A hand-written pre-push delegate with this command's own lines is adopted, a copy that drifted from the binary's text is reported by hooks --identity and refused by no-stale-hook-pins, and a probe can push an empty range through the hooks git runs

[HackingGate]

Closes #199.

What is now true

hooks --install --adopt and --check. An unmarked file in the hooks
directory is compared with the text the command would write by its effective
lines: the shebang and every line that is not a comment, a line ending in \
joined to the next, whitespace runs collapsed. That is exactly the difference
between the thirteen hand-written copies and the written text (ten
byte-identical, three wrapped at a different word on the last command).
Equal lines: the file is rewritten with the marker and reported adopted.
Different lines: exit 2 with a unified diff, file untouched. Without --adopt
the existing refusal stands and now names --adopt. --check writes nothing
and reports each of the four files (absent / written by this command and
matching / written by this command and not matching / hand-written and
adoptable / hand-written and different, with the diff) plus whether
core.hooksPath points at the directory; exit 0 only when all four match and
git runs them.

The delegate is a hook declaration. pins::declarations reads
<core.hooksPath or .githooks>/pre-push as id pre-push, manager git,
with a body naming the runner whose written text it matches (or that it
matches neither) and a fingerprint of the effective lines. hooks --identity
gains a fourth finding, drifted, reported per repository and waivable like
the others; it exists because a fleet whose copies all agree can still be a
fleet on an older release's text, which forked would call agreement.
no-stale-hook-pins reads the same file through hooks::delegate and
refuses a drifted copy (exit 1) at the stage it runs; a hand-written copy with
the same lines passes with a note naming --adopt.

[[probe]] with push = "empty". The probe makes a bare remote under
<owner>/<repo>.git, seeds it to the worktree's tip with --no-verify, then
pushes HEAD:refs/heads/probe to it again through the hooks git runs, naming
the remote with -c so nothing is added to the repository's config. Measured
on git 2.55.0: an up-to-date push starts the pre-push hook with the remote on
argv and nothing on stdin, so the delegate is what runs and the destination is
what it judges. refuses and allows therefore name destinations
(owner/repo) rather than file contents; path and stage beside push are
refused at load, as is any push value but "empty". The six verdicts and
expect apply unchanged. A tree with no delegate reports the push as
ACCEPTED, which is the finding.

This repository runs lefthook and installs no delegate, so the probe is a
tests/probe_cli.rs fixture rather than an entry in its own
policy/hooks.toml.

Tests

• tests/hooks_install_cli.rs: adopt of the fleet's verbatim hand-written
  text; a drifted copy refused with the diff and untouched; no --adopt still
  refused; --check states and exit codes; --adopt --check is a usage error.
• tests/hooks_identity_cli.rs: two installed copies agree and a drifted one
  is drifted; a hand-written copy agrees with an installed one; the delegate
  is read from where core.hooksPath points; drifted is waivable.
• tests/hook_pins_cli.rs: a matching delegate passes, a drifted one is
  refused at exit 1; a hand-written copy passes with the adopt note.
• tests/probe_cli.rs: the empty-range push reaches the delegate and
  prevent-public-push (demonstrated); no delegate means ACCEPTED; a refusal
  from elsewhere (no uphold on PATH) is not the guard; the three load-time
  refusals; a runner probe without path is refused.
• Unit tests for effective_lines, unified_diff, the fingerprint and
  is_destination.

cargo test: 917 passed, 0 failed. cargo clippy --all-targets -- -D warnings,
cargo run -- check, cargo run -- scan and build_reference.py --check all
clean.

[coderabbitai]

Warning

Review limit reached

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ca19078f-4bf6-45ae-9bac-c6941bbd5beb

📥 Commits

Reviewing files that changed from the base of the PR and between ab694be and 3370dc6.

📒 Files selected for processing (9)

• docs/REFERENCE.md
• src/hooks.rs
• src/main.rs
• src/pins.rs
• src/probe.rs
• tests/hook_pins_cli.rs
• tests/hooks_identity_cli.rs
• tests/hooks_install_cli.rs
• tests/probe_cli.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 93.43545% with 30 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.74%. Comparing base (310ebab) to head (3370dc6).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
src/probe.rs	87.07%	19 Missing ⚠️
src/hooks.rs	96.16%	10 Missing ⚠️
src/pins.rs	97.72%	1 Missing ⚠️

❌ Your patch status has failed because the patch coverage (93.43%) is below the target coverage (100.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #207      +/-   ##
==========================================
+ Coverage   93.63%   93.74%   +0.10%     
==========================================
  Files          44       44              
  Lines       17057    17561     +504     
==========================================
+ Hits        15971    16462     +491     
- Misses       1086     1099      +13     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.