fraqtal/agentic-dev
Template
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

feat(scripts): pre-commit hook + CI gate for compliance drift

Browse Source 
Wire pnpm compliance:emit-all into the pre-commit hook (conditional on
staged Payload configs, library traces, or compliance/ files) and add a
hard-fail compliance drift check step to the CI validate job positioned
after pnpm conformance.

Also fix emit-all.mjs: it previously hardcoded --check on every invocation,
so it never actually regenerated artifacts. Now the default mode writes and
--check mode diffs only — matching the pre-commit (write) vs CI (check) split.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Danijel Martinek
2026-05-18 20:14:45 +00:00
parent add54f14ef
commit 239cfcadfa
3 changed files with 41 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
scripts/compliance/emit-all.mjs
View File

@@ -2,12 +2,15 @@
/**
* emit-all.mjs — Compliance artifact orchestrator.
*
* Runs all three compliance emitters in --check mode and exits non-zero
* if any generator reports a mismatch or validation failure.
* Default: regenerates all three compliance artifacts (write mode).
* --check: diffs each artifact against the committed file; exits non-zero
* if any generator reports a mismatch or validation failure.
*
* Usage:
* node scripts/compliance/emit-all.mjs
* node scripts/compliance/emit-all.mjs # regenerate all artifacts
* node scripts/compliance/emit-all.mjs --check # drift check (CI gate)
* pnpm compliance:emit-all
* pnpm compliance:emit-all --check
*/
import { spawnSync } from "node:child_process";
@@ -22,11 +25,14 @@ const SCRIPTS = [
"emit-sub-processors.mjs",
];
const checkMode = process.argv.includes("--check");
const subArgs = checkMode ? ["--check"] : [];
let anyFailed = false;
for (const script of SCRIPTS) {
const scriptPath = path.join(__dirname, script);
const result = spawnSync(process.execPath, [scriptPath, "--check"], {
const result = spawnSync(process.execPath, [scriptPath, ...subArgs], {
stdio: "inherit",
});
@@ -36,14 +42,21 @@ for (const script of SCRIPTS) {
}
if (anyFailed) {
process.stderr.write(
"\n✗ compliance:emit-all — one or more artifacts are out of date.\n" +
" Run each generator to regenerate:\n" +
" pnpm compliance:data-map\n" +
" pnpm compliance:retention-policy\n" +
" pnpm compliance:sub-processors\n",
);
if (checkMode) {
process.stderr.write(
"\n✗ compliance:emit-all — one or more artifacts are out of date.\n" +
" Run `pnpm compliance:emit-all` to regenerate.\n",
);
} else {
process.stderr.write(
"\n✗ compliance:emit-all — one or more artifacts failed to generate.\n",
);
}
process.exit(1);
}
console.log("✓ compliance:emit-all — all artifacts are up to date");
if (checkMode) {
console.log("✓ compliance:emit-all — all artifacts are up to date");
} else {
console.log("✓ compliance:emit-all — all artifacts regenerated");
}