build: add a pre-commit hook and a direnv shell

.envrc

@@ -0,0 +1,2 @@
+watch_file Scripts/dev-tools.env
+use flake

.githooks/pre-commit

@@ -0,0 +1,35 @@
+#!/bin/sh
+set -u
+
+root="$(git rev-parse --show-toplevel)"
+tools="$root/.cache/flake-tools/bin"
+status=0
+swift="$(git diff --cached --name-only --diff-filter=ACMR -- '*.swift')"
+
+if [ -n "$swift" ]; then
+  if [ -x "$tools/swiftformat" ] && [ -x "$tools/swiftlint" ]; then
+    snapshot="$(mktemp -d)"
+    trap 'rm -rf "$snapshot"' EXIT
+    printf '%s\n' "$swift" .swiftformat .swiftlint.yml .swift-version | git checkout-index --prefix="$snapshot/" --stdin
+    sources="$(printf '%s\n' "$swift" | grep '^Sources/' || true)"
+    (
+      cd "$snapshot" || exit 1
+      printf '%s\n' "$swift" | tr '\n' '\0' | xargs -0 "$tools/swiftformat" --lint --quiet || exit 1
+      if [ -n "$sources" ]; then
+        printf '%s\n' "$sources" | tr '\n' '\0' | xargs -0 "$tools/swiftlint" lint --quiet --force-exclude || exit 1
+      fi
+    ) || status=1
+  else
+    echo "pre-commit: skipping SwiftFormat and SwiftLint, run make setup-tools to enable them" >&2
+  fi
+fi
+
+if ! git diff --cached --quiet -- Scripts/dev-tools.env; then
+  pins="$(mktemp)"
+  git show :Scripts/dev-tools.env > "$pins"
+  python3 "$root/Scripts/check-pinned-downloads.py" "$pins" ||
+    echo "pre-commit: warning, ci and make setup will fail until the pinned download above is public" >&2
+  rm -f "$pins"
+fi
+
+exit "$status"

.github/workflows/ci.yml

@@ -52,6 +52,8 @@ jobs:
         with:
           ref: ${{ inputs.pr_number != '' && format('refs/pull/{0}/merge', inputs.pr_number) || github.ref }}
           persist-credentials: false
+      - name: Check pinned downloads
+        run: make check-pins
       - uses: ./.github/actions/setup-lix
         with:
           make-target: setup-tools

