2GT-RichandClaude Opus 4.8
d44a0ea8a7
Security Audit failed on a newly-published advisory, GHSA-2m8v-j782-fhvr (socket.io-parser "Zero-attachment Memory Exhaustion", high). It affected both projects transitively via socket.io / socket.io-client. Patched to 4.2.7 in both lockfiles; no direct dependency versions changed. Also adds the gate that should have caught the previous two CI failures before they reached GitHub: - scripts/ci-preflight.sh runs every gate from .github/workflows/ci.yml (frontend and backend lint/type-check/build, plus both prod-dependency audits with the same audit-ci flags and allowlist) and additionally the backend Jest suite, which CI does not currently run. It runs all gates rather than failing fast, so one invocation surfaces every problem. ~35s. - scripts/claude-push-gate.sh wires that into a Claude Code PreToolUse hook so a `git push` is refused while any gate fails, with the failure detail returned inline. Non-push commands and --dry-run pass straight through. Verified: with the fix reverted, the gate correctly denied the push and reported "backend: lint FAIL"; with it restored, all 9 gates pass and both audit-ci invocations exit 0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
49 lines
1.5 KiB
Bash
Executable File
49 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Claude Code PreToolUse(Bash) hook: refuse `git push` until the local CI gates pass.
|
|
#
|
|
# Reads the hook payload on stdin. Non-push commands exit immediately, so the
|
|
# overhead on ordinary Bash calls is one short script invocation.
|
|
#
|
|
# On failure it emits a PreToolUse deny decision, which blocks the push and hands
|
|
# the reason back to the model so it can fix the problem instead of retrying.
|
|
|
|
set -uo pipefail
|
|
|
|
PAYLOAD="$(cat)"
|
|
CMD="$(printf '%s' "$PAYLOAD" | jq -r '.tool_input.command // ""' 2>/dev/null)"
|
|
|
|
# Only gate actual pushes (covers `git push`, `git -C <dir> push`, flags, etc.).
|
|
# Deliberately ignores --dry-run.
|
|
if ! printf '%s' "$CMD" | grep -Eq '(^|[;&|]|\s)git(\s+-[^;&|]*)?\s+push(\s|$)'; then
|
|
exit 0
|
|
fi
|
|
if printf '%s' "$CMD" | grep -q -- '--dry-run'; then
|
|
exit 0
|
|
fi
|
|
|
|
REPO="/Users/rteslow/mikrotik-manager"
|
|
[[ -x "$REPO/scripts/ci-preflight.sh" ]] || exit 0 # nothing to enforce
|
|
|
|
if OUTPUT="$("$REPO/scripts/ci-preflight.sh" 2>&1)"; then
|
|
exit 0
|
|
fi
|
|
|
|
DETAIL="$(tail -60 /tmp/ci-preflight-failures 2>/dev/null)"
|
|
python3 - "$OUTPUT" "$DETAIL" <<'PY'
|
|
import json, sys
|
|
summary, detail = sys.argv[1], sys.argv[2]
|
|
reason = (
|
|
"Push blocked: the local CI gates failed, so this would fail on GitHub too.\n\n"
|
|
f"{summary.strip()}\n\n{detail.strip()}\n\n"
|
|
"Fix these, re-run scripts/ci-preflight.sh until it passes, then push."
|
|
)
|
|
print(json.dumps({
|
|
"hookSpecificOutput": {
|
|
"hookEventName": "PreToolUse",
|
|
"permissionDecision": "deny",
|
|
"permissionDecisionReason": reason,
|
|
}
|
|
}))
|
|
PY
|
|
exit 0
|