The pre-push hook hangs every git push: sync's push re-triggers the hook that called it

[MongLong0214]

Regression in #418, on dev only. main is unaffected — v0.6.0 predates the hook.

What happens

The pre-push hook runs commitlore sync, and sync publishes with git push. A git push inside a pre-push hook fires pre-push again, which syncs again, which pushes again.

Measured with an instrumented hook:

40 seconds, 1,240 hook invocations, never returned

Any user who installs this and runs git push hangs.

Why the existing tests did not catch it

test/sync.test.ts has eleven cases and calls syncNotes directly in every one of them. The recursion is not a property of the function — it only exists when git invokes the hook. A hook was shipped and never exercised through a hook.

Fix

git push --no-verify in syncRemote.

It belongs in sync rather than in the hook: the recursion is a property of this push, not of the caller, and nothing is served by a notes push running a hook whose only job is to push notes.

What the regression test has to be

Against a real git push, not a function, with a deadline — the defect is a hang, so a test that waits for it forever fails the suite instead of the assertion. Four cases: it does not recurse, it publishes the mirror, a repository with nothing to publish still pushes cleanly, and a failing sync does not fail the push (the contract that outranks publishing).

Adjacent, filed separately

Setting up the test surfaced that COMMITLORE_BIN is exec'd directly by the stub, so a non-executable .js — dist/cli.js is exactly that — makes the hook die with 126 and take the git operation with it. The recorded-path branch does not have this shape: it runs exec "$recorded_node" "$recorded" and checks the interpreter is executable first.

[MongLong0214]

Fixed by #423, merged to dev. Never reached main.

git push --no-verify in syncRemote. On the push rather than in the hook: the recursion is a property of that push, not of its caller, and an environment-variable guard in the hook would be something a second caller could forget.

With the flag, the same push fires the hook once, exits 0, and the mirror reaches the remote.

The lesson is in the record's Warn:: a hook cannot be called tested until a test invokes it the way git does. test/sync.test.ts had eleven passing cases against syncNotes and none of them could have found this, because the recursion does not exist in a function call.

test/pre-push-hook.test.ts drives a real git push with a 30-second deadline — a test that waits for a hang forever fails the suite instead of the assertion. Re-run without the flag it reports:

× does not recurse: the push completes  31136ms
  → the push never returned — the hook re-entered itself

The COMMITLORE_BIN observation in the issue body is not fixed here and is worth its own ticket.