Files
holocron/tests/test-git-hooks-install.sh
Defame1297 dee56c506a feat(kyberforge): refresh the apm install at SessionStart, not at push
Why
---
ADR-0018 left deployed skills tracking the remote default branch with nothing
watching for drift. The mechanism that was supposed to cover this,
scripts/git-hooks/post-push, could never have worked: git has no client-side
post-push hook. install.sh copied it into .git/hooks/ so it looked installed,
and it had never once fired. Issue #78 reported it as skipping the gitea
plugin; it was skipping everything.

Refreshing on push was also the wrong shape. Your install goes stale when
someone else merges, so a push of your own is neither necessary nor sufficient
for staleness to have occurred.

Implementation notes
--------------------
kyberforge ships a SessionStart hook (startup matcher only) that runs
`apm outdated`, and when anything is behind runs `apm update --yes` and returns
reloadSkills:true so the running session picks up redeployed content. It exits
silently with no apm.lock.yaml present, which keeps it inert for hosts that
installed this plugin natively rather than through apm.

Two findings drove the wiring, both verified rather than assumed:

- apm resolves ${CLAUDE_PLUGIN_ROOT} against the installed package root, and
  `apm pack` keeps only *.json from .apm/hooks/. A .../hooks/<script> reference
  therefore points into the generated mirror where the script does not exist —
  apm reports "Hook script not found" and deploys a hook aimed at nothing. The
  reference must be .apm/-relative, and a test pins it.
- apm's executable-trust gate is OFF unless apm.yml carries an `executables:`
  block; until now every hook, bin and MCP primitive a dependency shipped would
  have deployed unprompted. Root apm.yml now enables it. The allow key is
  version-pinned by apm's design, so a kyberforge version bump silently blocks
  the hook until the key is bumped too — called out in the block and the ADR.

Also corrects ADR-0018 and AGENTS.md, which named `apm install` as the refresh
command. It is not: `apm install` deploys from apm.lock.yaml's pinned commit
and does not re-resolve refs. `apm update` does.

Impact
------
Session startup costs ~0.7s when current and ~10.4s when six packages are
behind. Auto-refresh rewrites apm.lock.yaml, so an unexplained modification to
it after opening a session is expected; the emitted notice says so.

.claude/settings.json stops being exactly {"hooks": {}} once the hook lands
there — the merged entry is apm's own output, and the rule that nothing
repo-authored goes in that file is unchanged. .claude/hooks/ and the
.claude/apm-hooks.json sidecar are gitignored install output.

The hook cannot install itself: dependencies resolve from the remote, so it
takes effect only after this merges and `apm update` runs once against the new
default branch.

scripts/git-hooks/ is now empty. install.sh's copy block is kept and
test-git-hooks-install.sh synthesizes its own fixture, so the mechanism stays
tested without requiring a dead hook to exist.

ADR: 0019
Refs: #78

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT
2026-08-14 17:46:38 +00:00

