feat: lefthook env support, refactor commit-msg hook

Adds lefthook `env` support. This is needed for `generate` and `docs`
make targets in some repos, as the `USERNAME` must be set to `siderolabs` (the GH
org name). On Zsh, `USERNAME` will always evaluate to the Linux
username, even with an export/override. Without setting `"USERNAME":
"siderolabs"` for these make targets, lefthook will generate artifacts
with mismatched repo/image identifiers (containing the local username).
This diff adds a "USERNAME" env override to all make targets invoked by
lefthook.

Refactors commit-msg hook to be pre-push instead. Using commit-msg
caused an edge case issue, where the user was unable to amend the commit
message with `make conformance` running at that stage. post-commit is more
suitable for this scenario.

Signed-off-by: Maja Bojarska <maja.bojarska@siderolabs.com>

Author: majabojarska

internal/output/lefthook/command.go

@@ -6,15 +6,16 @@ package lefthook
 
 // Command represents a single named command under a hook's commands: map.
 type Command struct { //nolint:govet
-	Run         string   `yaml:"run"`
-	Tags        []string `yaml:"tags,omitempty"`
-	Glob        string   `yaml:"glob,omitempty"`
-	Files       string   `yaml:"files,omitempty"`
-	Skip        []string `yaml:"skip,omitempty"`
-	Only        []string `yaml:"only,omitempty"`
-	Interactive bool     `yaml:"interactive,omitempty"`
-	StageFixed  bool     `yaml:"stage_fixed,omitempty"`
-	Priority    int      `yaml:"priority,omitempty"`
+	Run         string            `yaml:"run"`
+	Tags        []string          `yaml:"tags,omitempty"`
+	Glob        string            `yaml:"glob,omitempty"`
+	Files       string            `yaml:"files,omitempty"`
+	Env         map[string]string `yaml:"env,omitempty"`
+	Skip        []string          `yaml:"skip,omitempty"`
+	Only        []string          `yaml:"only,omitempty"`
+	Interactive bool              `yaml:"interactive,omitempty"`
+	StageFixed  bool              `yaml:"stage_fixed,omitempty"`
+	Priority    int               `yaml:"priority,omitempty"`
 }
 
 // WithRun sets the shell command lefthook executes for this command.
@@ -45,6 +46,17 @@ func (c *Command) WithFiles(files string) *Command {
 	return c
 }
 
+// WithEnv sets an environment variable on the command; safe to call multiple times.
+func (c *Command) WithEnv(name, value string) *Command {
+	if c.Env == nil {
+		c.Env = map[string]string{}
+	}
+
+	c.Env[name] = value
+
+	return c
+}
+
 // WithSkip lists git states or refs where the command should be skipped (e.g. "merge", "rebase").
 func (c *Command) WithSkip(skip ...string) *Command {
 	c.Skip = skip

internal/output/lefthook/hook.go

@@ -15,8 +15,8 @@ const (
 
 	// HookGroupPreCommit is the lefthook "pre-commit" hook name.
 	HookGroupPreCommit = "pre-commit"
-	// HookGroupCommitMsg is the lefthook "commit-msg" hook name.
-	HookGroupCommitMsg = "commit-msg"
+	// HookGroupPostCommit is the lefthook "post-commit" hook name.
+	HookGroupPostCommit = "post-commit"
 )
 
 // Hook represents the configuration for a single git hook (e.g. pre-commit)

internal/output/lefthook/lefthook.go

@@ -47,7 +47,7 @@ func (o *Output) Enable() {
 }
 
 // Hook returns the configuration for the named git hook (e.g. "pre-commit",
-// "commit-msg"), creating it on first access. New hooks are blank — set the
+// "post-commit"), creating it on first access. New hooks are blank — set the
 // execution model via WithParallel/WithPiped, and populate either Commands
 // or Jobs depending on which lefthook style you want.
 func (o *Output) Hook(name string) *Hook {

internal/output/lefthook/lefthook_test.go

@@ -29,7 +29,7 @@ func TestCommandsRoundTrip(t *testing.T) {
 	preCommit.Command("fmt").WithRun("make fmt")
 	preCommit.Command("lint").WithRun("make lint")
 
