feat: add lefthook support

Add support for lefthook.
Executes fmt, generate, lint, and conformance make targets on commit (at
different stages).

Signed-off-by: Maja Bojarska <maja.bojarska@siderolabs.com>

Author: majabojarska

Makefile

@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-05-26T16:46:25Z by kres c267185-dirty.
+# Generated on 2026-05-28T15:40:14Z by kres 80fec4e.
 
 # common variables
 
@@ -214,7 +214,7 @@ lint-gofumpt:  ## Runs gofumpt linter.
 
 .PHONY: fmt
 fmt:  ## Formats the source code
-	@docker run --rm -it -v $(PWD):/src -w /src golang:$(GO_VERSION) \
+	@docker run --rm -v $(PWD):/src -w /src golang:$(GO_VERSION) \
 		bash -c "export GOTOOLCHAIN=local; \
 		export GO111MODULE=on; export GOPROXY=https://proxy.golang.org; \
 		go install mvdan.cc/gofumpt@$(GOFUMPT_VERSION) && \
@@ -335,7 +335,7 @@ release-notes: $(ARTIFACTS)
 .PHONY: conformance
 conformance:
 	@docker pull $(CONFORMANCE_IMAGE)
-	@docker run --rm -it -v $(PWD):/src -w /src $(CONFORMANCE_IMAGE) enforce
+	@docker run --rm -v $(PWD):/src -w /src $(CONFORMANCE_IMAGE) enforce
 
 .PHONY: renovate-local
 renovate-local:  ## runs renovate locally to check syntax and test configuration

cmd/kres/cmd/gen.go

@@ -19,6 +19,7 @@ import (
 	"github.com/siderolabs/kres/internal/output/github"
 	"github.com/siderolabs/kres/internal/output/gitignore"
 	"github.com/siderolabs/kres/internal/output/golangci"
+	"github.com/siderolabs/kres/internal/output/lefthook"
 	"github.com/siderolabs/kres/internal/output/license"
 	"github.com/siderolabs/kres/internal/output/makefile"
 	"github.com/siderolabs/kres/internal/output/markdownlint"
@@ -76,6 +77,7 @@ func runGen() error {
 		output.Wrap(sops.NewOutput()),
 		output.Wrap(renovate.NewOutput()),
 		output.Wrap(conform.NewOutput()),
+		output.Wrap(lefthook.NewOutput()),
 	}
 
 	if !options.CompileGithubWorkflowsOnly {

internal/output/lefthook/command.go

@@ -0,0 +1,81 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package lefthook
+
+// Command represents a single named command under a hook's commands: map.
+type Command struct { //nolint:govet
+	Run         string   `yaml:"run"`
+	Tags        []string `yaml:"tags,omitempty"`
+	Glob        string   `yaml:"glob,omitempty"`
+	Files       string   `yaml:"files,omitempty"`
+	Skip        []string `yaml:"skip,omitempty"`
+	Only        []string `yaml:"only,omitempty"`
+	Interactive bool     `yaml:"interactive,omitempty"`
+	StageFixed  bool     `yaml:"stage_fixed,omitempty"`
+	Priority    int      `yaml:"priority,omitempty"`
+}
+
+// WithRun sets the shell command lefthook executes for this command.
+func (c *Command) WithRun(run string) *Command {
+	c.Run = run
+
+	return c
+}
+
+// WithTags attaches tags used for selective hook execution (lefthook --tags ...).
+func (c *Command) WithTags(tags ...string) *Command {
+	c.Tags = tags
+
+	return c
+}
+
+// WithGlob restricts the command to files matching the given glob.
+func (c *Command) WithGlob(glob string) *Command {
+	c.Glob = glob
+
+	return c
+}
+
+// WithFiles overrides the default file source (e.g. "git diff --name-only ...").
+func (c *Command) WithFiles(files string) *Command {
+	c.Files = files
+
+	return c
+}
+
+// WithSkip lists git states or refs where the command should be skipped (e.g. "merge", "rebase").
+func (c *Command) WithSkip(skip ...string) *Command {
+	c.Skip = skip
+
+	return c
+}
+
+// WithOnly is the inverse of WithSkip: command runs only in the listed states.
+func (c *Command) WithOnly(only ...string) *Command {
+	c.Only = only
+
+	return c
+}
+
+// WithInteractive marks the command as needing a TTY (stdin/stdout passthrough).
+func (c *Command) WithInteractive() *Command {
+	c.Interactive = true
+
+	return c
+}
+
+// WithStageFixed re-stages files modified by the command (useful for formatters).
+func (c *Command) WithStageFixed() *Command {
+	c.StageFixed = true
+
+	return c
+}
+
+// WithPriority sets the command's run order within its hook (lower runs first).
+func (c *Command) WithPriority(priority int) *Command {
+	c.Priority = priority
+
+	return c
+}