161 lines
5.8 KiB
Bash
Executable File

#!/usr/bin/env bash
# Tests for the git hook install block in scripts/install.sh.
# Runs install.sh from a temp repo to avoid touching the real .git/hooks/.
set -euo pipefail
# This script may itself run inside a git hook (e.g. pre-push), which sets
# GIT_DIR/GIT_EXEC_PATH/etc. in the environment. `git init`/`git -C` below
# would silently re-target the inherited GIT_DIR instead of creating an
# isolated repo in $TEMP_REPO, so start from a clean slate.
for var in $(compgen -v | grep '^GIT_'); do unset "$var"; done
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
PASS=0
FAIL=0
pass() { echo " PASS: $1"; PASS=$((PASS + 1)); }
fail() { echo " FAIL: $1"; FAIL=$((FAIL + 1)); }
# ---------------------------------------------------------------------------
# Temp repo setup
#
# install.sh derives REPO_ROOT from the script's own location, so copying it
# into a temp tree makes REPO_ROOT point there, not at the real checkout.
# ---------------------------------------------------------------------------
TEMP_REPO="$(mktemp -d)"
TEMP_HOME="$(mktemp -d)"
trap 'rm -rf "$TEMP_REPO" "$TEMP_HOME"' EXIT
mkdir -p "$TEMP_REPO/scripts"
git -C "$TEMP_REPO" init -q
# Minimal deploy-manifest.sh — empty deploy lists so install.sh reaches the
# hook-copy block without attempting to copy files that don't exist in the
# temp tree.
cat > "$TEMP_REPO/scripts/deploy-manifest.sh" << 'EOF'
# shellcheck disable=SC2034
DEPLOY_FILES=()
DEPLOY_EXECUTABLES=()
DEPLOY_DIRS=()
EOF
# Copy the real install.sh into the temp repo.
cp "$REPO_ROOT/scripts/install.sh" "$TEMP_REPO/scripts/install.sh"
HOOKS_SRC="$TEMP_REPO/scripts/git-hooks"
mkdir -p "$HOOKS_SRC"
# Copy whatever real hooks exist, then add a synthetic fixture. The repo
# currently ships none — the only entry was `post-push`, removed once it was
# found that git has no such client-side hook, so it had never fired (see
# ADR-0019). install.sh's copy block is generic and stays worth testing, so the
# fixture keeps that coverage alive independently of whether any real hook
# happens to exist. Real hooks are still picked up by the loops below.
if [[ -d "$REPO_ROOT/scripts/git-hooks" ]]; then
find "$REPO_ROOT/scripts/git-hooks" -maxdepth 1 -type f -exec cp {} "$HOOKS_SRC/" \;
fi
FIXTURE_HOOK="fixture-hook"
printf '#!/usr/bin/env bash\nexit 0\n' > "$HOOKS_SRC/$FIXTURE_HOOK"
chmod +x "$HOOKS_SRC/$FIXTURE_HOOK"
run_install() {
HOME="$TEMP_HOME" bash "$TEMP_REPO/scripts/install.sh" > /dev/null 2>&1
}
# ---------------------------------------------------------------------------
echo "--- hook install: files copied to .git/hooks/ ---"
# ---------------------------------------------------------------------------
run_install
for hook_file in "$HOOKS_SRC"/*; do
[[ -f "$hook_file" ]] || continue
hook_name="$(basename "$hook_file")"
if [[ -f "$TEMP_REPO/.git/hooks/$hook_name" ]]; then
pass "$hook_name installed to .git/hooks/"
else
fail "$hook_name missing from .git/hooks/"
fi
done
# ---------------------------------------------------------------------------
echo ""
echo "--- hook install: installed hooks are executable ---"
# ---------------------------------------------------------------------------
for hook_file in "$HOOKS_SRC"/*; do
[[ -f "$hook_file" ]] || continue
hook_name="$(basename "$hook_file")"
if [[ -x "$TEMP_REPO/.git/hooks/$hook_name" ]]; then
pass "$hook_name is executable"
else
fail "$hook_name is not executable"
fi
done
# ---------------------------------------------------------------------------
echo ""
echo "--- hook install: directories in git-hooks/ are not installed ---"
# ---------------------------------------------------------------------------
# Add a subdirectory to scripts/git-hooks/ — the install block must skip it
mkdir -p "$HOOKS_SRC/not-a-hook"
run_install
if [[ ! -e "$TEMP_REPO/.git/hooks/not-a-hook" ]]; then
pass "directories in scripts/git-hooks/ are not copied to .git/hooks/"
else
fail "a directory from scripts/git-hooks/ was incorrectly installed"
fi
rmdir "$HOOKS_SRC/not-a-hook"
# ---------------------------------------------------------------------------
echo ""
echo "--- hook install: resolves correctly when GIT_DIR is inherited (hook context) ---"
# ---------------------------------------------------------------------------
# Git sets GIT_DIR/GIT_WORK_TREE for child processes when this script itself
# runs as a hook (e.g. pre-push). Simulate that and confirm install.sh still
# resolves hooks against $TEMP_REPO, not the inherited GIT_DIR.
OTHER_REPO="$(mktemp -d)"
git -C "$OTHER_REPO" init -q
if HOME="$TEMP_HOME" GIT_DIR="$OTHER_REPO/.git" GIT_WORK_TREE="$OTHER_REPO" \
bash "$TEMP_REPO/scripts/install.sh" > /dev/null 2>&1; then
if [[ -f "$TEMP_REPO/.git/hooks/$FIXTURE_HOOK" ]]; then
pass "resolves \$TEMP_REPO/.git/hooks/ even with inherited GIT_DIR"
else
fail "installed into inherited GIT_DIR instead of \$TEMP_REPO"
fi
else
fail "install.sh failed when GIT_DIR/GIT_WORK_TREE were inherited"
fi
rm -rf "$OTHER_REPO"
# ---------------------------------------------------------------------------
echo ""
echo "--- hook install: idempotent ---"
# ---------------------------------------------------------------------------
run_install
for hook_file in "$HOOKS_SRC"/*; do
[[ -f "$hook_file" ]] || continue
hook_name="$(basename "$hook_file")"
if diff -q "$hook_file" "$TEMP_REPO/.git/hooks/$hook_name" > /dev/null 2>&1; then
pass "idempotent: $hook_name content unchanged after second install"
else
fail "idempotent: $hook_name content corrupted after second install"
fi
if [[ -x "$TEMP_REPO/.git/hooks/$hook_name" ]]; then
pass "idempotent: $hook_name still executable after second install"
else
fail "idempotent: $hook_name lost executable bit after second install"
fi
done
# ---------------------------------------------------------------------------
echo ""
echo "Results: $PASS passed, $FAIL failed"
[[ $FAIL -eq 0 ]]