---
id: 07-pre-commit-and-ci-integration
epic: compliance-manifests-pii-retention-subprocessors
title: Pre-commit hook and CI integration for compliance drift detection
type: technical-story
status: done
feature: tooling
depends-on: [06-compliance-generator-scripts]
blocks: []
created: 2026-05-18T17:52:09Z
updated: 2026-05-18T20:16:22.912Z
---

## Goal

Wire `pnpm compliance:emit-all` into the pre-commit hook (conditional — only when staged files are Payload configs or library traces) and add `pnpm compliance:emit-all --check` as a hard-fail step in the CI validate job, positioned after `pnpm conformance` and before `pnpm coverage:diff`.

## Why

The generators alone don't prevent drift — a developer could edit a Payload config and never regenerate. The pre-commit hook auto-regenerates and auto-stages `compliance/*.yml`; CI catches any slip-through on the PR. Together they form the E3 and E5 latency layers for compliance drift.

## Done when

- `.husky/pre-commit` gains a conditional step that: checks whether any staged file matches `packages/*/src/integrations/cms/**/*.ts`, `docs/library-decisions/*.md`, or `compliance/*.yml`; if so, runs `pnpm compliance:emit-all` and `git add compliance/`. Non-matching commits incur only the ~10ms detection cost.
- `.github/workflows/ci.yml` validate job gains a `Compliance manifest drift check` step running `pnpm compliance:emit-all --check`, positioned after `pnpm conformance`. CI failure message includes the fix command (`pnpm compliance:emit-all`).
- `pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff` all pass.

## In scope

- `.husky/pre-commit` — conditional compliance regeneration step.
- `.github/workflows/ci.yml` — validate job `compliance:emit-all --check` step.

## Out of scope

- Generator scripts themselves (Story 06).
- The `--no-verify` bypass — repo policy already prohibits it; CI re-checks provide the safety net.

## Tasks

- [x] Add conditional `pnpm compliance:emit-all` step to `.husky/pre-commit` (staged-file pattern guard matching Payload configs, library traces, and `compliance/*.yml`; auto-stages generated files via `git add compliance/`) and add `pnpm compliance:emit-all --check` hard-fail step to `.github/workflows/ci.yml` validate job with failure message pointing to the fix command — all gates pass on this commit.