.gitignore

@@ -1,5 +1,6 @@
 # Build artifacts
 .build/
+.direnv/
 __pycache__/
 
 # SwiftPM

CONTRIBUTING.md

@@ -43,7 +43,7 @@ The result must report the Swift 6.5 development snapshot named in `.swift-versi
 make setup
 ```
 
-Setup needs [Lix](https://lix.systems/install/) (or another Nix with flakes). It builds the repository's `flake.nix`: the pinned, prebuilt GhosttyKit is linked at `Frameworks/GhosttyKit.xcframework` and checked against its checksum, and the pinned SwiftFormat, SwiftLint, Python, Fish and Nushell are linked at `.cache/flake-tools`. **You do not need to compile GhosttyKit**, and no Homebrew installation is required. `nix develop` opens a shell with the same tools on `PATH`.
+Setup needs [Lix](https://lix.systems/install/) (or another Nix with flakes). It builds the repository's `flake.nix`: the pinned, prebuilt GhosttyKit is linked at `Frameworks/GhosttyKit.xcframework` and checked against its checksum, and the pinned SwiftFormat, SwiftLint, Python, Fish and Nushell are linked at `.cache/flake-tools`. **You do not need to compile GhosttyKit**, and no Homebrew installation is required. `nix develop` opens a shell with the same tools on `PATH`. With [direnv](https://direnv.net), `direnv allow` loads that shell whenever you enter the checkout.
 
 Tool versions and download checksums are recorded in [Scripts/dev-tools.env](Scripts/dev-tools.env), which the flake reads; other packages are pinned by `flake.lock`. Ghostty's internal archive pin remains in [Scripts/build-metadata.env](Scripts/build-metadata.env). Setup preserves an existing framework that does not match the pin and explains the mismatch instead of overwriting it. Setup does not launch OmniWM or change privacy permissions, login items, or CLI links.
 
@@ -84,6 +84,7 @@ Commit your change, push your branch to your fork, and open a pull request targe
 | --- | --- |
 | `make setup` | Check prerequisites and obtain the pinned dependencies. |
 | `make doctor` | Diagnose tools, dependencies, signing, and app paths without changing them. |
+| `make hooks` | Enable the pre-commit hook: SwiftFormat and SwiftLint on staged Swift files, and a warning when a pinned download in `Scripts/dev-tools.env` is not public yet. |
 | `make build` | Build the app without installing or launching it. |
 | `make run` | Build, sign, install, and switch to Dev; alias for `make dev-install`. |
 | `make use-dev` | Switch to the installed Dev app without rebuilding. |

Makefile

@@ -1,4 +1,4 @@
-.PHONY: setup setup-tools doctor format format-check lint lint-fix build localization-check localization-sync run dev-install use-dev use-release test-dev-tools energy-profile arc-audit test-skylight-live release-check verify check check-tool-versions check-swiftformat-version check-swiftlint-version
+.PHONY: setup setup-tools doctor format format-check lint lint-fix build localization-check localization-sync run dev-install use-dev use-release test-dev-tools energy-profile arc-audit test-skylight-live release-check verify check check-tool-versions check-swiftformat-version check-swiftlint-version check-pins hooks
 
 include Scripts/dev-tools.env
 
@@ -23,6 +23,12 @@ setup-tools:
 doctor:
 	./Scripts/doctor.sh
 
+check-pins:
+	python3 Scripts/check-pinned-downloads.py
+
+hooks:
+	git config core.hooksPath .githooks
+
 check-swiftformat-version:
 	@actual="$$("$(SWIFTFORMAT)" --version 2>/dev/null || true)"; if [ "$$actual" != "$(SWIFTFORMAT_VERSION)" ]; then echo "error: SwiftFormat $(SWIFTFORMAT_VERSION) required; found $${actual:-missing}" >&2; exit 1; fi
 

Scripts/check-pinned-downloads.py

@@ -0,0 +1,50 @@
+"""Check that every *_URL pinned in Scripts/dev-tools.env is downloadable.
+
+The flake fetches these URLs during make setup and in every CI job. A pin
+that points at a release asset before the release is published breaks both.
+"""
+
+import re
+import sys
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def pinned_urls(path):
+    urls = {}
+    for line in path.read_text(encoding="utf-8").splitlines():
+        key, separator, value = line.partition("=")
+        if separator and re.fullmatch(r"[A-Z0-9_]+_URL", key):
+            urls[key] = value
+    return urls
+
+
+def unreachable(url, timeout=30):
+    try:
+        request = urllib.request.Request(url, method="HEAD")
+        with urllib.request.urlopen(request, timeout=timeout):
+            return None
+    except urllib.error.HTTPError as error:
+        return f"HTTP {error.code}"
+    except (urllib.error.URLError, OSError, ValueError) as error:
+        return str(getattr(error, "reason", error))
+
+
+def main(argv):
+    path = Path(argv[1]) if len(argv) > 1 else ROOT / "Scripts/dev-tools.env"
+    failures = 0
+    for key, url in pinned_urls(path).items():
+        reason = unreachable(url)
+        if reason:
+            failures += 1
+            print(f"{path.name}: {key} is not downloadable ({reason}): {url}", file=sys.stderr)
+    if failures:
+        print("publish the asset or keep the previous pin until it is public", file=sys.stderr)
+    return 1 if failures else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))

Tests/DevToolingTests/test_check_pinned_downloads.py

@@ -0,0 +1,62 @@
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import threading
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[2]
+SCRIPT = ROOT / "Scripts/check-pinned-downloads.py"
+
+
+class Handler(BaseHTTPRequestHandler):
+    def do_HEAD(self):
+        self.send_response(200 if self.path == "/published.zip" else 404)
