test: skip placeholder-rejection tests once real checksums are populated

Adds has_placeholder_checksum() helper to tests/_hook_helpers.py and decorates
the per-hook placeholder-rejection tests with @pytest.mark.skipif. With real
checksums now committed, the consumer integration test in pre-commit-kreuzberg
covers the security path; the unit tests previously assumed placeholders and
broke once fetch_checksums.py ran. Also dogfood: exclude hooks/*/tests/bad.*
fixtures from shfmt-local since they're intentionally malformed.

Author: Goldziher

.pre-commit-config.yaml

@@ -81,3 +81,5 @@ repos:
         entry: bash hooks/shfmt/run.sh -w -i 2
         language: system
         types: [shell]
+        # bad.sh is intentionally bad-formatted as a hook test fixture.
+        exclude: ^hooks/.*/tests/bad\.

hooks/golangci-lint/checksums.txt

@@ -1,7 +1,7 @@
-# Asset checksums for golangci-lint v1.62.0
+# Asset checksums for golangci-lint v2.11.4
 # Generated by scripts/fetch_checksums.py — do not edit by hand.
 
-53695531eeb824b6883c703335cef6f07882f8ba6fedc00ed43853ea07fa1fbd  golangci-lint-1.62.0-linux-amd64.tar.gz
-e1e47209d7bdd288fd8cfe88548b477df2f7eca81b0e9ec1f9d45604f79185eb  golangci-lint-1.62.0-linux-arm64.tar.gz
-0ed6f1a216ddb62e293858196799608d63894bd2ec178114484363ca45cde84b  golangci-lint-1.62.0-darwin-amd64.tar.gz
-dde51958f0f24d442062b5709b6912d91e235115dfe5887e80b3e5602c9cc09b  golangci-lint-1.62.0-darwin-arm64.tar.gz
+200c5b7503f67b59a6743ccf32133026c174e272b930ee79aa2aa6f37aca7ef1  golangci-lint-2.11.4-linux-amd64.tar.gz
+3bcfa2e6f3d32b2bf5cd75eaa876447507025e0303698633f722a05331988db4  golangci-lint-2.11.4-linux-arm64.tar.gz
+c900d4048db75d1edfd550fd11cf6a9b3008e7caa8e119fcddbc700412d63e60  golangci-lint-2.11.4-darwin-amd64.tar.gz
+02db2a2dae8b26812e53b0688a6f617e3ef1f489790e829ea22862cf76945675  golangci-lint-2.11.4-darwin-arm64.tar.gz

hooks/kubeconform/run.sh

@@ -94,12 +94,12 @@ done
 status=0
 
 if ((${#chart_roots[@]} > 0)); then
-  if ! command -v helm > /dev/null 2>&1; then
+  if ! command -v helm >/dev/null 2>&1; then
     printf 'kubeconform: skipping chart validation — `helm` not on PATH (needed to template charts before validating).\n' >&2
     printf '  install helm to enable chart-aware validation; non-chart files are still validated.\n' >&2
   else
     for chart in "${!chart_roots[@]}"; do
-      if ! helm template kubeconform-test "${chart}" 2> /dev/null | "${bin_path}" "${flags[@]}" -; then
+      if ! helm template kubeconform-test "${chart}" 2>/dev/null | "${bin_path}" "${flags[@]}" -; then
         status=1
       fi
     done

hooks/php-cs-fixer/checksums.txt

@@ -1,4 +1,4 @@
-# Asset checksums for php-cs-fixer v3.64.0
+# Asset checksums for php-cs-fixer v3.95.1
 # Generated by scripts/fetch_checksums.py — do not edit by hand.
 
