加固

.githooks/check_staged_java_encoding.py

@@ -0,0 +1,92 @@
+#!/usr/bin/env python3
+import subprocess
+import sys
+
+
+def run_git(*args: str) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        ["git", *args],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        check=False,
+    )
+
+
+def staged_java_files() -> list[str]:
+    result = run_git("diff", "--cached", "--name-only", "--diff-filter=ACMR", "-z")
+    if result.returncode != 0:
+        sys.stderr.write(result.stderr.decode("utf-8", errors="replace"))
+        return []
+
+    files: list[str] = []
+    for raw in result.stdout.split(b"\0"):
+        if not raw:
+            continue
+        path = raw.decode("utf-8", errors="surrogateescape")
+        if path.lower().endswith(".java"):
+            files.append(path)
+    return files
+
+
+def staged_blob(path: str) -> bytes | None:
+    result = run_git("show", f":{path}")
+    if result.returncode != 0:
+        return None
+    return result.stdout
+
+
+def main() -> int:
+    utf8_errors: list[str] = []
+    bom_errors: list[str] = []
+    crlf_errors: list[str] = []
+    missing_errors: list[str] = []
+
+    for path in staged_java_files():
+        data = staged_blob(path)
+        if data is None:
+            missing_errors.append(path)
+            continue
+
+        if data.startswith(b"\xef\xbb\xbf"):
+            bom_errors.append(path)
+
+        try:
+            data.decode("utf-8")
+        except UnicodeDecodeError:
+            utf8_errors.append(path)
+
+        if b"\r\n" in data:
+            crlf_errors.append(path)
+
+    if not (utf8_errors or bom_errors or crlf_errors or missing_errors):
+        return 0
+
+    sys.stderr.write("\npre-commit blocked: Java file encoding/line-ending violations found.\n")
+    if utf8_errors:
+        sys.stderr.write("\n[Non-UTF-8 Java files]\n")
+        for p in utf8_errors:
+            sys.stderr.write(f"  - {p}\n")
+    if bom_errors:
+        sys.stderr.write("\n[UTF-8 BOM not allowed]\n")
+        for p in bom_errors:
+            sys.stderr.write(f"  - {p}\n")
+    if crlf_errors:
+        sys.stderr.write("\n[CRLF not allowed in Java files]\n")
+        for p in crlf_errors:
+            sys.stderr.write(f"  - {p}\n")
+    if missing_errors:
+        sys.stderr.write("\n[Could not read staged blob]\n")
+        for p in missing_errors:
+            sys.stderr.write(f"  - {p}\n")
+
+    sys.stderr.write(
+        "\nFix tips:\n"
+        "  1) Convert file encoding to UTF-8 (without BOM).\n"
+        "  2) Convert line endings to LF.\n"
+        "  3) Re-stage files: git add <file>\n"
+    )
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.githooks/pre-commit

@@ -0,0 +1,14 @@
+#!/usr/bin/env sh
+set -eu
+
+PYTHON_BIN="${PYTHON:-python}"
+if ! command -v "$PYTHON_BIN" >/dev/null 2>&1; then
+  PYTHON_BIN="python3"
+fi
+
+if ! command -v "$PYTHON_BIN" >/dev/null 2>&1; then
+  echo "pre-commit: Python is required to run encoding checks." >&2
+  exit 1
+fi
+
+exec "$PYTHON_BIN" ".githooks/check_staged_java_encoding.py"