-	o.Hook("commit-msg").Command("conformance").WithRun("make conformance")
+	o.Hook("post-commit").Command("conformance").WithRun("make conformance")
 
 	require.Equal(t, []string{"lefthook.yml"}, o.Filenames())
 
@@ -46,11 +46,11 @@ func TestCommandsRoundTrip(t *testing.T) {
 	require.NoError(t, yaml.Unmarshal(buf.Bytes(), &decoded))
 
 	require.Contains(t, decoded, "pre-commit")
-	require.Contains(t, decoded, "commit-msg")
+	require.Contains(t, decoded, "post-commit")
 
 	assert.Equal(t, "make fmt", decoded["pre-commit"].Commands["fmt"].Run)
 	assert.Equal(t, "make lint", decoded["pre-commit"].Commands["lint"].Run)
-	assert.Equal(t, "make conformance", decoded["commit-msg"].Commands["conformance"].Run)
+	assert.Equal(t, "make conformance", decoded["post-commit"].Commands["conformance"].Run)
 }
 
 func TestParallelDefaultIsOmitted(t *testing.T) {
@@ -70,7 +70,7 @@ func TestParallelFalseIsEmitted(t *testing.T) {
 	o := lefthook.NewOutput()
 	o.Enable()
 
-	o.Hook("commit-msg").
+	o.Hook("post-commit").
 		WithParallel(false).
 		Command("conformance").WithRun("make conformance")
 
@@ -252,6 +252,8 @@ func TestCommandBuilders(t *testing.T) {
 		WithTags("format", "go").
 		WithGlob("*.go").
 		WithFiles("git diff --name-only").
+		WithEnv("GOFMT_OPTS", "-s").
+		WithEnv("DEBUG", "1").
 		WithSkip("merge", "rebase").
 		WithOnly("ref: main").
 		WithInteractive().
@@ -265,15 +267,16 @@ func TestCommandBuilders(t *testing.T) {
 	var decoded map[string]struct { //nolint:govet
 		Parallel *bool               `yaml:"parallel"`
 		Commands map[string]struct { //nolint:govet
-			Run         string   `yaml:"run"`
-			Tags        []string `yaml:"tags"`
-			Glob        string   `yaml:"glob"`
-			Files       string   `yaml:"files"`
-			Skip        []string `yaml:"skip"`
-			Only        []string `yaml:"only"`
-			Interactive bool     `yaml:"interactive"`
-			StageFixed  bool     `yaml:"stage_fixed"`
-			Priority    int      `yaml:"priority"`
+			Run         string            `yaml:"run"`
+			Tags        []string          `yaml:"tags"`
+			Glob        string            `yaml:"glob"`
+			Files       string            `yaml:"files"`
+			Env         map[string]string `yaml:"env"`
+			Skip        []string          `yaml:"skip"`
+			Only        []string          `yaml:"only"`
+			Interactive bool              `yaml:"interactive"`
+			StageFixed  bool              `yaml:"stage_fixed"`
+			Priority    int               `yaml:"priority"`
 		} `yaml:"commands"`
 	}
 
@@ -288,6 +291,7 @@ func TestCommandBuilders(t *testing.T) {
 	assert.Equal(t, []string{"format", "go"}, cmd.Tags)
 	assert.Equal(t, "*.go", cmd.Glob)
 	assert.Equal(t, "git diff --name-only", cmd.Files)
+	assert.Equal(t, map[string]string{"GOFMT_OPTS": "-s", "DEBUG": "1"}, cmd.Env)
 	assert.Equal(t, []string{"merge", "rebase"}, cmd.Skip)
 	assert.Equal(t, []string{"ref: main"}, cmd.Only)
 	assert.True(t, cmd.Interactive)

internal/project/common/conformance.go

@@ -48,8 +48,8 @@ func (conformance *Conformance) CompileMakefile(output *makefile.Output) error {
 