-7d67bbf0635df7239e0a09aef9999f6f91bbc7ef55541ee06aaed727453bfa5e  php-cs-fixer.phar
+3a06439b16ca8a7713d47da25efbf7808b7c08e6f0bdedf2b0d69cf0ce887414  php-cs-fixer.phar

hooks/shfmt/tests/bad.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-main() {
-  local greeting="hello"
-  printf '%s\n' "${greeting}"
+main(){
+        local greeting="hello"
+            printf '%s\n' "${greeting}"
 }
 
 main "$@"

tests/_hook_helpers.py

@@ -18,6 +18,19 @@
 REPO_ROOT = Path(__file__).resolve().parent.parent
 
 
+def has_placeholder_checksum(hook_id: str) -> bool:
+    """True iff hooks/<id>/checksums.txt still contains a zero-filled placeholder.
+
+    Tests that exercise placeholder-rejection should pytest.skip when real
+    checksums have been populated — that path is exercised by the consumer
+    integration test instead.
+    """
+    f = REPO_ROOT / "hooks" / hook_id / "checksums.txt"
+    if not f.exists():
+        return True
+    return any("0" * 64 in line for line in f.read_text().splitlines())
+
+
 def _system_has(tool: str) -> bool:
     """True iff `tool` is reachable via the test's PATH (/usr/bin:/bin)."""
     return shutil.which(tool, path="/usr/bin:/bin") is not None

tests/test_air_check.py

@@ -4,7 +4,9 @@
 
 from pathlib import Path
 
-from tests._hook_helpers import assert_run_sh_executable, run_hook
+import pytest
+
+from tests._hook_helpers import assert_run_sh_executable, has_placeholder_checksum, run_hook
 
 HOOK = "air-check"
 
@@ -13,6 +15,10 @@ def test_run_sh_is_executable() -> None:
     assert_run_sh_executable(HOOK)
 
 
+@pytest.mark.skipif(
+    not has_placeholder_checksum("air-check"),
+    reason="checksums populated; placeholder-rejection covered by integration test",
+)
 def test_hook_aborts_on_placeholder_checksum(hook_cache: Path) -> None:
     """Until checksums.txt is populated, the hook must refuse to run.
 

tests/test_air_format.py

@@ -4,7 +4,9 @@
 
 from pathlib import Path
 
-from tests._hook_helpers import assert_run_sh_executable, run_hook
+import pytest
+
+from tests._hook_helpers import assert_run_sh_executable, has_placeholder_checksum, run_hook
 
 HOOK = "air-format"
 
@@ -13,6 +15,10 @@ def test_run_sh_is_executable() -> None:
     assert_run_sh_executable(HOOK)
 
 
+@pytest.mark.skipif(
+    not has_placeholder_checksum("air-format"),
+    reason="checksums populated; placeholder-rejection covered by integration test",
+)
 def test_hook_aborts_on_placeholder_checksum(hook_cache: Path) -> None:
     """Until checksums.txt is populated, the hook must refuse to run.
 

tests/test_checkstyle.py

@@ -6,7 +6,7 @@
 
 import pytest
 
-from tests._hook_helpers import assert_run_sh_executable, empty_path, run_hook
+from tests._hook_helpers import assert_run_sh_executable, empty_path, has_placeholder_checksum, run_hook
 
 HOOK = "checkstyle"
 
@@ -15,6 +15,10 @@ def test_run_sh_is_executable() -> None:
     assert_run_sh_executable(HOOK)
 
 
+@pytest.mark.skipif(
+    not has_placeholder_checksum("checkstyle"),
+    reason="checksums populated; placeholder-rejection covered by integration test",
+)
 def test_hook_skips_or_aborts_safely(
     hook_cache: Path,
     tmp_path: Path,

tests/test_detekt.py

@@ -6,7 +6,7 @@
 
 import pytest
 
-from tests._hook_helpers import assert_run_sh_executable, empty_path, run_hook
+from tests._hook_helpers import assert_run_sh_executable, empty_path, has_placeholder_checksum, run_hook
 
 HOOK = "detekt"
 
@@ -15,6 +15,10 @@ def test_run_sh_is_executable() -> None:
     assert_run_sh_executable(HOOK)
 
 
+@pytest.mark.skipif(
+    not has_placeholder_checksum("detekt"),
+    reason="checksums populated; placeholder-rejection covered by integration test",
+)
 def test_hook_skips_or_aborts_safely(
     hook_cache: Path,
     tmp_path: Path,