feat(hooks): push 前パイプラインハーネスの実装

[aloekun]

Summary

• Claude Code hooks に存在しない push hook を、PreToolUse ブロック + スタンドアロン exe の2段構成で補完
• PreToolUse の jj-push-guard プリセットで直接の push をブロックし、pnpm push に誘導
• hooks-push-pipeline (Rust exe) が hooks-config.toml の [push_pipeline] セクションからステップを読み込み、順次実行
• type = "command" ステップ（テスト等）は即時実行、type = "ai" ステップ（レビュー、コミット整理）は将来実装のプレースホルダー

Changes

ファイル	内容
.claude/hooks-push-pipeline/	パイプラインランナー (Rust, 9 テスト付き)
.claude/hooks-pre-tool-validate/src/main.rs	jj-push-guard プリセット追加
.claude/hooks-config.toml	[push_pipeline] セクション追加
package.json	build:hooks-push-pipeline, push スクリプト追加
docs/adr/adr-008-push-pipeline-harness.md	設計判断の記録

Test plan

• cargo test (hooks-push-pipeline): 9/9 pass
• cargo test (hooks-pre-tool-validate): 93/93 pass
• pnpm push でパイプライン実行を確認 (test pass → AI skip → push 完了)
• pnpm build:hooks で全 hooks の一括ビルドを確認

🤖 Generated with Claude Code

Summary by CodeRabbit

• 新機能

  • pnpm push によるプッシュ前パイプラインを追加（テスト実行とレビューステップを順に実行）。
  • 直接的なプッシュ操作をブロックして pnpm push を促す保護機構を導入。

• ドキュメント

  • ADR-008 を追加し、プッシュパイプラインの設計と動作方針を記載。

• その他

  • ビルド／デプロイスクリプトと ignore 設定を更新し、パイプライン実行ファイルの扱いを反映。

[coderabbitai]

📝 Walkthrough

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 59.09% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	プルリクエストのタイトル「feat(hooks): push 前パイプラインハーネスの実装」は、変更の主な内容（push 前に実行されるパイプラインハーネスの実装）を明確に要約しており、変更内容と完全に一致しています。

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (2)

.claude/hooks-pre-tool-validate/src/main.rs (1)

234-265: 環境変数プレフィックスによるバイパスの可能性

preset_git() (line 125) では (?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+|command\s+|env\s+)* を含めて環境変数プレフィックスや command/env ビルトイン経由の実行をブロックしています。しかし preset_jj_push_guard() にはこの対策がありません。

以下のコマンドがバイパスできる可能性があります：

• JJ_TRACE=1 jj git push
• command jj git push
• env jj git push

♻️ 環境変数プレフィックス対策の追加

 BlockedPattern {
-    pattern: Regex::new(r#"(?im)(^|&&|;|\|\||\||&)\s*jj\s+git\s+push(\s|$)"#).unwrap(),
+    pattern: Regex::new(r#"(?im)(^|&&|;|\|\||\||&)\s*(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+|command\s+|env\s+)*jj\s+git\s+push(\s|$)"#).unwrap(),
     message: r#"**jj git push がブロックされました**

同様に jj push のパターンにも適用してください。

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.claude/hooks-pre-tool-validate/src/main.rs around lines 234 - 265, The jj
push guard patterns in preset_jj_push_guard() lack the
environment-variable/command/env prefix protection present in preset_git();
update both Regex::new(...) patterns (the ones matching `jj\s+git\s+push` and
`jj\s+push`) to include the same prefix group
`(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+|command\s+|env\s+)*` at the start of the
pattern so invocations like `JJ_TRACE=1 jj git push`, `command jj git push`, or
`env jj push` are blocked the same way as in preset_git().

docs/adr/adr-008-push-pipeline-harness.md (1)

35-53: コードブロックに言語指定を追加してください。

markdownlint により、fenced code block に言語指定がないことが検出されています（MD040）。アーキテクチャ図として text または明示的な指定を追加してください。

