# rewrites the file for whatever version the @Database annotation declares, so editing an entity +# before bumping that number silently overwrites the record of the old shape -- and the migration +# test then validates happily against a schema that never shipped. It happened twice building +# Phase 2, and a note in CLAUDE.md did not prevent the second time. +SCHEMA_EDITS=$(git diff --cached --name-only --diff-filter=M -- 'app/schemas/**/*.json' || true) +if [ -n "$SCHEMA_EDITS" ]; then + echo "$SCHEMA_EDITS" >&2 + fail "an already-committed Room schema was modified (see above). Bump the database version first so a new file is written, then restore these with: git checkout -- app/schemas/" +fi + echo "pre-commit: all checks passed." |