lefthook.yml

# Git hooks managed by lefthook. Enable once per clone: `mise exec -- lefthook install`
# All tools resolve through `mise exec --` so hooks work without mise activated in the shell.
# `entire` (upstream's proprietary session-recording tool) is intentionally not
# wired in here: it is excluded from mise.toml (see the comment there), so its
# hook steps are stripped rather than left to fail or silently no-op.
pre-commit:
  parallel: false
  commands:
    oxlint:
      # Type-aware lint runs on staged files only here; the full-repo pass
      # moved to pre-push (repository:pre-push now depends on `check`).
      # `{staged_files}` is already glob-filtered and shell-escaped by
      # lefthook, and the command is skipped when nothing matches.
      glob: "**/*.{js,ts,cjs,mjs,cts,mts,d.cts,d.mts,jsx,tsx}"
      run: mise exec -- npx oxlint --type-aware --type-check {staged_files}
    oxfmt:
      # `{staged_files}` is glob/exclude-filtered and shell-escaped by
      # lefthook, so each path (including spaces) arrives intact; the command
      # is skipped when nothing formatable remains.
      glob: "**/*.{js,ts,cjs,mjs,cts,mts,d.cts,d.mts,jsx,tsx,json,jsonc,md}"
      exclude:
        - .pi/**
      run: mise exec -- npx oxfmt --write {staged_files}
      stage_fixed: true
    actionlint:
      glob:
        - ".github/workflows/**/*.yml"
        - ".github/workflows/**/*.yaml"
      run: mise exec -- actionlint
    zizmor:
      glob:
        - ".github/dependabot.yml"
        - ".github/workflows/**/*.yml"
        - ".github/workflows/**/*.yaml"
        - "**/action.yml"
        - "**/action.yaml"
      run: mise exec -- zizmor --offline --strict-collection --collect=default --format=plain {staged_files}
    tests:
      # Same unit lane, but through Nx so cache hits skip re-execution.
      # Pre-push still runs the full validation graph uncached where needed.
      run: mise exec -- npx nx run repository:test:unit

commit-msg:
  commands:
    commitlint:
      run: mise exec -- npx commitlint --edit {1}

pre-push:
  scripts:
    "control-plane.sh":
      runner: bash