internal/output/lefthook/group.go

@@ -0,0 +1,39 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package lefthook
+
+// Group is a container for nested Jobs with its own parallel/piped semantics.
+// Used to express "run these in parallel, then those sequentially" without
+// touching the hook-level execution model.
+type Group struct { //nolint:govet
+	// Parallel is a pointer so an explicit `parallel: false` can be emitted
+	// (the bool zero value would otherwise be suppressed by omitempty).
+	Parallel *bool  `yaml:"parallel,omitempty"`
+	Piped    bool   `yaml:"piped,omitempty"`
+	Jobs     []*Job `yaml:"jobs,omitempty"`
+}
+
+// WithParallel toggles parallel execution of this group's jobs.
+func (g *Group) WithParallel(parallel bool) *Group {
+	g.Parallel = &parallel
+
+	return g
+}
+
+// WithPiped enables piped (sequential, fail-fast, stdout-chained) execution.
+func (g *Group) WithPiped(piped bool) *Group {
+	g.Piped = piped
+
+	return g
+}
+
+// Job appends a new job to the group and returns it for further configuration.
+func (g *Group) Job() *Job {
+	j := &Job{}
+
+	g.Jobs = append(g.Jobs, j)
+
+	return j
+}

internal/output/lefthook/hook.go

@@ -0,0 +1,61 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package lefthook
+
+// Hook represents the configuration for a single git hook (e.g. pre-commit)
+// inside lefthook.yml. A hook can declare either Commands (a named map) or
+// Jobs (an ordered list with nested groups) — see lefthook docs for the
+// trade-off; mixing both in a single hook is generally not recommended.
+type Hook struct { //nolint:govet
+	// Parallel is a pointer so an explicit `parallel: false` can be emitted
+	// (with a plain bool + omitempty the false zero-value would be suppressed).
+	// Only meaningful for Commands-style hooks; Jobs-style hooks control
+	// parallelism per-Group.
+	Parallel *bool               `yaml:"parallel,omitempty"`
+	Piped    bool                `yaml:"piped,omitempty"`
+	Commands map[string]*Command `yaml:"commands,omitempty"`
+	Jobs     []*Job              `yaml:"jobs,omitempty"`
+}
+
+// WithParallel sets the hook-level parallel flag (Commands-style hooks only).
+func (h *Hook) WithParallel(parallel bool) *Hook {
+	h.Parallel = &parallel
+
+	return h
+}
+
+// WithPiped enables piped (sequential, fail-fast) execution of this hook's commands.
+func (h *Hook) WithPiped(piped bool) *Hook {
+	h.Piped = piped
+
+	return h
+}
+
+// Command returns the named command on this hook, creating it on first access.
+func (h *Hook) Command(name string) *Command {
+	if c, ok := h.Commands[name]; ok {
+		return c
+	}
+
+	if h.Commands == nil {
+		h.Commands = map[string]*Command{}
+	}
+
+	c := &Command{}
+	h.Commands[name] = c
+
+	return c
+}
+
+// Job appends a new job to this hook's Jobs list and returns it for further
+// configuration. Each top-level entry runs in declaration order; use AsGroup
+// on the returned job to nest a parallel/sequential group of inner jobs.
+func (h *Hook) Job() *Job {
+	j := &Job{}
+
+	h.Jobs = append(h.Jobs, j)
+
+	return j
+}

