#!/bin/sh
# commit-craft pre-push hook: lint the series and re-scan it for secrets before it leaves the machine.
# Install: cp pre-push .git/hooks/pre-push && chmod +x .git/hooks/pre-push
SCRIPTS="${COMMIT_CRAFT_SCRIPTS:-$HOME/.claude/skills/commit-craft/scripts}"
zero=0000000000000000000000000000000000000000
fail=0
while read -r local_ref local_sha remote_ref remote_sha; do
  [ "$local_sha" = "$zero" ] && continue                  # deleting a branch
  if [ "$remote_sha" = "$zero" ]; then
    base=$(git merge-base "$local_sha" "@{upstream}" 2>/dev/null || git merge-base "$local_sha" origin/HEAD 2>/dev/null)
    if [ -z "$base" ]; then echo "commit-craft: no upstream to compare $local_ref with; skipping" >&2; continue; fi
  else
    base=$remote_sha
  fi
  [ "$base" = "$local_sha" ] && continue
  python3 "$SCRIPTS/secret_gate.py" --range "$base..$local_sha"
  s=$?; [ "$s" -eq 0 ] || [ "$s" -eq 2 ] || fail=1
  python3 "$SCRIPTS/message_linter.py" --range "$base..$local_sha"
  s=$?; [ "$s" -eq 0 ] || [ "$s" -eq 2 ] || fail=1
done
exit $fail
