krz/domain-dig

 1#!/usr/bin/env bash
 2#
 3# Run the accessibility audit against the oldest supported simulator runtime
 4# before pushing.
 5#
 6# Enable once per clone:
 7#     git config core.hooksPath .githooks
 8#
 9# Why pre-push and not pre-commit: the suite takes ~85s. At pre-commit that
10# blocks every commit, and a hook you routinely bypass with --no-verify is worse
11# than no hook, because it trains you to ignore it. Pushes are far less frequent
12# and map to the unit of work that actually reaches CI.
13#
14# Why only the floor tier: CI already audits the newest runtime on a clean
15# checkout. The GitHub image has no old runtimes, so the floor is the one thing
16# CI structurally cannot cover — and it is the one this machine can. Running
17# both here would just double the wait to re-check what CI already does.
18#
19# Skip deliberately with: git push --no-verify
20
21set -euo pipefail
22
23repo_root=$(git rev-parse --show-toplevel)
24cd "$repo_root"
25
26zero='0000000000000000000000000000000000000000'
27changed=''
28
29# stdin: <local ref> <local sha> <remote ref> <remote sha>, one line per ref.
30while read -r _local_ref local_sha _remote_ref remote_sha; do
31  [ "$local_sha" = "$zero" ] && continue  # branch deletion
32
33  if [ "$remote_sha" = "$zero" ]; then
34    # New branch: diff against the default branch rather than the whole history.
35    base=$(git merge-base origin/main "$local_sha" 2>/dev/null || echo '')
36    range="${base:+$base..}$local_sha"
37  else
38    range="$remote_sha..$local_sha"
39  fi
40
41  changed="$changed$(git diff --name-only "$range" 2>/dev/null || true)"$'\n'
42done
43
44if [ -z "$(printf '%s' "$changed" | tr -d '[:space:]')" ]; then
45  exit 0
46fi
47
48# Only pay the ~85s when something could actually change the rendered UI.
49if ! printf '%s' "$changed" | grep -qE '\.(swift|xcassets|xcodeproj)|\.pbxproj|xcscheme'; then
50  echo "pre-push: no Swift/project changes, skipping accessibility audit"
51  exit 0
52fi
53
54echo "pre-push: running accessibility audit on the floor runtime (~85s)"
55echo "          skip with 'git push --no-verify'"
56
57if ! ./Scripts/audit-a11y.sh floor; then
58  echo
59  echo "pre-push: audit could not run. Push aborted." >&2
60  echo "          Re-run with './Scripts/audit-a11y.sh floor' to see why," >&2
61  echo "          or bypass with 'git push --no-verify'." >&2
62  exit 1
63fi
64
65# Note: findings are reported, not enforced, so a clean exit here does not mean
66# zero findings — read the list above. Enforcement is controlled by
67# AccessibilityAuditHarness.enforcedAuditTypes.
68exit 0