internal/output/lefthook/job.go

@@ -0,0 +1,132 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package lefthook
+
+// Job is an entry under a hook's or group's jobs: list. Each Job either runs
+// a command directly (via Run or Script) or wraps a nested Group.
+type Job struct { //nolint:govet
+	Name        string            `yaml:"name,omitempty"`
+	Run         string            `yaml:"run,omitempty"`
+	Script      string            `yaml:"script,omitempty"`
+	Tags        []string          `yaml:"tags,omitempty"`
+	Glob        []string          `yaml:"glob,omitempty"`
+	Exclude     []string          `yaml:"exclude,omitempty"`
+	Root        string            `yaml:"root,omitempty"`
+	Env         map[string]string `yaml:"env,omitempty"`
+	Skip        []string          `yaml:"skip,omitempty"`
+	Only        []string          `yaml:"only,omitempty"`
+	Interactive bool              `yaml:"interactive,omitempty"`
+	StageFixed  bool              `yaml:"stage_fixed,omitempty"`
+	Priority    int               `yaml:"priority,omitempty"`
+	Group       *Group            `yaml:"group,omitempty"`
+}
+
+// WithName sets the job's display name.
+func (j *Job) WithName(name string) *Job {
+	j.Name = name
+
+	return j
+}
+
+// WithRun sets the shell command to execute for this job.
+func (j *Job) WithRun(run string) *Job {
+	j.Run = run
+
+	return j
+}
+
+// WithScript sets a script file to execute (relative to lefthook source_dir).
+func (j *Job) WithScript(script string) *Job {
+	j.Script = script
+
+	return j
+}
+
+// WithTags attaches selectable tags (lefthook --tags ...).
+func (j *Job) WithTags(tags ...string) *Job {
+	j.Tags = tags
+
+	return j
+}
+
+// WithGlob restricts the job to files matching the given glob(s).
+func (j *Job) WithGlob(glob ...string) *Job {
+	j.Glob = glob
+
+	return j
+}
+
+// WithExclude is the inverse of WithGlob: skip files matching these patterns.
+func (j *Job) WithExclude(exclude ...string) *Job {
+	j.Exclude = exclude
+
+	return j
+}
+
+// WithRoot changes the working directory for the job.
+func (j *Job) WithRoot(root string) *Job {
+	j.Root = root
+
+	return j
+}
+
+// WithEnv sets an environment variable on the job; safe to call multiple times.
+func (j *Job) WithEnv(name, value string) *Job {
+	if j.Env == nil {
+		j.Env = map[string]string{}
+	}
+
+	j.Env[name] = value
+
+	return j
+}
+
+// WithSkip lists git states or refs where the job should be skipped (e.g. "merge", "rebase").
+func (j *Job) WithSkip(skip ...string) *Job {
+	j.Skip = skip
+
+	return j
+}
+
+// WithOnly is the inverse of WithSkip: job runs only in the listed states.
+func (j *Job) WithOnly(only ...string) *Job {
+	j.Only = only
+
+	return j
+}
+
+// WithInteractive marks the job as needing a TTY (stdin/stdout passthrough).
+func (j *Job) WithInteractive() *Job {
+	j.Interactive = true
+
+	return j
+}
+
+// WithStageFixed re-stages files modified by the job (useful for formatters).
+func (j *Job) WithStageFixed() *Job {
+	j.StageFixed = true
+
+	return j
+}
+
+// WithPriority sets the job's run order within its container (lower runs first).
+func (j *Job) WithPriority(priority int) *Job {
+	j.Priority = priority
+
+	return j
+}
+
+// AsGroup turns this job into a container for a nested Group, creating the
+// group on first call and returning it for chained configuration. The job's
+// Run/Script fields are typically left empty when AsGroup is used.
+func (j *Job) AsGroup() *Group {
+	if j.Group != nil {
+		return j.Group
+	}
+
+	j.Group = &Group{}
+
+	return j.Group
+}