+        self.end_headers()
+
+    def log_message(self, format, *args):
+        pass
+
+
+class CheckPinnedDownloadsTests(unittest.TestCase):
+    def setUp(self):
+        self.server = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
+        threading.Thread(target=self.server.serve_forever, daemon=True).start()
+        self.addCleanup(self.server.server_close)
+        self.addCleanup(self.server.shutdown)
+        self.base = f"http://127.0.0.1:{self.server.server_port}"
+
+    def run_check(self, pins):
+        with tempfile.TemporaryDirectory() as raw:
+            path = Path(raw) / "dev-tools.env"
+            path.write_text(pins)
+            return subprocess.run(
+                [sys.executable, SCRIPT, path], capture_output=True, text=True, check=False
+            )
+
+    def test_published_pins_pass(self):
+        result = self.run_check(
+            "SWIFTLINT_VERSION=0.65.1\n"
+            f"OMNIWM_GHOSTTY_DOWNLOAD_URL={self.base}/published.zip\n"
+            f"# OMNIWM_GHOSTTY_DOWNLOAD_URL={self.base}/v0.0.0/retired.zip\n"
+        )
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stderr, "")
+
+    def test_unpublished_pin_fails_and_names_the_key(self):
+        result = self.run_check(
+            f"OMNIWM_GHOSTTY_DOWNLOAD_URL={self.base}/published.zip\n"
+            "OMNIWM_MALFORMED_DOWNLOAD_URL=github.com/missing-scheme.zip\n"
+            f"OMNIWM_OTHER_DOWNLOAD_URL={self.base}/v9.9.9/missing.zip\n"
+        )
+        self.assertEqual(result.returncode, 1)
+        self.assertNotIn("Traceback", result.stderr)
+        self.assertIn("OMNIWM_MALFORMED_DOWNLOAD_URL is not downloadable (unknown url type", result.stderr)
+        self.assertIn("OMNIWM_OTHER_DOWNLOAD_URL is not downloadable (HTTP 404)", result.stderr)
+        self.assertNotIn("OMNIWM_GHOSTTY_DOWNLOAD_URL", result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()

Tests/DevToolingTests/test_pre_commit_hook.py

@@ -0,0 +1,94 @@
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+import threading
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[2]
+TOOLS = ROOT / ".cache/flake-tools"
+GOOD_SWIFT = (ROOT / "Sources/OmniWMIPC/IPCSocketPath.swift").read_text()
+
+
+class MissingAsset(BaseHTTPRequestHandler):
+    def do_HEAD(self):
+        self.send_response(404)
+        self.end_headers()
+
+    def log_message(self, format, *args):
+        pass
+
+
+class PreCommitHookTests(unittest.TestCase):
+    def make_repo(self):
+        raw = tempfile.TemporaryDirectory()
+        self.addCleanup(raw.cleanup)
+        repo = Path(raw.name)
+        (repo / "Scripts").mkdir()
+        shutil.copy2(ROOT / "Scripts/check-pinned-downloads.py", repo / "Scripts")
+        shutil.copytree(ROOT / ".githooks", repo / ".githooks")
+        for name in (".swiftformat", ".swiftlint.yml", ".swift-version"):
+            shutil.copy2(ROOT / name, repo / name)
+        if TOOLS.exists():
+            (repo / ".cache").mkdir()
+            (repo / ".cache/flake-tools").symlink_to(TOOLS.resolve())
+        env = {**os.environ, "GIT_CONFIG_GLOBAL": os.devnull, "GIT_CONFIG_NOSYSTEM": "1"}
+
+        def git(*args):
+            return subprocess.run(["git", *args], cwd=repo, env=env, capture_output=True, text=True, check=False)
+
+        git("init", "-q")
+        git("config", "core.hooksPath", ".githooks")
+        git("add", ".swiftformat", ".swiftlint.yml", ".swift-version")
+        return repo, git
+
+    def commit(self, git):
+        return git("-c", "user.name=t", "-c", "user.email=t@t", "commit", "-q", "-m", "change")
+
+    def test_unpublished_pin_warns_without_blocking_the_commit(self):
+        server = ThreadingHTTPServer(("127.0.0.1", 0), MissingAsset)
+        threading.Thread(target=server.serve_forever, daemon=True).start()
+        self.addCleanup(server.server_close)
+        self.addCleanup(server.shutdown)
+        repo, git = self.make_repo()
+        url = f"http://127.0.0.1:{server.server_port}/v9.9.9/GhosttyKit.zip"
+        (repo / "Scripts/dev-tools.env").write_text(f"OMNIWM_GHOSTTY_DOWNLOAD_URL={url}\n")
+        git("add", "Scripts/dev-tools.env")
+
+        result = self.commit(git)
+
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("OMNIWM_GHOSTTY_DOWNLOAD_URL is not downloadable (HTTP 404)", result.stderr)
+        self.assertIn("pre-commit: warning", result.stderr)
+        self.assertEqual(git("rev-list", "--count", "HEAD").stdout.strip(), "1")
+
+    @unittest.skipUnless((TOOLS / "bin/swiftformat").exists(), "needs make setup-tools")
+    def test_swift_checks_read_the_staged_content(self):
+        repo, git = self.make_repo()
+        (repo / "Sources").mkdir()
+        source = repo / "Sources/Socket.swift"
+        source.write_text(GOOD_SWIFT.replace("    public static", "  public   static", 1))
+        git("add", "Sources/Socket.swift")
+        source.write_text(GOOD_SWIFT)
+
+        result = self.commit(git)
+
+        self.assertNotEqual(result.returncode, 0)
+        self.assertNotEqual(git("rev-parse", "--verify", "-q", "HEAD").returncode, 0)
+
+    @unittest.skipUnless((TOOLS / "bin/swiftlint").exists(), "needs make setup-tools")
+    def test_swiftlint_only_checks_the_sources_make_lint_covers(self):
+        repo, git = self.make_repo()
+        shutil.copy2(ROOT / "Package.swift", repo / "Package.swift")
+        git("add", "Package.swift")
+
+        result = self.commit(git)
+
+        self.assertEqual(result.returncode, 0, result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()