From f2a5fb87afd8bfe34fd3d61045f8ee8677590031 Mon Sep 17 00:00:00 2001
From: Astrid Gealer <astrid@gealer.email>
Date: Mon, 26 Oct 2026 20:28:32 +0000
Subject: [PATCH] chore(ci): keep the pre-commit go vet and go test hooks out
 of node_modules

The go-vet and go-test hooks ran `go vet ./...` and `go test -short
-race ./...`. Go's ./... skips only vendor, testdata and `.`/`_`
directories, so once `npm ci` has run (pre-commit.yml runs it before the
hooks) it also matches Go source shipped inside npm packages, such as
frontend/node_modules/flatted/golang/pkg/flatted. Those packages have no
go.mod of their own, so they are absorbed into this module and the hooks
gate on third-party code.

Both hooks now build the package list with `go list -e ./...` and drop
/node_modules/ paths. -e keeps a broken node_modules package from
failing the listing; pipefail fails the hook if `go list` itself fails
instead of running on an empty list. The first-party package set is
unchanged.

#1286 covered the gocyclo walk in ci.yml and the Makefile. This covers
the pre-commit Go hooks named in the audit finding.

Refs #177

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .pre-commit-config.yaml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index fa1272951..219f95229 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -20,11 +20,19 @@ repos:
         require_serial: true
         files: '(\.go$|(^|/)go\.(mod|sum)$)'
 
+  # The Go hooks (go-vet here, go-test below) list packages with `go list`
+  # and drop node_modules instead of passing ./... (issue #177). Go's ./...
+  # skips only vendor, testdata and `.`/`_` directories, so after `npm ci`
+  # (pre-commit.yml runs it before this hook) it also matches Go source that
+  # npm packages ship, such as frontend/node_modules/flatted/golang, and the
+  # hooks would gate on code this repo does not own. -e lists a broken
+  # node_modules package instead of failing on it; pipefail makes a failing
+  # `go list` fail the hook rather than run on an empty package list.
   - repo: local
     hooks:
       - id: go-vet
         name: Run go vet
-        entry: bash -c 'go vet ./...'
+        entry: bash -c 'set -euo pipefail; pkgs=$(go list -e ./... | grep -v "/node_modules/"); go vet $pkgs'
         language: system
         pass_filenames: false
         files: \.go$
@@ -259,7 +267,8 @@ repos:
     hooks:
       - id: go-test
         name: Run Go tests (pre-push only; CI covers via ci.yml)
-        entry: bash -c 'go test -short -race ./...'
+        # Same node_modules exclusion as the go-vet hook (issue #177).
+        entry: bash -c 'set -euo pipefail; pkgs=$(go list -e ./... | grep -v "/node_modules/"); go test -short -race $pkgs'
         language: system
         pass_filenames: false
         files: \.go$