feat: harvest husky pre-push template and claude permissions from active repos - #790
Conversation
setup-husky コマンドのドキュメントが pre-push に言及していたが テンプレ実体が無かったギャップを解消。package.json scripts を 自動検出して typecheck / build / test:ci / npm audit を実行する 汎用フックを templates/husky/pre-push として追加。 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR introduces a Husky pre-push hook template ( ChangesHusky pre-push hook
🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Claude finished @keito4's task in 1m 31s —— View job コードレビュー
総評ドキュメントと実装の整合を取る、明確な目的を持ったテンプレート追加で全体的に質は高い。既存の
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7cc4cd23c4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if [ ! -f package.json ]; then | ||
| echo "[pre-push] No package.json at repo root; skipping npm-based checks." | ||
| exit 0 |
There was a problem hiding this comment.
In repositories that follow the existing setup-husky guidance, the npm scripts live in next/package.json and the documented hook runs them via npm --prefix next; with this template, those same repos hit this root-only check and exit 0, so the pre-push typecheck/test gate is silently disabled. I checked .claude/commands/setup-husky.md, which explicitly says to use npm --prefix next and lists the required scripts in next/package.json, so the template needs to support that documented layout or it won't replace the inline hook safely.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
templates/husky/pre-push (1)
33-41: ⚡ Quick winTreat alias script names as fallbacks, not cumulative steps.
If a repo defines both
typecheckandtype-checkor bothtest:ciandtest:all, this hook runs the same expensive gate twice. A single “first match wins” helper would keep pre-push latency predictable.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@templates/husky/pre-push` around lines 33 - 41, The hook currently calls run_if_script separately for aliases (e.g., run_if_script typecheck and run_if_script type-check, run_if_script test:ci and run_if_script test:all), causing duplicate/expensive gates; change the logic so run_if_script implements a first-match-wins fallback: track which gate key (e.g., SKIP_TYPECHECK, SKIP_TEST) has been executed and if already handled skip subsequent alias calls so aliases act as fallbacks rather than cumulative steps; update the helper used by run_if_script (and any callers referencing typecheck/type-check or test:ci/test:all) to consult and set a done flag per gate key before running the expensive action.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@templates/husky/pre-push`:
- Around line 21-23: The pre-push husky template currently hardcodes npm for
running scripts and audits (see the npm run "$script_name" and npm audit
invocations); update the hook to detect the repository package manager using the
same lockfile-based detection logic used by the existing quality-gate flow and
invoke scripts and audits via the detected tool (e.g., run script via the
detected package manager command rather than npm), and implement alias
deduplication so if equivalent scripts exist (e.g., "typecheck" vs "type-check",
"test:ci" vs "test:all") the hook resolves to a single canonical script name
before running to avoid duplicate work—reuse the quality-gate's lockfile
detection helper and script-resolution strategy to locate the package manager
and canonical script name.
In `@templates/README.md`:
- Around line 29-31: Update the README table entry for the `husky/pre-push`
template to narrow the scope from “全プロジェクト” to indicate it only applies to
package.json-based (Node / npm-script) repositories; mention that the hook exits
when the repo root has no package.json and therefore only runs for Node/npm
projects so readers won't expect it to run in non-Node repos.
---
Nitpick comments:
In `@templates/husky/pre-push`:
- Around line 33-41: The hook currently calls run_if_script separately for
aliases (e.g., run_if_script typecheck and run_if_script type-check,
run_if_script test:ci and run_if_script test:all), causing duplicate/expensive
gates; change the logic so run_if_script implements a first-match-wins fallback:
track which gate key (e.g., SKIP_TYPECHECK, SKIP_TEST) has been executed and if
already handled skip subsequent alias calls so aliases act as fallbacks rather
than cumulative steps; update the helper used by run_if_script (and any callers
referencing typecheck/type-check or test:ci/test:all) to consult and set a done
flag per gate key before running the expensive action.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f272a1a5-3cc6-40fa-9c9f-f82f621c2709
📒 Files selected for processing (2)
templates/README.mdtemplates/husky/pre-push
| if node -e "process.exit(require('./package.json').scripts?.['$script_name'] ? 0 : 1)" 2>/dev/null; then | ||
| echo "[pre-push] Running $script_name..." | ||
| npm run "$script_name" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the mismatch between the new hook and the existing multi-package-manager contract.
sed -n '1,120p' templates/husky/pre-push
printf '\n---\n'
sed -n '44,74p' .claude/hooks/README.md
printf '\n---\n'
rg -n 'npm run|npm audit|pnpm|yarn|bun|ロックファイル|lockfile' templates/husky/pre-push .claude/hooks/README.mdRepository: keito4/config
Length of output: 3133
Remove hardcoded npm from the “generic” templates/husky/pre-push hook (lines ~21-23, ~45-46)
This template hardcodes npm run "$script_name" and npm audit ..., but the existing quality-gate flow is designed to support npm / pnpm / yarn / bun via lockfile auto-detection—so pnpm/yarn/bun repos won’t match the expected toolchain/lockfile behavior.
- Switch to package-manager-aware execution for both script running and audit (reuse the same lockfile-based detection logic from the existing quality-gate flow).
