feat: add lefthook support

Add support for lefthook.
Executes fmt, generate, lint, and conformance make targets on commit (at
different stages).

Signed-off-by: Maja Bojarska <maja.bojarska@siderolabs.com>

Author: majabojarska

Makefile

@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-05-26T16:46:25Z by kres c267185-dirty.
+# Generated on 2026-05-28T15:40:14Z by kres 80fec4e.
 
 # common variables
 
@@ -214,7 +214,7 @@ lint-gofumpt:  ## Runs gofumpt linter.
 
 .PHONY: fmt
 fmt:  ## Formats the source code
-	@docker run --rm -it -v $(PWD):/src -w /src golang:$(GO_VERSION) \
+	@docker run --rm -v $(PWD):/src -w /src golang:$(GO_VERSION) \
 		bash -c "export GOTOOLCHAIN=local; \
 		export GO111MODULE=on; export GOPROXY=https://proxy.golang.org; \
 		go install mvdan.cc/gofumpt@$(GOFUMPT_VERSION) && \
@@ -335,7 +335,7 @@ release-notes: $(ARTIFACTS)
 .PHONY: conformance
 conformance:
 	@docker pull $(CONFORMANCE_IMAGE)
-	@docker run --rm -it -v $(PWD):/src -w /src $(CONFORMANCE_IMAGE) enforce
+	@docker run --rm -v $(PWD):/src -w /src $(CONFORMANCE_IMAGE) enforce
 
 .PHONY: renovate-local
 renovate-local:  ## runs renovate locally to check syntax and test configuration

cmd/kres/cmd/gen.go

@@ -19,6 +19,7 @@ import (
 	"github.com/siderolabs/kres/internal/output/github"
 	"github.com/siderolabs/kres/internal/output/gitignore"
 	"github.com/siderolabs/kres/internal/output/golangci"
+	"github.com/siderolabs/kres/internal/output/lefthook"
 	"github.com/siderolabs/kres/internal/output/license"
 	"github.com/siderolabs/kres/internal/output/makefile"
 	"github.com/siderolabs/kres/internal/output/markdownlint"
@@ -91,6 +92,7 @@ func runGen() error {
 			output.Wrap(release.NewOutput()),
 			output.Wrap(markdownlint.NewOutput()),
 			output.Wrap(template.NewOutput()),
+			output.Wrap(lefthook.NewOutput()),
 		)
 	}
 

internal/output/lefthook/command.go

@@ -0,0 +1,81 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package lefthook
+
+// Command represents a single named command under a hook's commands: map.
+type Command struct { //nolint:govet
+	Run         string   `yaml:"run"`
+	Tags        []string `yaml:"tags,omitempty"`
+	Glob        string   `yaml:"glob,omitempty"`
+	Files       string   `yaml:"files,omitempty"`
+	Skip        []string `yaml:"skip,omitempty"`
+	Only        []string `yaml:"only,omitempty"`
+	Interactive bool     `yaml:"interactive,omitempty"`
+	StageFixed  bool     `yaml:"stage_fixed,omitempty"`
+	Priority    int      `yaml:"priority,omitempty"`
+}
+
+// WithRun sets the shell command lefthook executes for this command.
+func (c *Command) WithRun(run string) *Command {
+	c.Run = run
+
+	return c
+}
+
+// WithTags attaches tags used for selective hook execution (lefthook --tags ...).
+func (c *Command) WithTags(tags ...string) *Command {
+	c.Tags = tags
+
+	return c
+}
+
+// WithGlob restricts the command to files matching the given glob.
+func (c *Command) WithGlob(glob string) *Command {
+	c.Glob = glob
+
+	return c
+}
+
+// WithFiles overrides the default file source (e.g. "git diff --name-only ...").
+func (c *Command) WithFiles(files string) *Command {
+	c.Files = files
+
+	return c
+}
+
+// WithSkip lists git states or refs where the command should be skipped (e.g. "merge", "rebase").
+func (c *Command) WithSkip(skip ...string) *Command {
+	c.Skip = skip
+
+	return c
+}
+
+// WithOnly is the inverse of WithSkip: command runs only in the listed states.
+func (c *Command) WithOnly(only ...string) *Command {
+	c.Only = only
+
+	return c
+}
+
+// WithInteractive marks the command as needing a TTY (stdin/stdout passthrough).
+func (c *Command) WithInteractive() *Command {
+	c.Interactive = true
+
+	return c
+}
+
+// WithStageFixed re-stages files modified by the command (useful for formatters).
+func (c *Command) WithStageFixed() *Command {
+	c.StageFixed = true
+
+	return c
+}
+
+// WithPriority sets the command's run order within its hook (lower runs first).
+func (c *Command) WithPriority(priority int) *Command {
+	c.Priority = priority
+
+	return c
+}

