marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-20 13:39:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(pre-push-safety-net): preserve existing hooks during explicit integration

Browse Source
This commit is contained in:
Marius Ciepluch
2026-09-13 17:51:28 +02:00
parent f04955c367
commit 749c7ab45d
9 changed files with 294 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/pre-push-safety-net/implementation-group-7.md
+40
View File
@@ -35,3 +35,43 @@ deletions, no work, policy combinations and deadline ownership.
- CLAIM: Task 7.1 interface and policy integration implemented.
- EVIDENCE: `/tmp/group7-1-full.log`, `/tmp/group7-1-final-focused.log`; ruff, mypy and diff checks exit 0.
- GAPS: Representative multi-ref performance and real capability admission remain group 8 work.
## Task 7.2 brief
Requirements 1.2, 5.3, 5.4 and 7.4; design: Result and Hook Adapter.
Deliver executable opt-in integration and non-overwriting installation, preserve the
configured hook path, explicitly chain a prior hook with its exact input/arguments,
retain rejection, and document guarded removal. The existing hook's runtime remains
its own behavior; input retention and Safety Net analysis share one deadline.
Verify with disposable repositories and a local bare remote, never this project's hooks.
## Debug Report
- ROOT_CAUSE: `git rev-parse --path-format=absolute --git-path hooks/pre-push` canonicalizes the final symlink, so even O_EXCL on the returned name creates its target. Initial attribution to shell noclobber was not supported by the subsequent test.
- CATEGORY: LOGIC_ERROR
- FIX_PLAN: Resolve only `hooks`, append the literal `pre-push` basename, and create with O_EXCL/O_NOFOLLOW.
- VERIFICATION: Dangling-symlink regression passes; target remains absent.
- NEXT_ACTION: RETRY_TASK
- CONFIDENCE: HIGH
- NOTES: Git documents absolute output as canonical: https://git-scm.com/docs/git-rev-parse/2.33.0.html . Guarded removal instructions use directory-only resolution too.
## Status Report
- STATUS: READY_FOR_REVIEW
- TASK: 7.2
- RED_PHASE_OUTPUT: `/tmp/group7-2-red.log` (missing integration); `/tmp/group7-2-flag-off.log` (two failures with chaining OFF). ON: three passed; switch removed, final 16 hook/interface tests passed.
- TESTS_RUN: full regression 1282 passed, 9 skipped in 119.95s; final 16 focused tests include subsequently added exact-exit and symlink controls. Ruff, formatting, mypy, shell syntax, CLI help and diff checks pass.
- CONCERNS: input-retention failure stops the integration because a prior hook cannot safely receive partial input. Prior hook runtime remains separate from analysis.
## Review Verdict
- VERDICT: APPROVED
- TASK: 7.2
- MECHANICAL_RESULTS: actual diff and installation/removal recipes reviewed; disposable remote accepts/rejects correctly; original stdin bytes/arguments and exact nonzero exit preserved; source/index/ref state and core.hooksPath preserved; no placeholders or secrets; task boundary maintained.
- FINDINGS: final-path canonicalization issue repaired and regression tested. Installation is explicit and does not overwrite existing hooks or symlink targets.
- RED phase: VERIFIED.
- SUMMARY: Opt-in integration preserves prior hook behavior and supports guarded restoration.
## Verification Result
- STATUS: VERIFIED
- CLAIM_TYPE: TASK
- CLAIM: Task 7.2 non-destructive hook integration delivered.
- EVIDENCE: `/tmp/group7-2-full.log`, `/tmp/group7-2-final-focused.log`; static checks and shell/CLI smoke exit 0.
- GAPS: No hook installed in this project's actual repository; rollout remains NO-GO.