📝 言語指定の追加

-```
+```text
 Claude が "jj git push" を実行しようとする

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/adr/adr-008-push-pipeline-harness.md` around lines 35 - 53, The fenced
code block in adr-008-push-pipeline-harness.md that contains the architecture
diagram (the block beginning with the line "Claude が \"jj git push\" を実行しようとする")
must include a language spec to satisfy markdownlint MD040; update the opening
triple-backtick to include a language such as text (e.g., ```text) so the
diagram block is explicitly marked and the linter error is resolved.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.claude/hooks-push-pipeline/src/main.rs:
- Around line 196-197: The current unwrap_or_else on pipeline.push_cmd accepts
empty or whitespace-only strings; update the logic that builds push_cmd (and the
similar cmd handling at the other block) to trim whitespace and treat an empty
result as missing so the DEFAULT_PUSH_CMD is used: when reading
pipeline.push_cmd, trim() the string and if the trimmed string is non-empty use
it, otherwise fall back to DEFAULT_PUSH_CMD (same change for the other variable
named cmd/ pipeline.cmd), ensuring both whitespace-only and empty strings are
replaced by the default.

In `@package.json`:
- Line 16: The "push" npm script currently uses Windows-only backslash and .exe
(".\\.claude\\hooks-push-pipeline.exe"), which breaks on Unix; update the "push"
script in package.json to invoke a cross-platform path or wrapper (for example
"./.claude/hooks-push-pipeline" without backslashes/extension) or implement
platform-specific scripts like "push:win" and "push:unix" and have "push"
dispatch to the correct one (or use a small Node wrapper that selects the
correct binary), referencing the "push" script name and the
".claude/hooks-push-pipeline" binary to locate the change.

---

Nitpick comments:
In @.claude/hooks-pre-tool-validate/src/main.rs:
- Around line 234-265: The jj push guard patterns in preset_jj_push_guard() lack
the environment-variable/command/env prefix protection present in preset_git();
update both Regex::new(...) patterns (the ones matching `jj\s+git\s+push` and
`jj\s+push`) to include the same prefix group
`(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+|command\s+|env\s+)*` at the start of the
pattern so invocations like `JJ_TRACE=1 jj git push`, `command jj git push`, or
`env jj push` are blocked the same way as in preset_git().

In `@docs/adr/adr-008-push-pipeline-harness.md`:
- Around line 35-53: The fenced code block in adr-008-push-pipeline-harness.md
that contains the architecture diagram (the block beginning with the line
"Claude が \"jj git push\" を実行しようとする") must include a language spec to satisfy
markdownlint MD040; update the opening triple-backtick to include a language
such as text (e.g., ```text) so the diagram block is explicitly marked and the
linter error is resolved.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8eefad1c-2540-404e-b3ed-db1abdc1742f

📥 Commits

Reviewing files that changed from the base of the PR and between cdd1551 and 9d9bcb9.

⛔ Files ignored due to path filters (1)

• .claude/hooks-push-pipeline/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (9)

• .claude/hooks-config.toml
• .claude/hooks-pre-tool-validate/src/main.rs
• .claude/hooks-push-pipeline/Cargo.toml
• .claude/hooks-push-pipeline/src/main.rs
• .gitignore
• CLAUDE.md
• docs/adr/adr-008-push-pipeline-harness.md
• package.json
• scripts/deploy-hooks.ts

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

クロスプラットフォーム互換性の確認が必要です。

push スクリプトで Windows 固有のパス構文 (.\) を使用しています。Unix 系システム（Linux/macOS）では ./ が必要であり、現在の構文では動作しません。

.exe 拡張子から Windows 専用を意図している可能性がありますが、クロスプラットフォーム対応が必要な場合は以下の修正を検討してください：

🔧 クロスプラットフォーム対応の提案

-    "push": ".\\.claude\\hooks-push-pipeline.exe",
+    "push": "node -e \"require('child_process').execSync(process.platform === 'win32' ? '.\\\\.claude\\\\hooks-push-pipeline.exe' : './.claude/hooks-push-pipeline', {stdio: 'inherit'})\"",

