chore: commit-msg 훅을 PIKI-Infra 정본에서 원격 배선

[m-a-king]

Situation

커밋 타입 형식({type}: 제목)을 강제하는 commit-msg 훅이 PIKI-Server 에만 체크인돼 있고, 이 repo 엔 없었다. 훅을 repo 마다 복제하면 정본과 어긋나는(drift) 순간 규약이 갈라진다.

Task

훅 정본을 PIKI-Infra(hooks/commit-msg)가 SSOT 로 소유하고, 이 repo 는 복사본을 체크인하지 않은 채 배선만 갖는다.

Action

• .claude/settings.json 신설: SessionStart 가 PIKI-Infra 의 install.sh(정본 설치기)를 원격 fetch 해 실행하는 한 줄 부트스트랩
  • 자산 목록·설치 위치·실패 처리는 install.sh 만 알고, 이 repo 에 남는 상수는 repo 좌표(TeamPiKi/PIKI-Infra) 1개
  • 처음엔 자산 경로·설치 로직을 SessionStart 명령에 직접 박았으나, 자산이 늘 때마다 소비 repo 전부를 고쳐야 해 설치 로직을 PIKI-Infra 로 올리는 구조로 전환
  • 설치기는 $(git rev-parse --git-common-dir)/hooks 에 설치해 worktree(.git 이 파일인 경우)에서도 동작
  • fetch 실패(오프라인·권한 없음)나 bash -n 문법 검증 실패 시 실행·설치를 스킵하고 기존 설치본 유지, exit 0 (문법 가드는 CodeRabbit 가용성 지적 수용)
• 훅 파일 자체는 이 repo 에 두지 않음 (SSOT 위반 복사본 금지)

Result

• 부트스트랩 실행 실측: 원격 install.sh 경유로 설치본이 PIKI-Infra 정본과 바이트 동일
• 형식 위반 커밋 거부(exit 1)·규약 커밋 통과 실측
• 이후 공통 자산(훅·스크립트)이 늘어도 이 repo 는 무변경

Summary by CodeRabbit

• Chores
  • Added a startup automation that safely retrieves and runs an installation script after validating it first.
  • The process now uses a temporary file and cleans up automatically, with failures handled silently.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a new .claude/settings.json file with a SessionStart hook. The hook fetches install.sh from TeamPiKi/PIKI-Infra, validates it with bash -n, executes it from a temporary file, cleans up the file, and exits successfully.

Changes

Session Hook Configuration

Layer / File(s)	Summary
SessionStart hook definition .claude/settings.json	New config defines a SessionStart hook that fetches install.sh via gh api, validates it with bash -n, runs it from a temp file, removes the temp file, and exits with success.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main change: wiring the commit-msg hook to fetch from PIKI-Infra as the source of truth.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/commit-hook-wiring

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.claude/settings.json (1)

8-8: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Pin the hook fetch to a ref and add integrity checks. .claude/settings.json:8 pulls hooks/commit-msg from PIKI-Infra's default branch, so each session can install whatever is currently there. gh api supports ref=, so pin this to a tag or commit SHA and consider a checksum/signature check before installing.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.claude/settings.json at line 8, The hook install command in the settings
entry is fetching hooks/commit-msg from the repository default branch, which
makes the installed hook mutable. Update the command in .claude/settings.json to
use gh api with a fixed ref (tag or commit SHA) when downloading the hook, and
add an integrity check such as verifying a checksum or signature before calling
install. Keep the change localized to the settings command string so the hook
source is pinned and validated before use.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.claude/settings.json:
- Line 8: The hook install command in the settings entry is fetching
hooks/commit-msg from the repository default branch, which makes the installed
hook mutable. Update the command in .claude/settings.json to use gh api with a
fixed ref (tag or commit SHA) when downloading the hook, and add an integrity
check such as verifying a checksum or signature before calling install. Keep the
change localized to the settings command string so the hook source is pinned and
validated before use.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: eedc9d31-1e13-47f5-b7ba-2f5f5443d0ce

📥 Commits

Reviewing files that changed from the base of the PR and between 07372ff and f42d9c1.

📒 Files selected for processing (1)

• .claude/settings.json

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.claude/settings.json:
- Line 8: The SessionStart command currently pulls and executes the remote
install script from the default branch, which is mutable. Update the command in
settings.json to reference an immutable ref for
repos/TeamPiKi/PIKI-Infra/contents/install.sh using gh api, and ideally add
checksum verification before piping to bash so the install path is pinned and
reproducible.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 72e5fb5b-6a76-435b-ba06-ffa62b765634

📥 Commits

Reviewing files that changed from the base of the PR and between f42d9c1 and 60cf18f.

📒 Files selected for processing (1)

• .claude/settings.json