1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
|
#!/usr/bin/env bash
# Case 01: 'git status' inside an .hg repository must be blocked.
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
mkdir -p "$tmp/repo/.hg"
mkdir -p "$tmp/repo/sub"
input=$(jq -n --arg cwd "$tmp/repo/sub" --arg cmd "git status" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
# Run hook; capture stderr and exit code.
err=$(echo "$input" | "$HOOK_SCRIPT" 2>&1 >/dev/null)
rc=$?
if [[ $rc -ne 2 ]]; then
echo "expected exit 2 (blocked), got $rc"
echo "stderr was: $err"
exit 1
fi
if ! grep -q "hg status" <<<"$err"; then
echo "expected stderr to suggest 'hg status', got: $err"
exit 1
fi
#!/usr/bin/env bash
# Case 02: 'git --version' outside any .hg/.git context must be allowed.
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
input=$(jq -n --arg cwd "$tmp" --arg cmd "git --version" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
echo "expected exit 0 (allow), got non-zero"
exit 1
fi
#!/usr/bin/env bash
# Case 03: closer .git wins over outer .hg, AND bare git repos
# (HEAD/refs/objects in cwd, no .git subdir) inside an .hg ancestor allow.
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
# Sub-case A: regular .git nested under .hg
mkdir -p "$tmp/outer/.hg"
mkdir -p "$tmp/outer/inner/.git"
input=$(jq -n --arg cwd "$tmp/outer/inner" --arg cmd "git log" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
echo "sub-case A (nested .git) expected exit 0, got non-zero"
exit 1
fi
# Sub-case B: bare git repo (no .git subdir) inside .hg ancestor
mkdir -p "$tmp/outer/testdata/repo.git/refs"
mkdir -p "$tmp/outer/testdata/repo.git/objects"
touch "$tmp/outer/testdata/repo.git/HEAD"
input=$(jq -n --arg cwd "$tmp/outer/testdata/repo.git" --arg cmd "git log" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
echo "sub-case B (bare repo) expected exit 0, got non-zero"
exit 1
fi
#!/usr/bin/env bash
# Case 04: 'hg status' inside an .hg repo must be allowed (only git is blocked).
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
mkdir -p "$tmp/repo/.hg"
input=$(jq -n --arg cwd "$tmp/repo" --arg cmd "hg status" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
echo "expected exit 0 (allow), got non-zero"
exit 1
fi
#!/usr/bin/env bash
# Case 05: 'FOO=bar git status' inside an .hg repo must be blocked
# (env-var prefix correctly skipped to find the real leading command).
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
mkdir -p "$tmp/repo/.hg"
input=$(jq -n --arg cwd "$tmp/repo" --arg cmd "FOO=bar GIT_PAGER=cat git status" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
err=$(echo "$input" | "$HOOK_SCRIPT" 2>&1 >/dev/null)
rc=$?
if [[ $rc -ne 2 ]]; then
echo "expected exit 2 (blocked), got $rc"
echo "stderr: $err"
exit 1
fi
#!/usr/bin/env bash
# Case 06: 'ls -la' inside an .hg repo must be allowed (not a git command).
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
mkdir -p "$tmp/repo/.hg"
input=$(jq -n --arg cwd "$tmp/repo" --arg cmd "ls -la" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
echo "expected exit 0 (allow), got non-zero"
exit 1
fi
#!/usr/bin/env bash
# Case 07: 'cd /tmp && git init' inside an .hg repo must be allowed
# (only the leading token is inspected — this is the documented escape valve).
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
mkdir -p "$tmp/repo/.hg"
input=$(jq -n --arg cwd "$tmp/repo" --arg cmd "cd /tmp && git init" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
echo "expected exit 0 (allow), got non-zero"
exit 1
fi
#!/usr/bin/env bash
# Runs all hook test cases. Each case is a self-contained shell script
# that exits 0 on PASS, non-zero on FAIL.
#
# Cases live in hooks/test/cases/*.sh, are run alphabetically, and
# can use the helper functions/env defined here.
set -u
# Resolve repo root regardless of where this is invoked from.
script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
repo_root=$(cd "$script_dir/../.." && pwd)
HOOK_SCRIPT="$repo_root/hooks/block-git-in-hg.sh"
export HOOK_SCRIPT
if [[ ! -x "$HOOK_SCRIPT" ]]; then
echo "FATAL: hook script not found or not executable: $HOOK_SCRIPT"
exit 2
fi
passed=0
failed=0
failed_cases=()
shopt -s nullglob
for case_file in "$script_dir"/cases/*.sh; do
case_name=$(basename "$case_file" .sh)
if bash "$case_file" >/tmp/hook_test_out.$$ 2>&1; then
echo "PASS $case_name"
passed=$((passed + 1))
else
echo "FAIL $case_name"
sed 's/^/ | /' /tmp/hook_test_out.$$
failed=$((failed + 1))
failed_cases+=("$case_name")
fi
rm -f /tmp/hook_test_out.$$
done
echo
echo "Result: $passed passed, $failed failed"
if (( failed > 0 )); then
printf ' failed: %s\n' "${failed_cases[@]}"
exit 1
fi
exit 0
|