mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-15 16:42:15 +00:00
rcourtman
eb5a477dc9
Canonical Governance failed on nearly every push today (6 of the last 8 commits) because the local pre-commit hook and the CI workflow disagreed about the canonical completion guard in two ways. Frontend-only commits skipped the guard entirely: the hook gated ALL governance checks behind governance-path detection as a perf optimization, but subsystem contracts name canonical frontend files, so those commits landed locally and failed the same guard in CI. The hook now always runs the (cheap) completion guard; only the multi-minute Go test and audit battery stays path-gated. Contract-neutral bypasses did not travel: PULSE_ALLOW_CONTRACT_NEUTRAL_COMMIT authorized the commit in the local shell and vanished, so CI re-ran the guard without it and went red. A new prepare-commit-msg hook records the reason as a Contract-Neutral trailer in the commit message, and the workflow now evaluates the guard per commit (each commit's file list against its own parent), honoring the trailer exactly as the commit-time hook honored the env var. Per-commit evaluation also stops a compliant commit from being blamed for range-mates. The new hook is registered as a worktree-sensitive governance file in governance_stage_guard.py with a matching unit test assert.
18 lines
768 B
Bash
18 lines
768 B
Bash
#!/usr/bin/env sh
|
|
|
|
set -eu
|
|
|
|
# Record the contract-neutral bypass in the commit itself. The canonical
|
|
# completion guard re-runs per commit on GitHub Actions, where the
|
|
# PULSE_ALLOW_CONTRACT_NEUTRAL_COMMIT env var from the local commit shell
|
|
# does not exist; this trailer is the auditable, machine-readable carrier
|
|
# the canonical-governance workflow reads back for each commit in the
|
|
# pushed range. Without it, every legitimately bypassed commit fails CI.
|
|
msg_file="$1"
|
|
reason="${PULSE_ALLOW_CONTRACT_NEUTRAL_COMMIT:-}"
|
|
reason=$(printf '%s' "$reason" | tr '\n' ' ' | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
|
|
if [ -n "$reason" ]; then
|
|
git interpret-trailers --in-place --if-exists replace \
|
|
--trailer "Contract-Neutral: $reason" "$msg_file"
|
|
fi
|