 // CompileLefthook implements lefthook.Compiler.
 func (conformance *Conformance) CompileLefthook(output *lefthook.Output) error {
-	output.Hook(lefthook.HookGroupCommitMsg).WithParallel(false).
-		Command("conformance").WithRun("make conformance")
+	output.Hook(lefthook.HookGroupPostCommit).WithParallel(false).
+		Command("conformance").WithRun("make conformance").WithEnv("USERNAME", conformance.meta.GitHubOrganization)
 
 	return nil
 }

internal/project/common/conformance_test.go

@@ -5,16 +5,50 @@
 package common_test
 
 import (
+	"bytes"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/siderolabs/kres/internal/output/lefthook"
 	"github.com/siderolabs/kres/internal/output/makefile"
 	"github.com/siderolabs/kres/internal/project/common"
+	"github.com/siderolabs/kres/internal/project/meta"
 )
 
 func TestConformanceInterfaces(t *testing.T) {
 	assert.Implements(t, (*makefile.Compiler)(nil), new(common.Conformance))
 	assert.Implements(t, (*lefthook.Compiler)(nil), new(common.Conformance))
 }
+
+func TestConformanceLefthook(t *testing.T) {
+	conformance := common.NewConformance(&meta.Options{
+		GitHubOrganization: "testorg",
+	})
+
+	output := lefthook.NewOutput()
+	output.Enable()
+
+	require.NoError(t, conformance.CompileLefthook(output))
+
+	var buf bytes.Buffer
+
+	require.NoError(t, output.GenerateFile("lefthook.yml", &buf))
+
+	var decoded map[string]struct {
+		Commands map[string]struct {
+			Env map[string]string `yaml:"env"`
+		} `yaml:"commands"`
+	}
+
+	require.NoError(t, yaml.Unmarshal(buf.Bytes(), &decoded))
+
+	hook := decoded["post-commit"]
+	require.NotEmpty(t, hook.Commands)
+
+	conformanceCmd, exists := hook.Commands["conformance"]
+	require.True(t, exists, "conformance command not found")
+	assert.Equal(t, "testorg", conformanceCmd.Env["USERNAME"])
+}

internal/project/common/lint.go

@@ -91,12 +91,19 @@ func (lint *Lint) CompileLefthook(output *lefthook.Output) error {
 	// stage 1: mutating formatters (shared group — generate/fmt blocks append here too).
 	hookPreCommit.Group(lefthook.PreCommitFixStage).
 		WithParallel(false).
-		Job().WithName("lint-fmt").WithRun("make lint-fmt").WithStageFixed()
+		Job().
+		WithName("lint-fmt").
+		WithRun("make lint-fmt").
+		WithEnv("USERNAME", lint.meta.GitHubOrganization).
+		WithStageFixed()
 
 	// stage 2: lint runs after, against the formatted tree.
 	hookPreCommit.Group(lefthook.PreCommitLintStage).
 		WithParallel(false).
-		Job().WithName("lint").WithRun("make lint")
+		Job().
+		WithName("lint").
+		WithRun("make lint").
+		WithEnv("USERNAME", lint.meta.GitHubOrganization)
 
 	return nil
 }

internal/project/common/lint_test.go

@@ -5,18 +5,92 @@
 package common_test
 
 import (
+	"bytes"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.yaml.in/yaml/v4"
 
