cmux-next gate: a stale hook install refuses; never fall back to the pushed checks

Merged
LA
3d ago
+159-22

Summary

Its base #34219 has merged (c874cb91a83), and #34197 merged first (884c330817a), so feat-cmux-next was merged into this branch (a6ad5896f90, no force push). Neither touches this PR's lines: feat's prepush-gate.py is byte-identical to #34219's head, and #34197 changed only web_lint_prepush.py. This PR's own change over feat is two files.

The pre-push hook must never run code that the push controls (docs/contributor-verification.md, trust boundary). When the installed hook was older than a check, the cmux-next gate fell back to the pushed head's copy:

  • of check-leo-bans.py and check-ghostty-reserved-keys.py, which it then ran;
  • of scripts/swift_source_mask.py, which it wrote into the check trees, where check-package-dependency-lists.py imports it.

Now, on a hook run (--trusted-scripts-dir), a check that the pushed head has but the install lacks refuses the push with:

the installed hook is older than the checks this push needs: rerun scripts/install-git-hooks.sh

The pushed copy is never run or written. A head older than the check skips it, as before. A manual run, with no --trusted-scripts-dir, still reads the checkout's copy. A current install has all three files, so it is not affected.

Folded in, per the earlier review of #34219:

  • The perf cron comment no longer says the push runs the tests.
  • The refusal message no longer names the perf cron tests.
  • The dead guarded = perf_cron_tests(...) or guarded line is gone.

Testing

Red on e2550b6e243 (#34219's head; the tests are in their own commit), green on the head:

(cd tests && python3 -m unittest -k stale_install -k refuse_an_install_without_the_masker test_cmux_next_prepush_gate)
  • On the base: 3 failures. The hook ran a pushed check-leo-bans.py and a pushed check-ghostty-reserved-keys.py (each writes a marker file), and build_trees did not refuse an install without the masker.
  • On the head: all pass. The push is refused with the message above, nothing pushed runs, and the check trees hold only the installed masker.

Observed / Not run

Observed:

  • python3 tests/test_cmux_next_prepush_gate.py: 91 tests OK, including the stale-install lint-tools.lock test added after review.
  • python3 scripts/cmux-next/prepush-gate.py: no new violations.

Not run:

  • A real push from a stale install on a Mac. The test uses the real installer and a real git push, with the file removed from the installed copy.

Changelog

none

Proof

No capture: hook tooling only.