#!/bin/sh
# Refuse a commit carrying something that should not be published.
#
# Activate once per clone:   git config core.hooksPath .githooks
#
# Versioned deliberately. A hook that lives only in .git/hooks exists on one
# machine, is invisible in review, and is absent from every fresh clone -- which
# for a repository authored in public means the safety check is missing exactly
# when a new contributor needs it most.
#
# The companion commit-msg hook runs the SAME vocabulary over the message, which
# is the one published surface that cannot be corrected after a push.
#
# To commit past it knowingly:   git commit --no-verify
set -e
ROOT="$(git rev-parse --show-toplevel)"

# FIRST, because it decides whether anything below it can speak for this commit.
# The checks here read the WORKING TREE and the commit records the INDEX; when
# those differ, a green hook is green about files that are not being committed.
python3 "$ROOT/tools/hygiene_check.py" --staged-is-what-ships

exec python3 "$ROOT/tools/hygiene_check.py"