または、Unix 用にはシンボリックリンクや拡張子なしのバイナリを用意する方法もあります。

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` at line 16, The "push" npm script currently uses Windows-only
backslash and .exe (".\\.claude\\hooks-push-pipeline.exe"), which breaks on
Unix; update the "push" script in package.json to invoke a cross-platform path
or wrapper (for example "./.claude/hooks-push-pipeline" without
backslashes/extension) or implement platform-specific scripts like "push:win"
and "push:unix" and have "push" dispatch to the correct one (or use a small Node
wrapper that selects the correct binary), referencing the "push" script name and
the ".claude/hooks-push-pipeline" binary to locate the change.

[coderabbitai]

🧹 Nitpick comments (1)

.claude/hooks-push-pipeline/src/main.rs (1)

106-114: Windows 固有の cmd /c を使用しているため、Linux/macOS では動作しません

Command::new("cmd").args(["/c", cmd]) は Windows 専用です。クロスプラットフォーム対応が必要な場合は、OS に応じてシェルを切り替える必要があります。

現在の設計が Windows 専用で意図的であれば問題ありませんが、将来的な移植性を考慮する場合は修正を検討してください。

♻️ クロスプラットフォーム対応案

-    let mut child = match Command::new("cmd")
-        .args(["/c", cmd])
+    #[cfg(windows)]
+    let mut child = match Command::new("cmd")
+        .args(["/c", cmd])
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+    {
+        Ok(c) => c,
+        Err(e) => return (false, format!("Failed to execute {}: {}", cmd, e)),
+    };
+
+    #[cfg(not(windows))]
+    let mut child = match Command::new("sh")
+        .args(["-c", cmd])
         .stdout(std::process::Stdio::piped())
         .stderr(std::process::Stdio::piped())
         .spawn()

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.claude/hooks-push-pipeline/src/main.rs around lines 106 - 114, The code
currently spawns a process with Windows-only Command::new("cmd").args(["/c",
cmd]) which breaks on Linux/macOS; change the spawn logic to choose the shell
based on the target OS (e.g., if cfg!(windows) use
Command::new("cmd").args(&["/c", cmd]) else use Command::new("sh").args(&["-c",
cmd])) and then call .stdout(Stdio::piped()).stderr(Stdio::piped()).spawn() the
same way; keep the same error handling (the Err(e) => return ...) and the
variable names (child, cmd) so the rest of the function remains unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.claude/hooks-push-pipeline/src/main.rs:
- Around line 106-114: The code currently spawns a process with Windows-only
Command::new("cmd").args(["/c", cmd]) which breaks on Linux/macOS; change the
spawn logic to choose the shell based on the target OS (e.g., if cfg!(windows)
use Command::new("cmd").args(&["/c", cmd]) else use
Command::new("sh").args(&["-c", cmd])) and then call
.stdout(Stdio::piped()).stderr(Stdio::piped()).spawn() the same way; keep the
same error handling (the Err(e) => return ...) and the variable names (child,
cmd) so the rest of the function remains unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b2e6b497-f318-43af-8055-f6b0e1b1abc3

📥 Commits

Reviewing files that changed from the base of the PR and between 9d9bcb9 and 9150913.

⛔ Files ignored due to path filters (1)

• .claude/hooks-push-pipeline/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (9)

• .claude/hooks-config.toml
• .claude/hooks-pre-tool-validate/src/main.rs
• .claude/hooks-push-pipeline/Cargo.toml
• .claude/hooks-push-pipeline/src/main.rs
• .gitignore
• CLAUDE.md
• docs/adr/adr-008-push-pipeline-harness.md
• package.json
• scripts/deploy-hooks.ts

✅ Files skipped from review due to trivial changes (3)

• CLAUDE.md
• .claude/hooks-push-pipeline/Cargo.toml
• .gitignore

🚧 Files skipped from review as they are similar to previous changes (4)

• scripts/deploy-hooks.ts
• package.json
• .claude/hooks-config.toml
• docs/adr/adr-008-push-pipeline-harness.md