 	"github.com/siderolabs/kres/internal/output/ghworkflow"
 	"github.com/siderolabs/kres/internal/output/lefthook"
 	"github.com/siderolabs/kres/internal/output/makefile"
 	"github.com/siderolabs/kres/internal/project/common"
+	"github.com/siderolabs/kres/internal/project/meta"
 )
 
 func TestLintInterfaces(t *testing.T) {
 	assert.Implements(t, (*makefile.Compiler)(nil), new(common.Lint))
 	assert.Implements(t, (*ghworkflow.Compiler)(nil), new(common.Lint))
 	assert.Implements(t, (*lefthook.Compiler)(nil), new(common.Lint))
 }
+
+func TestLintLefthook(t *testing.T) {
+	lint := common.NewLint(&meta.Options{
+		GitHubOrganization: "testorg",
+	})
+
+	output := lefthook.NewOutput()
+	output.Enable()
+
+	require.NoError(t, lint.CompileLefthook(output))
+
+	var buf bytes.Buffer
+
+	require.NoError(t, output.GenerateFile("lefthook.yml", &buf))
+
+	var decoded map[string]struct {
+		Jobs []struct {
+			Group *struct {
+				Jobs []struct {
+					Env  map[string]string `yaml:"env"`
+					Name string            `yaml:"name"`
+				} `yaml:"jobs"`
+			} `yaml:"group"`
+		} `yaml:"jobs"`
+	}
+
+	require.NoError(t, yaml.Unmarshal(buf.Bytes(), &decoded))
+
+	hook := decoded["pre-commit"]
+	require.NotEmpty(t, hook.Jobs, "should have at least one job group")
+
+	// Check lint-fmt job in PreCommitFixStage
+	require.NotNil(t, hook.Jobs[0].Group)
+
+	var lintFmtJob *struct {
+		Env  map[string]string `yaml:"env"`
+		Name string            `yaml:"name"`
+	}
+
+	for i := range hook.Jobs[0].Group.Jobs {
+		if hook.Jobs[0].Group.Jobs[i].Name == "lint-fmt" {
+			lintFmtJob = &hook.Jobs[0].Group.Jobs[i]
+
+			break
+		}
+	}
+
+	require.NotNil(t, lintFmtJob, "lint-fmt job not found")
+	assert.Equal(t, "testorg", lintFmtJob.Env["USERNAME"])
+
+	// Check lint job in PreCommitLintStage
+	require.Len(t, hook.Jobs, 2, "should have two job groups (fix and lint stages)")
+	require.NotNil(t, hook.Jobs[1].Group)
+
+	var lintJob *struct {
+		Env  map[string]string `yaml:"env"`
+		Name string            `yaml:"name"`
+	}
+
+	for i := range hook.Jobs[1].Group.Jobs {
+		if hook.Jobs[1].Group.Jobs[i].Name == "lint" {
+			lintJob = &hook.Jobs[1].Group.Jobs[i]
+
+			break
+		}
+	}
+
+	require.NotNil(t, lintJob, "lint job not found")
+	assert.Equal(t, "testorg", lintJob.Env["USERNAME"])
+}

internal/project/custom/custom_test.go

@@ -135,15 +135,15 @@ func TestCompileLefthookCommands(t *testing.T) {
 	step := custom.NewStep(&meta.Options{}, "custom")
 	step.Lefthook.Enabled = true
 	step.Lefthook.Hooks = map[string]*lefthook.Hook{
-		"commit-msg": {
+		"post-commit": {
 			Parallel: new(false),
 			Commands: map[string]*lefthook.Command{
 				"conformance": {Run: "make conformance"},
 			},
 		},
 	}
 
-	hook := decodeLefthook(t, step)["commit-msg"]
+	hook := decodeLefthook(t, step)["post-commit"]
 
 	require.NotNil(t, hook.Parallel)
 	assert.False(t, *hook.Parallel)

internal/project/golang/generate.go

@@ -437,7 +437,10 @@ func (generate *Generate) CompileLefthook(output *lefthook.Output) error {
 	output.Hook(lefthook.HookGroupPreCommit).
 		Group(lefthook.PreCommitFixStage).
 		WithParallel(false).
-		Job().WithName("generate").WithRun("make generate").WithStageFixed()
+		Job().WithName("generate").
+		WithRun("make generate").
+		WithEnv("USERNAME", generate.meta.GitHubOrganization).
+		WithStageFixed()
 
 	return nil
 }