chore(release): v7.17.6 — hook exec bit, clean lockfile, schema docs - #20
Merged
Conversation
The trailer belongs to the tooling some contributors run, not to this repository, and it reached nine commits before anyone noticed. Discipline did not catch it, so a gate does now. - a regression test scans every authored commit and fails on the trailer, naming the offender rather than just going red; - the eight already-published commits are listed by full SHA, so nothing is grandfathered vaguely. That list is a ratchet: a separate assertion fails if it ever grows, because adding a SHA to excuse a new commit is the box-ticking this project refuses to accept from anyone else; - CLAUDE.md states the rule for automated contributors, alongside the other conventions learned the hard way — including verifying commit line lengths in a step of their own, since chaining the check to the commit means committing before reading the check; - CONTRIBUTING.md carries the same rule for humans. Proven red: a throwaway commit carrying the trailer failed the test with its own SHA in the output, then was removed.
test: fail the build on a Co-Authored-By trailer
chore: sync develop with the v7.17.5 release
`npm ci` installed minimatch 9.0.5, brace-expansion 2.0.2 and lodash 4.17.21 — three high-severity advisories between them (ReDoS, DoS by memory exhaustion, prototype pollution and code injection via `_.template`). Development and CI were therefore testing against vulnerable dependencies. Consumers were never exposed: our ranges are caret ranges, so a fresh install of the published package resolves the patched versions on its own — verified by installing ruleofcode@7.17.5 from the registry into an empty project, which audits clean. Only this repository's pinned lockfile was stale. package.json is untouched; the ranges already admitted the patched versions. `npm audit --omit=dev` now reports zero vulnerabilities.
Git Hook Compliance called every hook of every Windows project non-executable, and the consumer could not act on it. NTFS carries no POSIX execute bit: `fs.stat().mode` is 0o666 for every file there and `chmod` is a no-op, so `chmod +x` — the suggestion the law printed — changes nothing. It also judged files git never runs: husky keeps `.gitignore`, `husky.sh` and `h` in its hooks directory. The bit now comes from the git index (`100755` / `100644`), which answers the same question identically on every platform and only for files a consumer can commit a mode for. Untracked hooks are not judged at all: husky ignores its generated `_` directory wholesale, so no mode exists there for git or anyone else to set. The law was right about the defect underneath, and keeping that was the harder half. The committed layout is `.husky/<hook>`, not the resolved hooks directory, so the check reads both — otherwise removing the false positive would have removed the true one with it. Our own hooks were committed at 100644 and are fixed here; a Linux clone would not have executed them. Reported by a Windows consumer whose build it blocked, having stayed on the previous version. Proven red and green, on this repository and on a real git fixture.
A consumer rendering law cards from `laws --json` had to infer that
`stack: "frontend"` means "read satisfiedBy.angular". Nothing said so,
so they coded against an observation and reported the difference as an
inconsistency. It is not one — but the contract was undocumented, which
is our fault, not theirs.
`stack` answers selection: does this law run here at all. A
`satisfiedBy` key answers guidance: which technology the instructions
are written for. The two are orthogonal, and the registry proves it —
no key maps onto a single stack:
typescript 71 laws = 12 typescript-stack + 59 universal
python 70 laws = 37 python-stack + 33 universal
angular 67 laws = 58 frontend-stack + 3 typescript
+ 6 universal
`angular` sitting on TypeScript-stack and universal laws is the
clearest evidence that a key is not a stack label. Renaming it to
`frontend` would make the field lie: the advice really is
Angular-specific, and a React project matches `stack: "frontend"`.
The JSON already ships the mapping as `satisfiedByStacks.stackToKey`,
so the section points renderers at that field rather than a table to
copy — a key added later is then picked up rather than missed. It also
states the gap plainly: all 58 frontend laws carry only Angular
guidance, and a card should say so rather than present Angular steps as
universal (#12).
…t-index fix(laws): read the hook executable bit from the git index
…ckfile fix(deps): refresh the lockfile off three vulnerable transitive versions
docs: document the law card schema and its two axes
Bumps package.json and hooks/installer VERSION to 7.17.6 and regenerates the tracked .husky hooks. schemaVersion stays 2. Ships what is already on develop: - fix(laws): Git Hook Compliance called every hook of every Windows project non-executable — a violation `chmod +x` could not fix, since NTFS has no such bit. The mode now comes from the git index, which answers the same question on every platform, and only names git runs as hooks are judged. The real defect it was built to catch is kept: hooks committed at 100644 are not executable on a Linux clone. - fix(deps): the lockfile pinned three transitive versions with high-severity advisories, so CI tested against them. Consumers were never exposed — a fresh install of the published package resolves the patched versions. package.json is unchanged. - docs: the law card schema, and why `stack` and a `satisfiedBy` key are two axes rather than one vocabulary. Gate: eslint 0, jest full suite, canary green (py100/ng136/node78). Self-audit: exit 0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Releases three changes already on
develop.🔴 Git Hook Compliance no longer fails every Windows project
Closes #15. A Windows consumer stayed on 7.17.4 because this blocked their build.
The law called every hook non-executable and the consumer could not act on it: NTFS has no POSIX execute bit, so
chmod +x— the fix the law printed — changes nothing. It also judged files git never runs (.gitignore,husky.sh,h).The mode now comes from the git index, which answers the same question identically on every platform. The real defect it was built to catch is kept: hooks committed at
100644are not executable on a Linux clone — ours were, and are fixed. The suggestion is actionable now:git update-index --chmod=+x.🔒 Lockfile off three high-severity advisories
CI was testing against minimatch 9.0.5, brace-expansion 2.0.2 and lodash 4.17.21. Consumers were never exposed — the published package's caret ranges resolve the patched versions, verified against the registry tarball.
package.jsonunchanged.📄 Law card schema documented
stack(selection) and asatisfiedBykey (guidance) are two axes, not one vocabulary — no key maps onto a single stack. The README now says so and points renderers atsatisfiedByStacks.stackToKey, which the JSON already shipped undocumented.Verdict impact
Changes verdicts on Windows projects and on projects with committed hooks; no config default changes; schemaVersion stays 2.
Gate
npm run lint— 0 errorsnpx jest— 505 suites / 13871 tests, exit 0npm run canary— green (py100 / ng136 / node78), red proven rednode dist/cli.js audit— exit 0