67 lines
3.2 KiB
Markdown
67 lines
3.2 KiB
Markdown
# REPORT — `catalog_gates --fast` and the pre-push hook (2026-08-02)
|
|
|
|
**Overwritten** per the standing rule. The prior contents (the entry point itself, earlier the same
|
|
day) have their durable record in `CHANGELOG.md`; nothing was lost.
|
|
|
|
**Change:** `scripts/catalog_gates.py` gains `--fast`; `.githooks/pre-push` (new) runs it;
|
|
`scripts/test_catalog_gates.py` (new) pins its behaviour; `CLAUDE.md` records the hook.
|
|
**No gate logic changed, no template touched, no version** (this repo carries none).
|
|
|
|
| Commit | What |
|
|
|---|---|
|
|
| `c3e4bb1` | `scripts/catalog_gates.py` `--fast` + `scripts/test_catalog_gates.py` + `.githooks/pre-push` + `CLAUDE.md` |
|
|
| `340ff2a` | `CHANGELOG.md` |
|
|
|
|
Baseline on arrival: `fd7747d1293c`, clean, `HEAD == origin/main` — matched the spec's anchor.
|
|
|
|
## What `--fast` selects, and why the other two are excluded
|
|
|
|
`--fast` runs only gates that touch **no network and no container runtime**. Today that is gate 1,
|
|
`check-image-pins.py`. `check-image-resolvable.py` (network) and `check-volume-persistence.py`
|
|
(Docker, minutes per app) are **not** in it.
|
|
|
|
That exclusion is the point, not a compromise: **a push that pulls images and starts containers gets
|
|
bypassed within a week, and the bypass becomes the habit.** Both remain deliberate periodic runs — at
|
|
the start of a catalog campaign, before a publish train that vouches the catalog, and whenever a
|
|
template's `volumes:` block or image tag changes — on a scratch host, never a customer box.
|
|
|
|
**The skip is announced**, with its reason and with what still owes a run. A silently narrowed run
|
|
reads as "covered everything" when it did not. Default behaviour with no flag is **unchanged**: all
|
|
three gates, exactly as before.
|
|
|
|
## `.githooks/pre-push`
|
|
|
|
Runs `catalog_gates.py --fast` and refuses the push, printing a line before and after because an
|
|
absent log line is not evidence a hook ran. Limits, written into the hook: **per-clone**
|
|
(`core.hooksPath` is local config; this clone is armed — `git config --get core.hooksPath` →
|
|
`.githooks`) and **`git push --no-verify` bypasses it on purpose**. It was **not** used against this
|
|
repo; both real pushes ran the hook and passed.
|
|
|
|
This makes R-161's convention half automatic-ish, not automatic. The unbypassable half is CI, which
|
|
has no execution mechanism here yet and is now tracked as `felhom.eu` `OPEN-ITEMS.md` **R-168**.
|
|
|
|
## `test_catalog_gates.py` — pins the CONTENT, not just the exit code
|
|
|
|
Five tests: the static gate's own stdout must appear (an inert runner prints the summary while
|
|
calling nothing), the runtime gates' must **not**, the skip must be announced, and the no-flag path
|
|
must still select all three. **Red-proof:** replacing `run_gate`'s body with `return 0` turns it red.
|
|
|
|
## Verification
|
|
|
|
```
|
|
catalog_gates — static gate only [--fast]
|
|
--fast SKIPPED: image-resolvable, volume-persistence — …
|
|
|
|
image-pin gate OK — 53 templates, 0 unpinned images
|
|
|
|
image-pins OK (exit 0)
|
|
|
|
all catalog gates OK
|
|
```
|
|
|
|
`python3 scripts/test_catalog_gates.py` → **5 tests, OK**.
|
|
`python3 scripts/test_check_volume_persistence.py` — untouched, still green.
|
|
|
|
Full cross-repo detail, every red-proof, the `core.hooksPath` probe measurements and the hub
|
|
deployment: `felhom.eu/REPORT.md`.
|