#!/usr/bin/env bash
# commit-msg hook — refuse a release commit when the local PhASAR sibling is out
# of sync with the pin, so you can't cut a release (incrementMajor/Minor/Patch)
# that builds a different PhASAR than you validated.
#
# Installed by build-analyzer.sh on dev builds (and via `git config core.hooksPath`
# guard); only acts on commits whose message declares a release. Bypass with
# `git commit --no-verify` (do NOT for a real release).
set -uo pipefail
msg_file="$1"

grep -qiE 'increment(Major|Minor|Patch)' "$msg_file" 2>/dev/null || exit 0

root="$(git rev-parse --show-toplevel 2>/dev/null || echo .)"
check="${root}/stig-code-analyzer/scripts/check-phasar-sync.sh"
[[ -f "$check" ]] || exit 0

echo "[commit-msg] release commit detected — verifying PhASAR is in sync with the pin…" >&2
if ! bash "$check" --strict; then
  echo "" >&2
  echo "[commit-msg] ABORTED: PhASAR is out of sync with pins.env (see above)." >&2
  echo "[commit-msg] Fix the pin / push phasar, or rerun with --no-verify to override." >&2
  exit 1
fi
exit 0
