ci(drift): enforce alias freshness checks in CI and contributor flow (#2910)

Merging alias-drift guardrails and local hook hardening.

tests/precommit-alias-drift-hook.test.cjs

@@ -0,0 +1,67 @@
+'use strict';
+
+const { describe, test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { createTempDir, cleanup } = require('./helpers.cjs');
+
+const ROOT = path.resolve(__dirname, '..');
+const HOOK_PATH = path.join(ROOT, '.githooks', 'pre-commit');
+
+function writeExec(filePath, content) {
+  fs.writeFileSync(filePath, content, { mode: 0o755 });
+}
+
+describe('.githooks/pre-commit alias drift guard', () => {
+  test('runs npm check when staged files include command-manifest/alias artifacts', (t) => {
+    const tmpDir = createTempDir('gsd-precommit-hook-');
+    t.after(() => cleanup(tmpDir));
+
+    const binDir = path.join(tmpDir, 'bin');
+    fs.mkdirSync(binDir, { recursive: true });
+
+    writeExec(path.join(binDir, 'git'), `#!/usr/bin/env bash\nprintf "%s\\n" "${'sdk/src/query/command-manifest.phase.ts'}"\n`);
+    writeExec(path.join(binDir, 'npm'), `#!/usr/bin/env bash\nprintf "called" > "$GSD_TEST_NPM_MARKER"\n`);
+
+    const marker = path.join(tmpDir, 'npm-called.txt');
+
+    execFileSync('bash', [HOOK_PATH], {
+      cwd: ROOT,
+      env: {
+        ...process.env,
+        PATH: `${binDir}:${process.env.PATH}`,
+        GSD_TEST_NPM_MARKER: marker,
+      },
+      stdio: 'pipe',
+    });
+
+    assert.ok(fs.existsSync(marker), 'expected npm run check:alias-drift to be invoked');
+  });
+
+  test('does not run npm check when staged files are unrelated', (t) => {
+    const tmpDir = createTempDir('gsd-precommit-hook-');
+    t.after(() => cleanup(tmpDir));
+
+    const binDir = path.join(tmpDir, 'bin');
+    fs.mkdirSync(binDir, { recursive: true });
+
+    writeExec(path.join(binDir, 'git'), `#!/usr/bin/env bash\nprintf "%s\\n" "README.md"\n`);
+    writeExec(path.join(binDir, 'npm'), `#!/usr/bin/env bash\nprintf "called" > "$GSD_TEST_NPM_MARKER"\n`);
+
+    const marker = path.join(tmpDir, 'npm-called.txt');
+
+    execFileSync('bash', [HOOK_PATH], {
+      cwd: ROOT,
+      env: {
+        ...process.env,
+        PATH: `${binDir}:${process.env.PATH}`,
+        GSD_TEST_NPM_MARKER: marker,
+      },
+      stdio: 'pipe',
+    });
+
+    assert.ok(!fs.existsSync(marker), 'expected npm check to be skipped for unrelated staged files');
+  });
+});

tests/prepush-enterprise-email-hook.test.cjs

@@ -0,0 +1,90 @@
+'use strict';
+
+const { describe, test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { createTempDir, cleanup } = require('./helpers.cjs');
+
+const ROOT = path.resolve(__dirname, '..');
+const HOOK_PATH = path.join(ROOT, '.githooks', 'pre-push');
+
+function writeExec(filePath, content) {
+  fs.writeFileSync(filePath, content, { mode: 0o755 });
+}
+
+describe('.githooks/pre-push enterprise email guard', () => {
+  test('blocks push when any to-be-pushed commit matches local blocked regex', (t) => {
+    const tmpDir = createTempDir('gsd-prepush-hook-');
+    t.after(() => cleanup(tmpDir));
+
+    const binDir = path.join(tmpDir, 'bin');
+    fs.mkdirSync(binDir, { recursive: true });
+
+    writeExec(path.join(binDir, 'git'), `#!/usr/bin/env bash
+set -euo pipefail
+if [[ "$1" == "rev-list" ]]; then
+  echo "c1"
+  echo "c2"
+  exit 0
+fi
+if [[ "$1" == "show" ]]; then
+  commit="$(printf '%s\n' "$@" | tail -n 1)"
+  if [[ "$commit" == "c1" ]]; then
+    echo "trekkie@nomorestars.com"
+  else
+    echo "person@example-corp.com"
+  fi
+  exit 0
+fi
+exit 1
+`);
+
+    assert.throws(() => {
+      execFileSync('bash', [HOOK_PATH], {
+        cwd: ROOT,
+        env: {
+          ...process.env,
+          PATH: `${binDir}:${process.env.PATH}`,
+          GSD_BLOCKED_AUTHOR_REGEX: '@example-corp\\.com$',
+        },
+        input: 'refs/heads/pr refs-local-sha refs/heads/pr refs-remote-sha\n',
+        stdio: 'pipe',
+      });
+    }, /Push blocked: commit author email matched local blocked regex/);
+  });
+
+  test('allows push when to-be-pushed commits are non-enterprise emails', (t) => {
+    const tmpDir = createTempDir('gsd-prepush-hook-');
+    t.after(() => cleanup(tmpDir));
+
+    const binDir = path.join(tmpDir, 'bin');
+    fs.mkdirSync(binDir, { recursive: true });
+
+    writeExec(path.join(binDir, 'git'), `#!/usr/bin/env bash
+set -euo pipefail
+if [[ "$1" == "rev-list" ]]; then
+  echo "c1"
+  echo "c2"
+  exit 0
+fi
+if [[ "$1" == "show" ]]; then
+  echo "trekkie@nomorestars.com"
+  exit 0
+fi
+exit 1
+`);
+
+    execFileSync('bash', [HOOK_PATH], {
+      cwd: ROOT,
+      env: {
+        ...process.env,
+        PATH: `${binDir}:${process.env.PATH}`,
+        GSD_BLOCKED_AUTHOR_REGEX: '@example-corp\\.com$',
+      },
+      input: 'refs/heads/pr refs-local-sha refs/heads/pr refs-remote-sha\n',
+      stdio: 'pipe',
+    });
+  });
+});