chore: catch lint failures before push (misspell + scoped golangci-lint)

[momosh-ssv]

Why

Most PRs lately have hit a red lint check that only surfaces in CI, since nothing in the repo installs a local check. Two flavors so far:

• misspell findings (.golangci.yaml, locale: US) — usually British spellings in comments (cancelled, behaviour, ...).
• staticcheck-class findings — e.g. boole-convergence polish: gating docs, startup fork validation, spectest bound (#2968 items 4, 6, 7) #2973 lost a CI round to a single QF1008 (embedded-field selector) in a test helper.

What

scripts/git-hooks/pre-push runs two stages against what a push actually introduces or modifies (diffed against the remote ref, or the merge-base with stage/main for new branches):

1. misspell — checks the changed .go/.md blobs at the pushed commit with the standalone misspell binary, and blocks the push with the same file:line:col output CI would produce. It scans the blobs, not the working tree, so uncommitted edits can't mask findings. Plain text scanning — near-instant.
2. golangci-lint, scoped — runs the repo's golangci-lint (same config make lint uses in CI, staticcheck included) on just the packages containing changed .go files. Type-checking linters need full packages on disk, so this stage lints the checkout and only runs when the pushed ref is the checked-out HEAD; nested modules (ssvsigner/, scripts/differ/) are skipped since CI's root-module run doesn't cover them either. ~1.5s warm on a one-package change, vs CI's ~7-minute full-repo run.

Also:

• make install-hooks — opt-in, points core.hooksPath at scripts/git-hooks (relative, so it resolves per-worktree).
• tool.mod — promotes github.com/golangci/misspell/cmd/misspell to a tool directive, pinned at the v0.7.0 already in the graph via golangci-lint (one-line diff, no version changes; tool.sum untouched). Using golangci's fork keeps the hook's word list identical to CI's. golangci-lint itself was already a tool directive.

git push --no-verify bypasses the whole hook for a one-off.

Verified

• Hook passes a clean range and flags a known-bad historical commit with the exact findings CI reported on it.
• golangci stage: a probe commit with a misspelling + S1002 bool-comparison + unused func fails both stages with CI-identical output (~6s cold-cache, ~1.5s warm); a clean comment-only probe on the same package passes in ~1.5s.
• make install-hooks sets and resolves the hooks path correctly across worktrees.

[greptile-apps]

Greptile Summary

The PR adds an opt-in pre-push misspell check, a Make target to install repository hooks, and a pinned Go tool declaration for the standalone linter.

• Installs scripts/git-hooks through core.hooksPath.
• Diffs pushed commits and scans changed Go and Markdown blobs.
• Adds github.com/golangci/misspell/cmd/misspell to tool.mod.

Confidence Score: 4/5

The PR appears safe to merge, with non-blocking hook reliability and diagnostic issues worth addressing.

The hook can silently omit linting in some remote layouts, mislabel tool failures as spelling findings, and mishandle unusual filenames, but these concerns affect the optional local check rather than production behavior.

Files Needing Attention: scripts/git-hooks/pre-push

Important Files Changed

Filename	Overview
scripts/git-hooks/pre-push	Adds the committed-blob misspell hook, with non-blocking robustness issues around base discovery, tool-error classification, and pathname handling.
Makefile	Adds a straightforward opt-in target that configures the repository-relative hooks path.
tool.mod	Promotes the already-pinned golangci misspell command to a Go tool without changing dependency versions.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    Push[git push] --> Ref{Existing remote ref?}
    Ref -->|Yes| Remote[Use remote SHA as base]
    Ref -->|No| Merge[Find merge-base with origin/stage or origin/main]
    Merge -->|Neither available| Skip[Silently skip ref]
    Remote --> Diff[Collect changed Go and Markdown paths]
    Merge --> Diff
    Diff --> Blob[Read each blob at local SHA]
    Blob --> Tool[Run misspell through go tool]
    Tool -->|Any output| Block[Label as misspell issue and block]
    Tool -->|No output| Allow[Allow push]

Loading

_{Reviews (1): Last reviewed commit: "chore: add versioned pre-push hook runni..." | Re-trigger Greptile}

[greptile-apps]

Hardcoded base refs skip linting

If a contributor's checkout lacks local origin/stage and origin/main refs, both merge-base commands fail and the silent continue permits the new branch push without running misspell, defeating the hook's purpose of surfacing failures before CI.

[momosh-ssv]

Fixed in 231d6b7.

[greptile-apps]

Tool errors resemble spelling findings

When go tool cannot resolve or execute misspell, its stderr is captured in out and labeled as a spelling issue, blocking the push with instructions to amend code instead of reporting the actual local tool failure.

[momosh-ssv]

Fixed in f43e970.

[greptile-apps]

Unquoted path list loses filenames

For a pushed Go or Markdown path containing whitespace or shell glob characters, for f in $files applies field splitting and pathname expansion, so the hook reads nonexistent or unintended blobs and can omit spelling findings from the actual changed file.

[momosh-ssv]

Fixed in 064d3f3.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.2%. Comparing base (48d4f3a) to head (c29d588).
⚠️ Report is 17 commits behind head on stage.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.