fix: dotnet/steep/rubocop/php-cs-fixer/hadolint hardening

- dotnet-format / dotnet-format-check: walk up looking for .sln/.csproj/
  .fsproj/.vbproj before invoking; warn-and-skip if no MSBuild project found
  (avoids the "Could not find a MSBuild project file" crash in repos with no
  .NET project).
- steep: warn-and-skip when no Steepfile is present in any ancestor (avoids
  "Cannot find Steepfile" when a Gemfile exists but no Steep config).
- rubocop / rubocop-lint: when a Gemfile is found in an ancestor, export
  BUNDLE_GEMFILE so `bundle exec rubocop` works from PWD without "Could not
  locate Gemfile". Fall back to system rubocop.
- php-cs-fixer: auto-pass --config=.php-cs-fixer.dist.php (or .php-cs-fixer.php)
  when present so prek's multi-file invocations don't trip "For multiple paths
  config parameter is required."
- hadolint: on Darwin-arm64, prefer system-installed hadolint (Homebrew) and
  warn-and-skip if absent (the x86_64 binary segfaults under Rosetta on Apple
  Silicon, no native arm64 binary upstream).

Author: Goldziher

hooks/dotnet-format-check/run.sh

@@ -4,10 +4,39 @@
 # is not on PATH, prints a skip warning and exits 0.
 set -euo pipefail
 
-if ! command -v dotnet >/dev/null 2>&1; then
+if ! command -v dotnet > /dev/null 2>&1; then
   printf 'kreuzberg-pre-commit-hooks: skipping dotnet-format-check — `dotnet` not found on PATH.\n' >&2
   printf '  install the .NET SDK 6+ to enable this hook.\n' >&2
   exit 0
 fi
 
+# `dotnet format` requires an MSBuild project (.sln/.csproj/.fsproj/.vbproj).
+_find_dotnet_project() {
+  local d="${1:-${PWD}}"
+  while [[ "${d}" != "/" && "${d}" != "." && -n "${d}" ]]; do
+    if compgen -G "${d}"/*.sln > /dev/null \
+      || compgen -G "${d}"/*.csproj > /dev/null \
+      || compgen -G "${d}"/*.fsproj > /dev/null \
+      || compgen -G "${d}"/*.vbproj > /dev/null; then
+      return 0
+    fi
+    d="$(dirname "${d}")"
+  done
+  return 1
+}
+
+start="${PWD}"
+if [[ $# -gt 0 ]]; then
+  for arg in "$@"; do
+    [[ "${arg}" == -* ]] && continue
+    start="$(dirname "${arg}")"
+    break
+  done
+fi
+
+if ! _find_dotnet_project "${start}"; then
+  printf 'kreuzberg-pre-commit-hooks: skipping dotnet-format-check — no MSBuild project file (.sln/.csproj/.fsproj/.vbproj) found in or above %s.\n' "${start}" >&2
+  exit 0
+fi
+
 exec dotnet format --verify-no-changes "$@"

hooks/dotnet-format/run.sh

@@ -4,10 +4,42 @@
 # and exits 0.
 set -euo pipefail
 
-if ! command -v dotnet >/dev/null 2>&1; then
+if ! command -v dotnet > /dev/null 2>&1; then
   printf 'kreuzberg-pre-commit-hooks: skipping dotnet-format — `dotnet` not found on PATH.\n' >&2
   printf '  install the .NET SDK 6+ to enable this hook.\n' >&2
   exit 0
 fi
 
+# `dotnet format` requires an MSBuild project (.sln/.csproj/.fsproj/.vbproj).
+# Walk up from PWD (or the first input file's dirname) so polyrepos with the
+# .NET project tucked under packages/csharp/ still work; warn-and-skip if none
+# is found in any ancestor.
+_find_dotnet_project() {
+  local d="${1:-${PWD}}"
+  while [[ "${d}" != "/" && "${d}" != "." && -n "${d}" ]]; do
+    if compgen -G "${d}"/*.sln > /dev/null \
+      || compgen -G "${d}"/*.csproj > /dev/null \
+      || compgen -G "${d}"/*.fsproj > /dev/null \
+      || compgen -G "${d}"/*.vbproj > /dev/null; then
+      return 0
+    fi
+    d="$(dirname "${d}")"
+  done
+  return 1
+}
+
+start="${PWD}"
+if [[ $# -gt 0 ]]; then
+  for arg in "$@"; do
+    [[ "${arg}" == -* ]] && continue
+    start="$(dirname "${arg}")"
+    break
+  done
+fi
+
+if ! _find_dotnet_project "${start}"; then
+  printf 'kreuzberg-pre-commit-hooks: skipping dotnet-format — no MSBuild project file (.sln/.csproj/.fsproj/.vbproj) found in or above %s.\n' "${start}" >&2
+  exit 0
+fi
+
 exec dotnet format "$@"

hooks/hadolint/run.sh

@@ -3,6 +3,10 @@
 # Downloads the upstream hadolint release binary, sha256-verifies it against
 # checksums.txt, caches it, and execs it with the args + files passed by
 # pre-commit / prek.
+#
+# On Darwin-arm64 we prefer a system-installed `hadolint` (e.g. via Homebrew's
+# arm64 build) because upstream v2.12.0 doesn't ship a Darwin-arm64 binary and
+# the x86_64 binary segfaults under Rosetta 2.
 set -euo pipefail
 
 HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -13,12 +17,24 @@ source "${REPO_ROOT}/lib/platform.sh"
 # shellcheck source=../../lib/download.sh
 source "${REPO_ROOT}/lib/download.sh"
 
-VERSION="$(grep -v '^#' "${HOOK_DIR}/version.txt" | tr -d '[:space:]')"
-CHECKSUMS="${HOOK_DIR}/checksums.txt"
-
 os="$(detect_os)"
 arch="$(detect_arch)"
 
+# Apple Silicon: upstream ships no Darwin-arm64 binary and the x86_64 build
+# segfaults under Rosetta. Prefer a system hadolint (Homebrew, MacPorts) if
+# present; otherwise warn-and-skip so we don't crash the whole pre-commit run.
+if [[ "${os}" == "macos" && "${arch}" == "aarch64" ]]; then
+  if command -v hadolint > /dev/null 2>&1; then
+    exec hadolint "$@"
+  fi
+  printf 'kreuzberg-pre-commit-hooks: skipping hadolint — no native Darwin-arm64 binary upstream and the x86_64 build segfaults under Rosetta.\n' >&2
+  printf '  install hadolint via `brew install hadolint` to enable this hook on Apple Silicon.\n' >&2
+  exit 0
+fi
+
+VERSION="$(grep -v '^#' "${HOOK_DIR}/version.txt" | tr -d '[:space:]')"
+CHECKSUMS="${HOOK_DIR}/checksums.txt"
+
 case "${os}" in
 linux) os_part="Linux" ;;
 macos) os_part="Darwin" ;;
@@ -37,12 +53,6 @@ aarch64) arch_part="arm64" ;;
   ;;
 esac
 
-# Upstream hadolint v2.12.0 does not publish a Darwin-arm64 binary. Apple
-# silicon Macs run the x86_64 build under Rosetta 2.
-if [[ "${os_part}" == "Darwin" && "${arch_part}" == "arm64" ]]; then
-  arch_part="x86_64"
-fi
-
 ext=""
 [[ "${os_part}" == "Windows" ]] && ext=".exe"
 

hooks/php-cs-fixer/run.sh

@@ -27,4 +27,25 @@ url="https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases/download/v${VERSION}/
 
 phar_path="$(download_tool php-cs-fixer "${VERSION}" "${url}" "${asset_name}" "${CHECKSUMS}")"
 
-exec php "${phar_path}" "$@"
+# php-cs-fixer requires `--config` whenever multiple positional paths are
+# passed and a config file exists. Auto-discover .php-cs-fixer.dist.php /
+# .php-cs-fixer.php in the cwd and pass `--config` explicitly so prek's
+# multi-file invocations don't error with "For multiple paths config parameter
+# is required."
+extra_args=()
+if [[ ! " $* " =~ " --config" && ! " $* " =~ " --config=" ]]; then
+  for cfg in .php-cs-fixer.dist.php .php-cs-fixer.php; do
+    if [[ -f "${cfg}" ]]; then
+      extra_args+=("--config=${cfg}")
+      break
+    fi
+  done
+fi
+
+if ((${#extra_args[@]} > 0)) && [[ "${1:-}" == "fix" ]]; then
+  cmd="$1"
+  shift
+  exec php "${phar_path}" "${cmd}" "${extra_args[@]}" "$@"
+fi
+
+exec php "${phar_path}" "${extra_args[@]}" "$@"

hooks/rubocop-lint/run.sh

@@ -5,20 +5,16 @@
 # warning and exits 0.
 set -euo pipefail
 
-_pick_rubocop() {
+_find_gemfile() {
   local start_dir="${1:-${PWD}}"
   local d="${start_dir}"
-  while [[ "${d}" != "/" && "${d}" != "." ]]; do
-    if [[ -f "${d}/Gemfile" ]] && command -v bundle >/dev/null 2>&1; then
-      printf 'bundle\n'
+  while [[ "${d}" != "/" && "${d}" != "." && -n "${d}" ]]; do
+    if [[ -f "${d}/Gemfile" ]]; then
+      printf '%s/Gemfile\n' "${d}"
       return 0
     fi
     d="$(dirname "${d}")"
   done
-  if command -v rubocop >/dev/null 2>&1; then
-    printf 'rubocop\n'
-    return 0
-  fi
   return 1
 }
 