internal/output/lefthook/config.go

@@ -0,0 +1,70 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package lefthook
+
+// Config is a declarative description of lefthook.yml contributions, suitable
+// for unmarshalling from a kres.yaml block.
+//
+// Hooks reuse the very same builder types (Hook, Command, Job, Group) that
+// serialize lefthook.yml, so the config is authored in lefthook's native schema
+// and there is a single definitive set of types for both serializing the output
+// and deserializing the config.
+type Config struct {
+	Hooks   map[string]*Hook `yaml:"hooks"`
+	Enabled bool             `yaml:"enabled"`
+}
+
+// Compile merges the configured hooks into the output. It is a no-op when the
+// config is disabled.
+func (c Config) Compile(output *Output) error {
+	if !c.Enabled {
+		return nil
+	}
+
+	for name, cfgHook := range c.Hooks {
+		if cfgHook == nil {
+			continue
+		}
+
+		hook := output.Hook(name)
+
+		if cfgHook.Parallel != nil {
+			hook.WithParallel(*cfgHook.Parallel)
+		}
+
+		if cfgHook.Piped {
+			hook.WithPiped(true)
+		}
+
+		for cmdName, cmd := range cfgHook.Commands {
+			*hook.Command(cmdName) = *cmd
+		}
+
+		for _, job := range cfgHook.Jobs {
+			// A named job wrapping a group is merged into the hook's group of
+			// the same name, so a config can extend the shared fix/lint groups
+			// emitted by the standard blocks instead of forking a new one.
+			if job.Group != nil && job.Name != "" {
+				group := hook.Group(job.Name)
+
+				if job.Group.Parallel != nil {
+					group.WithParallel(*job.Group.Parallel)
+				}
+
+				if job.Group.Piped {
+					group.WithPiped(true)
+				}
+
+				group.Jobs = append(group.Jobs, job.Group.Jobs...)
+
+				continue
+			}
+
+			hook.Jobs = append(hook.Jobs, job)
+		}
+	}
+
+	return nil
+}

internal/output/lefthook/group.go

@@ -0,0 +1,39 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package lefthook
+
+// Group is a container for nested Jobs with its own parallel/piped semantics.
+// Used to express "run these in parallel, then those sequentially" without
+// touching the hook-level execution model.
+type Group struct { //nolint:govet
+	// Parallel is a pointer so an explicit `parallel: false` can be emitted
+	// (the bool zero value would otherwise be suppressed by omitempty).
+	Parallel *bool  `yaml:"parallel,omitempty"`
+	Piped    bool   `yaml:"piped,omitempty"`
+	Jobs     []*Job `yaml:"jobs,omitempty"`
+}
+
+// WithParallel toggles parallel execution of this group's jobs.
+func (g *Group) WithParallel(parallel bool) *Group {
+	g.Parallel = &parallel
+
+	return g
+}
+
+// WithPiped enables piped (sequential, fail-fast, stdout-chained) execution.
+func (g *Group) WithPiped(piped bool) *Group {
+	g.Piped = piped
+
+	return g
+}
+
+// Job appends a new job to the group and returns it for further configuration.
+func (g *Group) Job() *Job {
+	j := &Job{}
+
+	g.Jobs = append(g.Jobs, j)
+
+	return j
+}

internal/output/lefthook/hook.go

@@ -0,0 +1,95 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package lefthook
+
+// Pre-commit stage keys: stable names for Hook.Group so multiple project blocks
+// can append jobs to the same ordered group. Each value is both the lookup key
+// and the group's emitted `name:`.
+const (
+	// PreCommitFixStage is stage 1: mutating formatters/generators, re-staged via stage_fixed.
+	PreCommitFixStage = "fix"
+	// PreCommitLintStage is stage 2: verification, runs after the fix stage.
+	PreCommitLintStage = "lint"
+
+	// HookGroupPreCommit is the lefthook "pre-commit" hook name.
+	HookGroupPreCommit = "pre-commit"
+	// HookGroupCommitMsg is the lefthook "commit-msg" hook name.
+	HookGroupCommitMsg = "commit-msg"
+)
+
+// Hook represents the configuration for a single git hook (e.g. pre-commit)
+// inside lefthook.yml. A hook can declare either Commands (a named map) or
+// Jobs (an ordered list with nested groups) — see lefthook docs for the
+// trade-off; mixing both in a single hook is generally not recommended.
+type Hook struct { //nolint:govet
+	// Parallel is a pointer so an explicit `parallel: false` can be emitted
+	// (with a plain bool + omitempty the false zero-value would be suppressed).
+	// Only meaningful for Commands-style hooks; Jobs-style hooks control
+	// parallelism per-Group.
+	Parallel *bool               `yaml:"parallel,omitempty"`
+	Piped    bool                `yaml:"piped,omitempty"`
+	Commands map[string]*Command `yaml:"commands,omitempty"`
+	Jobs     []*Job              `yaml:"jobs,omitempty"`
+}
+
+// WithParallel sets the hook-level parallel flag (Commands-style hooks only).
+func (h *Hook) WithParallel(parallel bool) *Hook {
+	h.Parallel = &parallel
+
+	return h
+}
+
+// WithPiped enables piped (sequential, fail-fast) execution of this hook's commands.
+func (h *Hook) WithPiped(piped bool) *Hook {
+	h.Piped = piped
+
+	return h
+}
+
+// Command returns the named command on this hook, creating it on first access.
+func (h *Hook) Command(name string) *Command {
+	if c, ok := h.Commands[name]; ok {
+		return c
+	}
+
+	if h.Commands == nil {
+		h.Commands = map[string]*Command{}
+	}
+
+	c := &Command{}
+	h.Commands[name] = c
+
+	return c
+}
+
+// Job appends a new job to this hook's Jobs list and returns it for further
+// configuration. Each top-level entry runs in declaration order; use AsGroup
+// on the returned job to nest a parallel/sequential group of inner jobs.
+func (h *Hook) Job() *Job {
+	j := &Job{}
+
+	h.Jobs = append(h.Jobs, j)
+
+	return j
+}
+
+// Group returns the named group on this hook, wrapped in a Job entry, creating
+// it on first access (mirroring makefile.Output.Target). The name is emitted as
+// the wrapping job's `name:` and doubles as the lookup key, so different project
+// blocks can contribute jobs to the same group regardless of compile order;
+// group emission order follows first-creation order.
+func (h *Hook) Group(name string) *Group {
+	for _, j := range h.Jobs {
+		if j.Group != nil && j.Name == name {
+			return j.Group
+		}
+	}
+
+	g := &Group{}
+
+	h.Jobs = append(h.Jobs, &Job{Name: name, Group: g})
+
+	return g
+}