jacobh2
f1abb0d2ef
Build Kvitt images / build (push) Failing after 51s
The server gate becomes cargo fmt --check && cargo clippy --all-targets -- -D warnings && cargo audit && cargo test (CLAUDE.md, server/README.md). The pre-commit hook runs cargo audit --no-fetch only when server/Cargo.lock or a server Cargo.toml is staged, and skips with a message when cargo-audit or the advisory database is missing. First run: 0 advisories, 0 warnings over 319 crates; no audit.toml needed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
51 lines
2.8 KiB
Bash
Executable File
51 lines
2.8 KiB
Bash
Executable File
#!/bin/sh
|
||
# Kvitt pre-commit hook: the fast subset of both gates. Installed by tools/install-git-hooks.sh.
|
||
# Each check runs only when its project exists, so the hook works on branches before android/ or server/ exist.
|
||
set -e
|
||
top=$(git rev-parse --show-toplevel)
|
||
|
||
# Secrets and personal data never reach git (CLAUDE.md › Never commit).
|
||
bad=$(git -C "$top" ls-files --cached -- '*local.properties' '*.jks' '*.keystore' '*.p12' '*.aar' 'models/' 'export/' \
|
||
'*service-account*.json' '*google-services.json' '*.pem' '*.sqlite' '*.db' 'infra/secrets/' | head -5)
|
||
if [ -n "$bad" ]; then
|
||
echo "pre-commit: a secret, keystore, vendor binary or personal-data file is staged or tracked:" >&2
|
||
echo "$bad" >&2
|
||
echo "Unstage with: git rm --cached <file>" >&2
|
||
exit 1
|
||
fi
|
||
|
||
# Android: the pure model tests, through the one-build-at-a-time lock, with JDK 25 first on PATH and JAVA_HOME
|
||
# untouched (CLAUDE.md › Build and verify); the shell's java may be a stub.
|
||
if [ -x "$top/android/gradlew" ] && [ -d "$top/android/core/model" ] && [ -x "$top/tools/gradle-serial.sh" ]; then
|
||
[ -d /opt/homebrew/opt/openjdk@25/bin ] && PATH="/opt/homebrew/opt/openjdk@25/bin:$PATH"
|
||
"$top/tools/gradle-serial.sh" --quiet :core:model:test :domain:test || {
|
||
echo "pre-commit: Android fast tests failed (see above). Run tools/gradle-serial.sh check for the full picture." >&2
|
||
exit 1
|
||
}
|
||
fi
|
||
|
||
# Server: the pure domain crate tests.
|
||
if [ -f "$top/server/Cargo.toml" ] && [ -d "$top/server/crates/kvitt-domain" ] && command -v cargo >/dev/null 2>&1; then
|
||
(cd "$top/server" && cargo test --quiet -p kvitt-domain) || {
|
||
echo "pre-commit: kvitt-domain tests failed (see above). Run the server gate for the full picture." >&2
|
||
exit 1
|
||
}
|
||
fi
|
||
|
||
# Server: cargo audit, only when a dependency changed (server/Cargo.lock or a Cargo.toml staged), so ordinary
|
||
# commits stay fast. Offline (--no-fetch: the advisory database in ~/.cargo/advisory-db as last fetched by the gate).
|
||
# A missing cargo-audit or a database never fetched skips the check with a message; it never fails the commit.
|
||
if [ -f "$top/server/Cargo.lock" ] && git -C "$top" diff --cached --name-only -- 'server/Cargo.lock' 'server/Cargo.toml' \
|
||
'server/**/Cargo.toml' | grep -q .; then
|
||
if ! command -v cargo-audit >/dev/null 2>&1; then
|
||
echo "pre-commit: cargo-audit is not installed; skipping the dependency audit (cargo install cargo-audit --locked)." >&2
|
||
elif [ ! -d "${CARGO_HOME:-$HOME/.cargo}/advisory-db" ]; then
|
||
echo "pre-commit: no advisory database yet; skipping the dependency audit (run cargo audit once from server/)." >&2
|
||
else
|
||
(cd "$top/server" && cargo audit --no-fetch --quiet) || {
|
||
echo "pre-commit: cargo audit found advisories in server/Cargo.lock (see above). Fix them, or see server/README.md." >&2
|
||
exit 1
|
||
}
|
||
fi
|
||
fi
|