@@ -28,14 +24,15 @@ else
   start="${PWD}"
 fi
 
-if ! mode="$(_pick_rubocop "${start}")"; then
-  printf 'kreuzberg-pre-commit-hooks: skipping rubocop-lint — `rubocop` not on PATH and no `Gemfile`/`bundle` available.\n' >&2
-  printf '  install rubocop via `gem install rubocop` or add it to your Gemfile.\n' >&2
-  exit 0
+if gemfile="$(_find_gemfile "${start}")" && command -v bundle > /dev/null 2>&1; then
+  export BUNDLE_GEMFILE="${gemfile}"
+  exec bundle exec rubocop "$@"
 fi
 
-if [[ "${mode}" == "bundle" ]]; then
-  exec bundle exec rubocop "$@"
+if command -v rubocop > /dev/null 2>&1; then
+  exec rubocop "$@"
 fi
 
-exec rubocop "$@"
+printf 'kreuzberg-pre-commit-hooks: skipping rubocop-lint — `rubocop` not on PATH and no `Gemfile`/`bundle` available.\n' >&2
+printf '  install rubocop via `gem install rubocop` or add it to your Gemfile.\n' >&2
+exit 0

hooks/rubocop/run.sh

@@ -7,20 +7,16 @@ set -euo pipefail
 
 # Pick the right invocation. Walk up from the first input file (or pwd) looking
 # for a Gemfile so projects with managed gems get the bundled rubocop.
-_pick_rubocop() {
+_find_gemfile() {
   local start_dir="${1:-${PWD}}"
   local d="${start_dir}"
-  while [[ "${d}" != "/" && "${d}" != "." ]]; do
-    if [[ -f "${d}/Gemfile" ]] && command -v bundle >/dev/null 2>&1; then
-      printf 'bundle\n'
+  while [[ "${d}" != "/" && "${d}" != "." && -n "${d}" ]]; do
+    if [[ -f "${d}/Gemfile" ]]; then
+      printf '%s/Gemfile\n' "${d}"
       return 0
     fi
     d="$(dirname "${d}")"
   done
-  if command -v rubocop >/dev/null 2>&1; then
-    printf 'rubocop\n'
-    return 0
-  fi
   return 1
 }
 
@@ -30,14 +26,15 @@ else
   start="${PWD}"
 fi
 
-if ! mode="$(_pick_rubocop "${start}")"; then
-  printf 'kreuzberg-pre-commit-hooks: skipping rubocop — `rubocop` not on PATH and no `Gemfile`/`bundle` available.\n' >&2
-  printf '  install rubocop via `gem install rubocop` or add it to your Gemfile.\n' >&2
-  exit 0
+if gemfile="$(_find_gemfile "${start}")" && command -v bundle > /dev/null 2>&1; then
+  export BUNDLE_GEMFILE="${gemfile}"
+  exec bundle exec rubocop -A "$@"
 fi
 
-if [[ "${mode}" == "bundle" ]]; then
-  exec bundle exec rubocop -A "$@"
+if command -v rubocop > /dev/null 2>&1; then
+  exec rubocop -A "$@"
 fi
 
-exec rubocop -A "$@"
+printf 'kreuzberg-pre-commit-hooks: skipping rubocop — `rubocop` not on PATH and no `Gemfile`/`bundle` available.\n' >&2
+printf '  install rubocop via `gem install rubocop` or add it to your Gemfile.\n' >&2
+exit 0

hooks/steep/run.sh

@@ -4,17 +4,28 @@
 # directly. If neither is available, prints a skip warning and exits 0.
 set -euo pipefail
 
+_find_steepfile() {
+  local d="${1:-${PWD}}"
+  while [[ "${d}" != "/" && "${d}" != "." && -n "${d}" ]]; do
+    if [[ -f "${d}/Steepfile" ]]; then
+      return 0
+    fi
+    d="$(dirname "${d}")"
+  done
+  return 1
+}
+
 _pick_steep() {
   local start_dir="${1:-${PWD}}"
   local d="${start_dir}"
   while [[ "${d}" != "/" && "${d}" != "." ]]; do
-    if [[ -f "${d}/Gemfile" ]] && command -v bundle >/dev/null 2>&1; then
+    if [[ -f "${d}/Gemfile" ]] && command -v bundle > /dev/null 2>&1; then
       printf 'bundle\n'
       return 0
     fi
     d="$(dirname "${d}")"
   done
-  if command -v steep >/dev/null 2>&1; then
+  if command -v steep > /dev/null 2>&1; then
     printf 'steep\n'
     return 0
   fi
@@ -27,6 +38,12 @@ else
   start="${PWD}"
 fi
 
+if ! _find_steepfile "${start}"; then
+  printf 'kreuzberg-pre-commit-hooks: skipping steep — no Steepfile found in or above %s.\n' "${start}" >&2
+  printf '  initialize steep via `steep init` to enable this hook.\n' >&2
+  exit 0
+fi
+
 if ! mode="$(_pick_steep "${start}")"; then
   printf 'kreuzberg-pre-commit-hooks: skipping steep — `steep` not on PATH and no `Gemfile`/`bundle` available.\n' >&2
   printf '  install steep via `gem install steep` or add it to your Gemfile.\n' >&2