From 0de5f06f4323d74899f2ea436409597f50e4aba9 Mon Sep 17 00:00:00 2001
From: Jeroen Schweitzer <jpmschweitzer@gmail.com>
Date: Mon, 20 Apr 2026 22:14:12 +0200
Subject: [PATCH] add pre-push quality gate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

.githooks/pre-push runs make push-check, which aggregates the gates
that must pass before a push lands: Go lint, test, test-race, build,
test-integration, vuln, plus Flutter app-analyze and app-test. App-
side targets gracefully noop until Flutter is scaffolded, so the
gate is usable today without waiting on the app bootstrap.

Hooks are versioned under .githooks/ rather than the usual local
.git/hooks so the gate travels with the repo. `make hooks` wires
them up by pointing git core.hooksPath at the tracked directory —
one-time setup, documented in CLAUDE.md alongside `make tools`.

The hook prepends $GOBIN/$HOME/go/bin to PATH before invoking make,
so govulncheck / goimports / golangci-lint installed via `make tools`
resolve even when the user hasn't added that directory to their
login PATH.

The git-commit skill already forbids --no-verify, which is what keeps
this gate meaningful: "the hook is slow" is a reason to fix the slow
test, not to bypass the gate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .githooks/pre-push | 18 ++++++++++++++++++
 CHANGELOG.md       |  1 +
 2 files changed, 19 insertions(+)
 create mode 100755 .githooks/pre-push

diff --git a/.githooks/pre-push b/.githooks/pre-push
new file mode 100755
index 00000000..e5101045
--- /dev/null
+++ b/.githooks/pre-push
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Pre-push gate. Blocks the push if any quality check fails.
+#
+# Install: `make hooks` (points git core.hooksPath at .githooks/).
+# Bypass: never. If this runs slowly, fix the slow test; don't reach
+# for --no-verify (git-commit skill forbids it).
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+# `make tools` installs Go-installed binaries into $HOME/go/bin (or
+# $GOBIN if set). Users routinely forget to put that on PATH, so the
+# hook prepends it here to avoid spurious "command not found" failures
+# for govulncheck / goimports / golangci-lint.
+export PATH="${GOBIN:-$HOME/go/bin}:$PATH"
+
+echo "==> pre-push: make push-check"
+make push-check
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 513131cc..2b25c9fe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,6 +29,7 @@ heading, and (b) bumping `project.yaml` `version:` in the same commit.
   [ADR 0002](docs/ADRs/0002-sidecar-language-go.md) — Sidecar language: Go.
   [ADR 0003](docs/ADRs/0003-pql-as-supporter-tool.md) — pql as supporter tool; wrap, don't duplicate; pql is a Clide subsystem when present.
   [ADR 0004](docs/ADRs/0004-ignore-file-strategy.md) — Ignore file strategy (`ignore_files:` in `.pql/config.yaml`, layered).
+- Pre-push quality gate: `.githooks/pre-push` runs `make push-check` (lint + test + test-race + test-integration + vuln + app-analyze + app-test) so bad pushes are caught locally before they hit Gitea. The app-side targets gracefully noop until Flutter is scaffolded. Install with `make hooks` (sets `git config core.hooksPath .githooks`); the hook prepends `$GOBIN`/`$HOME/go/bin` to PATH so govulncheck resolves without the user touching their shell profile.
 - Go sidecar/CLI skeleton under `sidecar/` (module `git.schweitz.net/jpmschweitzer/clide/sidecar`): `cmd/clide/main.go`, `internal/cli` with a stdlib-flag dispatch, `internal/diag` mirroring pql's exit-code + stderr-JSON contract, `internal/version` with ldflag-stamped build info, and placeholder packages for `daemon`, `pty`, `proc`, `git`, `ipc`, `pql` awaiting their tier. `clide --version` emits JSON build-info today.
 - Root `Makefile` drives both the Go sidecar and the Flutter app under one toolchain. Version is read from `project.yaml` via awk and stamped into the sidecar via `-ldflags -X`. Flutter targets gracefully noop before the app is scaffolded so the Makefile is usable from day one. Pinned Go tooling (govulncheck, goimports, golangci-lint) installs via `make tools`.
 - `ci/` entry scripts: `test.sh`, `lint.sh` (includes the supply-chain gate — no green lint without a green CVE scan), `security.sh`, `release.sh` (stub).