3.2 KiB
REPORT — catalog_gates --fast and the pre-push hook (2026-08-02)
Overwritten per the standing rule. The prior contents (the entry point itself, earlier the same
day) have their durable record in CHANGELOG.md; nothing was lost.
Change: scripts/catalog_gates.py gains --fast; .githooks/pre-push (new) runs it;
scripts/test_catalog_gates.py (new) pins its behaviour; CLAUDE.md records the hook.
No gate logic changed, no template touched, no version (this repo carries none).
| Commit | What |
|---|---|
c3e4bb1 |
scripts/catalog_gates.py --fast + scripts/test_catalog_gates.py + .githooks/pre-push + CLAUDE.md |
340ff2a |
CHANGELOG.md |
Baseline on arrival: fd7747d1293c, clean, HEAD == origin/main — matched the spec's anchor.
What --fast selects, and why the other two are excluded
--fast runs only gates that touch no network and no container runtime. Today that is gate 1,
check-image-pins.py. check-image-resolvable.py (network) and check-volume-persistence.py
(Docker, minutes per app) are not in it.
That exclusion is the point, not a compromise: a push that pulls images and starts containers gets
bypassed within a week, and the bypass becomes the habit. Both remain deliberate periodic runs — at
the start of a catalog campaign, before a publish train that vouches the catalog, and whenever a
template's volumes: block or image tag changes — on a scratch host, never a customer box.
The skip is announced, with its reason and with what still owes a run. A silently narrowed run reads as "covered everything" when it did not. Default behaviour with no flag is unchanged: all three gates, exactly as before.
.githooks/pre-push
Runs catalog_gates.py --fast and refuses the push, printing a line before and after because an
absent log line is not evidence a hook ran. Limits, written into the hook: per-clone
(core.hooksPath is local config; this clone is armed — git config --get core.hooksPath →
.githooks) and git push --no-verify bypasses it on purpose. It was not used against this
repo; both real pushes ran the hook and passed.
This makes R-161's convention half automatic-ish, not automatic. The unbypassable half is CI, which
has no execution mechanism here yet and is now tracked as felhom.eu OPEN-ITEMS.md R-168.
test_catalog_gates.py — pins the CONTENT, not just the exit code
Five tests: the static gate's own stdout must appear (an inert runner prints the summary while
calling nothing), the runtime gates' must not, the skip must be announced, and the no-flag path
must still select all three. Red-proof: replacing run_gate's body with return 0 turns it red.
Verification
catalog_gates — static gate only [--fast]
--fast SKIPPED: image-resolvable, volume-persistence — …
image-pin gate OK — 53 templates, 0 unpinned images
image-pins OK (exit 0)
all catalog gates OK
python3 scripts/test_catalog_gates.py → 5 tests, OK.
python3 scripts/test_check_volume_persistence.py — untouched, still green.
Full cross-repo detail, every red-proof, the core.hooksPath probe measurements and the hub
deployment: felhom.eu/REPORT.md.