ci: keep pre-commit proportionate and avoid tool downloads (WealthLedger/frontend#62) (#86)

scripts/test-pre-commit.mjs

@@ -47,6 +47,12 @@ test("pre-commit scans the index, redacts findings and fails closed", () => {
 		}
 
 		git("init", "--quiet");
+		// The hook must run the installed lint-staged binary, never download one.
+		const localBin = nodePath.join(cwd, "node_modules", ".bin");
+		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
+		mkdirSync(localBin, { recursive: true });
+		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
+		writeFileSync(nodePath.join(localBin, "lint-staged"), "#!/bin/sh\necho ran >> downstream\n", { mode: 0o755 });
 		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
 		writeFileSync(nodePath.join(cwd, "sample.txt"), "safe staged content\n");
 		git("add", "sample.txt");
@@ -77,3 +83,37 @@ test("pre-commit scans the index, redacts findings and fails closed", () => {
 		rmSync(cwd, { force: true, recursive: true });
 	}
 });
+
+test("pre-commit never downloads tools and blocks when lint-staged is missing", () => {
+	const hook = nodePath.resolve(".husky/pre-commit");
+	const cwd = mkdtempSync(nodePath.join(tmpdir(), "frontend-hook-"));
+	const bin = nodePath.join(cwd, "bin");
+	const marker = nodePath.join(cwd, "downstream");
+
+	try {
+		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
+		mkdirSync(bin);
+		// Gitleaks passes; npx/npm must never be reached, even if present on PATH.
+		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
+		writeFileSync(nodePath.join(bin, "gitleaks"), "#!/bin/sh\nexit 0\n", { mode: 0o755 });
+
+		for (const command of ["npx", "npm"]) {
+			// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
+			writeFileSync(nodePath.join(bin, command), "#!/bin/sh\necho ran >> downstream\n", { mode: 0o755 });
+		}
+
+		const result = spawnSync("/bin/sh", ["-e", hook], {
+			cwd,
+			encoding: "utf8",
+			env: { ...process.env, PATH: `${bin}${nodePath.delimiter}${process.env.PATH}` },
+		});
+
+		assert.notEqual(result.status, 0, "missing lint-staged must block commit");
+		assert.match(result.stderr, /lint-staged is not installed/);
+		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
+		assert.ok(!existsSync(marker), "hook must not invoke npx or npm");
+	}
+	finally {
+		rmSync(cwd, { force: true, recursive: true });
+	}
+});