chore(hooks): scope integ-local-gate to PRs that touch local-execution code - #845
Merged
Conversation
…n code integ-local-gate.sh verified the integ-local marker UNCONDITIONALLY on every `gh pr merge` / `git merge`, unlike its sibling integ-destroy-gate and integ-broad-gate which first check whether the merged PR's diff actually touches their scope. Because the integ-local marker is file-scoped AND carries a 14d TTL, a marker that has aged out (or been invalidated by an unrelated src/local change already on main) blocked EVERY merge -- including pure src/provisioning PRs that touch no local code at all. Add the PR-diff scope guard the siblings already have: for `gh pr merge <N>` the hook now fetches the PR file list via `gh pr view <N> --json files` and passes the merge through when no path matches the local-execution scope (^src/local/|^src/cli/commands/local-*.ts$|^tests/integration/local-). `git merge` and number-less `gh pr merge` fall through to the unconditional verify since the incoming diff cannot be cheaply enumerated. Fail-open on a `gh pr view` error (infra outage must not block merges), mirroring integ-broad-gate. Adds 4 smoke-test cases (non-local pass-through, src/local file gate, tests/integration/local- file gate, gh-failure fail-open) and updates the hooks.md gate description. No src change.
|
🎉 This PR is included in version 0.221.3 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
integ-local-gate.shverified theinteg-localmarker UNCONDITIONALLY on everygh pr merge/git merge, unlike its sibling gatesinteg-destroy-gate.shandinteg-broad-gate.sh, which first check whether the merged PR's diff actually touches their scope before consulting the marker.Because the
integ-localmarker is file-scoped AND carries a 14-day TTL, a marker that has aged out (or been invalidated by an unrelatedsrc/localchange already on main) blocked EVERY merge — including puresrc/provisioningPRs that touch no local-execution code at all. This surfaced while merging a Cloud Control RDS provider fix: the gate demanded a Dockerlocal-invokerun for a PR that has nothing to do with local execution.Fix
Add the PR-diff scope guard the sibling gates already have. For
gh pr merge <N>the hook fetches the PR file list viagh pr view <N> --json filesand passes the merge through when no path matches the local-execution scope:git mergeand number-lessgh pr mergefall through to the unconditional verify (the incoming diff cannot be cheaply enumerated). Fail-open on agh pr viewerror so an infra outage never blocks merges, mirroringinteg-broad-gate.sh.This makes the hook match its own documented intent (CLAUDE.md already says it blocks "any PR that touches
src/local/**...").Tests
4 new smoke cases in
integ-local-gate.test.sh(20/20 pass): non-local-files pass-through,src/localfile gate-fires,tests/integration/local-file gate-fires,gh pr viewfailure fail-open. Hook header +.claude/rules/hooks.mdgate description updated. Nosrcchange.