vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ops-log): record who committed, by althing handle

Browse Source 
Two agents share ONE checkout of this repo on nh3-dev, and every commit here
is attributed to Vuong Hoang by convention -- so a commit's author line says
nothing about which agent made it. The ops log closed that gap for HOST
changes; it did not cover commits to the shared tree.

Found the hard way today: e43e262 appeared interleaved between two of this
session's commits, in this session's own reflog, and was unattributable from
git, from the ops log AND from the althing bus. It was sitting in the push set
at the time, and forseti had explicitly asked that unrelated management-repo
commits not be pushed -- so the one thing needed to honour that request was
the one thing nothing recorded.

The hook APPENDS to .git/hooks/post-commit rather than replacing it, because
graphify already owns that file and core.hooksPath would disable it.
Best-effort by construction: a failure here must never fail a commit.
This commit is contained in:
Vuong Hoang
2026-09-19 06:55:28 -07:00
parent 3e7d3a3e3d
commit 0dc8e9096e
2 changed files with 48 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/git-hooks/install.sh
Executable
+16
View File
@@ -0,0 +1,16 @@
#!/usr/bin/env bash
# Chain the ops-log attribution hook onto .git/hooks/post-commit.
#
# APPENDS rather than replaces: graphify already owns that file, and
# core.hooksPath would disable it. Idempotent — safe to re-run.
set -euo pipefail
REPO="$(git rev-parse --show-toplevel)"
HOOK="$REPO/.git/hooks/post-commit"
if [ ! -f "$HOOK" ]; then
printf '#!/bin/sh\n' > "$HOOK"; chmod +x "$HOOK"
fi
if grep -q "post-commit-ops-log" "$HOOK"; then
echo "already installed"; exit 0
fi
printf '\n# ops-log attribution hook (scripts/git-hooks/post-commit-ops-log)\n"$(git rev-parse --show-toplevel)/scripts/git-hooks/post-commit-ops-log" || true\n' >> "$HOOK"
echo "installed — commits now record their althing handle to the ops log"
scripts/git-hooks/post-commit-ops-log
Executable
+32
View File
@@ -0,0 +1,32 @@
#!/bin/sh
# post-commit-ops-log — record who committed, by althing handle.
#
# WHY. Two agents (infra-ops and infra-hermes) share ONE checkout of this repo
# on nh3-dev, and every commit here is attributed to Vuong Hoang by convention.
# So a commit's author line says nothing about which agent made it. The ops log
# closed this for HOST changes; it did not cover commits to the shared tree.
#
# Found the hard way on 2026-09-19: commit e43e262 appeared interleaved between
# two of this session's commits, in this session's own reflog, and was
# unattributable from git, from the ops log AND from the althing bus. It was
# sitting in the push set at the time.
#
# Appended to .git/hooks/post-commit, which already carries the graphify hook.
# Best-effort by construction: a failure here must never fail a commit.
[ "${OPS_LOG_SKIP_HOOK:-0}" = "1" ] && exit 0
REPO=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0
[ -x "$REPO/scripts/ops-log" ] || exit 0
SUBJECT=$(git log -1 --format=%s 2>/dev/null)
SHA=$(git log -1 --format=%h 2>/dev/null)
FILES=$(git diff --name-only HEAD~1 HEAD 2>/dev/null | wc -l)
"$REPO/scripts/ops-log" record \
--host "$(hostname)" \
--action commit \
--target "$(basename "$REPO")" \
--outcome changed \
--detail "$SHA ($FILES files): $SUBJECT" \
-q >/dev/null 2>&1 || true
exit 0