- Optionally deduplicate heavy alias checks (
typecheckvstype-check,test:civstest:all) when both exist to avoid running the same work twice.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@templates/husky/pre-push` around lines 21 - 23, The pre-push husky template
currently hardcodes npm for running scripts and audits (see the npm run
"$script_name" and npm audit invocations); update the hook to detect the
repository package manager using the same lockfile-based detection logic used by
the existing quality-gate flow and invoke scripts and audits via the detected
tool (e.g., run script via the detected package manager command rather than
npm), and implement alias deduplication so if equivalent scripts exist (e.g.,
"typecheck" vs "type-check", "test:ci" vs "test:all") the hook resolves to a
single canonical script name before running to avoid duplicate work—reuse the
quality-gate's lockfile detection helper and script-resolution strategy to
locate the package manager and canonical script name.
| | テンプレート | いつ使う | | ||
| | ---------------- | ---------------------------------------------------------------------------------------- | | ||
| | `husky/pre-push` | **全プロジェクト**: typecheck / build / test:ci / npm audit を push 前に実行（自動検出） | |
There was a problem hiding this comment.
Narrow the scope from “all projects” to package.json-based repos.
templates/husky/pre-push exits immediately when the repo root has no package.json (Lines 27-29 there), so **全プロジェクト** is broader than the actual behavior. Calling out Node/npm-script projects here would set the right expectation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@templates/README.md` around lines 29 - 31, Update the README table entry for
the `husky/pre-push` template to narrow the scope from “全プロジェクト” to indicate it
only applies to package.json-based (Node / npm-script) repositories; mention
that the hook exits when the repo root has no package.json and therefore only
runs for Node/npm projects so readers won't expect it to run in non-Node repos.
ohana / raycast-extensions の .claude/settings*.json を調査し、 既存の広い権限 (npm:* / npx:* / gh:* / python3:* 等) でカバーされない 真に新規な許可コマンドのみを抽出して追加。 - Bash(nodemon:*): dev-only watcher - Bash(supabase projects api-keys:*): read-only - Bash(supabase projects get-config:*): read-only - WebFetch(domain:skills.sh): raycast-extensions で参照 chmod / git merge / git rebase 等は意図的に ask ブロック維持 (安全側)。 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
keito4
changed the title
直近 OYKOT-jp / Elu-co-jp / keito4-org / keito4 配下の active リポの .claude/settings.local.json を全走査し、既存の広い allow glob で カバーされず複数リポで繰り返し使われている開発ツールチェーンのみを追加。 - 代替ランタイム: bun / bunx / uv - モバイル/ネイティブビルド: flutter / dart / ./gradlew / adb / xcodebuild / xcrun / xcodegen / swiftlint / maestro / patrol - Ruby/iOS CI: ruby / gem / bundle / fastlane / pod - 秘密管理(dev): doppler run（書き込み系は ask 維持） - ユーティリティ: yq（jq 相当）/ git worktree（agent worktree 運用） いずれも build/test/dev 用途で副作用が小さいものに限定。chmod / git merge / rebase 等の他リポで allow されていた項目は安全側で ask 維持。 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
🎉 This PR is included in version 1.114.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Why
/setup-huskyのドキュメントが pre-push に言及していたのにテンプレ実体が無く、また直近で keito4 が触っているリポ (ohana,effectuation,raycast-extensions) で個別に許可されている Claude コマンドが共通化されていなかった。これらを収穫して config に取り込む。さらに OYKOT-jp / Elu-co-jp / keito4-org / keito4 配下の active リポ全体を走査し、既存の広い allow glob でカバーされない開発ツールチェーンを追加収穫した。
What
1. Husky pre-push テンプレ (
templates/husky/pre-push)package.jsonの scripts を自動検出して順次実行:typecheck/type-checkbuildtest:ci/test:allnpm audit --audit-level=high --omit=dev（非ブロッキング、AUDIT_BLOCK=1で強制）SKIP_TYPECHECK/SKIP_BUILD/SKIP_TEST/SKIP_AUDIT環境変数で個別スキップ可能package.json不在のリポでも安全に no-optemplates/README.mdに Husky フックセクション追加2. Claude 権限の収穫 (
.claude/settings.json)2a. ohana / raycast-extensions からの初回収穫
既存の広い権限 (
npm:*/npx:*/gh:*/python3:*等) でカバーされない真に新規な許可コマンドのみを追加:Bash(nodemon:*)— dev-only watcherBash(supabase projects api-keys:*)— read-onlyBash(supabase projects get-config:*)— read-onlyWebFetch(domain:skills.sh)— raycast-extensions で参照2b. 全 active リポ走査による開発ツールチェーン収穫
OYKOT-jp / Elu-co-jp / keito4-org / keito4 配下の
.claude/settings.local.jsonを全走査し、既存 glob でカバーされず複数リポで繰り返し使われている dev/build/test ツールのみを追加:bun/bunx/uvflutter/dart/./gradlew/adb/xcodebuild/xcrun/xcodegen/swiftlint/maestro/patrol（calendar_alerm, intent-gate-android 等）ruby/gem/bundle/fastlane/poddoppler run（secrets の直接出力や書き込み系はask維持）yq（jq相当）/git worktree（agent worktree 運用）How
pre_git_quality_gates.pyと同様の auto-detect パターンで repo 横断の再利用性を確保。chmod/git merge/git rebase/terragrunt apply/ 1Passwordop/ 各種 destructive コマンドは他リポで allow されていても安全側でask/ 不採用を維持。dopplerもrun（secret 注入してコマンド実行）のみに限定し、生 secret 出力は対象外。Risk
低。
repo-maintenanceの自動適用ロジック変更は今回スコープ外。🤖 Generated with Claude Code