test(trace): add golden files for the generated git hook scripts

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Chainloop-Trace-Sessions: a5941a7b-7e2e-46b4-b95d-cd9fadb00b3b

Author: migmartri

app/cli/internal/trace/hooks/hooks_test.go

@@ -20,6 +20,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -219,6 +220,58 @@ func TestInstallRefusesToClobberBackup(t *testing.T) {
 	assert.Equal(t, original, string(content))
 }
 
+// TestHookGoldenFiles compares the hook scripts Install writes against the
+// committed golden files in testdata/. The temporary hooks directory is
+// replaced by a placeholder so the files stay stable. Run with
+// UPDATE_GOLDEN=1 to regenerate them after an intentional change:
+//
+//	UPDATE_GOLDEN=1 go test ./app/cli/internal/trace/hooks/ -run TestHookGoldenFiles
+func TestHookGoldenFiles(t *testing.T) {
+	const hooksDirPlaceholder = "<hooks-dir>"
+
+	testCases := []struct {
+		hook        string
+		foreignHook bool
+		golden      string
+	}{
+		{hook: "commit-msg", golden: "testdata/commit-msg.sh"},
+		{hook: "post-commit", golden: "testdata/post-commit.sh"},
+		{hook: "post-rewrite", golden: "testdata/post-rewrite.sh"},
+		{hook: "pre-push", golden: "testdata/pre-push.sh"},
+		{hook: "pre-push", foreignHook: true, golden: "testdata/pre-push-chained.sh"},
+		{hook: "post-commit", foreignHook: true, golden: "testdata/post-commit-chained.sh"},
+	}
+
+	for _, tc := range testCases {
+		t.Run(filepath.Base(tc.golden), func(t *testing.T) {
+			gitDir := t.TempDir()
+			hooksDir := filepath.Join(gitDir, "hooks")
+			require.NoError(t, os.MkdirAll(hooksDir, 0755))
+			if tc.foreignHook {
+				require.NoError(t, os.WriteFile(filepath.Join(hooksDir, tc.hook), []byte("#!/bin/sh\n"), 0600))
+			}
+
+			_, err := Install(gitDir, false)
+			require.NoError(t, err)
+
+			content, err := os.ReadFile(filepath.Join(hooksDir, tc.hook))
+			require.NoError(t, err)
+			generated := strings.ReplaceAll(string(content), hooksDir, hooksDirPlaceholder)
+
+			if os.Getenv("UPDATE_GOLDEN") == "1" {
+				//nolint:gosec // golden paths are fixed testdata paths from the table above
+				require.NoError(t, os.WriteFile(tc.golden, []byte(generated), 0600))
+				return
+			}
+
+			expected, err := os.ReadFile(tc.golden)
+			require.NoError(t, err, "golden file missing; run UPDATE_GOLDEN=1 to generate")
+			assert.Equal(t, string(expected), generated,
+				"generated hook does not match golden file %s; run UPDATE_GOLDEN=1 to update", tc.golden)
+		})
+	}
+}
+
 // TestHookScriptsExitStatus runs each generated hook against a fake chainloop
 // binary, or none at all (as in GUI git clients). Only pre-push propagates a
 // chainloop failure, so requireTrace can block the push; every other hook must

app/cli/internal/trace/hooks/testdata/commit-msg.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+# chainloop-trace-managed
+if command -v chainloop >/dev/null 2>&1; then
+	chainloop trace hook git commit-msg "$@"
+fi
+exit 0

app/cli/internal/trace/hooks/testdata/post-commit-chained.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+# chainloop-trace-managed
+if command -v chainloop >/dev/null 2>&1; then
+	chainloop trace hook git post-commit
+fi
+[ -x "<hooks-dir>/post-commit.chainloop-backup" ] && exec "<hooks-dir>/post-commit.chainloop-backup" "$@"
+exit 0

app/cli/internal/trace/hooks/testdata/post-commit.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+# chainloop-trace-managed
+if command -v chainloop >/dev/null 2>&1; then
+	chainloop trace hook git post-commit
+fi
+exit 0

app/cli/internal/trace/hooks/testdata/post-rewrite.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+# chainloop-trace-managed
+if command -v chainloop >/dev/null 2>&1; then
+	chainloop trace hook git post-rewrite
+fi
+exit 0

app/cli/internal/trace/hooks/testdata/pre-push-chained.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+# chainloop-trace-managed
+if command -v chainloop >/dev/null 2>&1; then
+	chainloop trace hook git pre-push || exit $?
+fi
+[ -x "<hooks-dir>/pre-push.chainloop-backup" ] && exec "<hooks-dir>/pre-push.chainloop-backup" "$@"
+exit 0

app/cli/internal/trace/hooks/testdata/pre-push.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+# chainloop-trace-managed
+if command -v chainloop >/dev/null 2>&1; then
+	chainloop trace hook git pre-push || exit $?
+fi
+exit 0