Quality Commit

Quality Commit

Run all quality gates on staged changes, then commit. Replaces manual multi-step commit prep that frequently causes pre-commit hook friction.

NEVER

• Never run git add . or git add -A — always stage specific files by name.
• Never commit after partial gate failures by bypassing hooks — gates exist for correctness.
• Never let optional tools (CodeRabbit, Semgrep) block the workflow when not installed — skip with warning.
• Never widen scope to unrelated repo cleanup during commit prep.
• Never attempt to auto-fix gate failures and retry — report errors, let the agent fix first.

Decision: What Gates to Run

Has staged files?
├─ No → Print warning, exit
└─ Yes →
    ├─ Always: Lint → TypeCheck → Semgrep → Tests → Commit
    ├─ --review or --full: Add CodeRabbit (slow, ~30s) before commit
    └─ --push: After commit, Semgrep committed files, push to remote

Gate Execution

Scope detection

STAGED=$(git diff --cached --name-only --diff-filter=ACMR)
bash scripts/classify-staged-files.sh  # categorizes into frontend/api/shared

Semgrep: file-at-a-time (critical workaround)

Semgrep 1.146.0+ crashes with multiple file arguments (Invalid_argument: invalid path). Always loop:

for f in $STAGED_FILES; do
  semgrep scan --config auto --json "$f" 2>/dev/null || true
done

Block on critical/high findings. Warn on medium/low. Skip if not installed.

TypeCheck workspace commands

• frontend: npx svelte-check --tsconfig ./tsconfig.json --threshold error (11 pre-existing errors in test files are known baseline — ignore)
• api: npx tsc --noEmit
• shared: npx tsc --noEmit

Related test discovery

node scripts/find-related-tests.js <staged-file>
# src/lib/server/auth/rbac.ts → src/lib/server/auth/rbac.test.ts

Run discovered tests: npx vitest run <test-files> --reporter=verbose

Commit message format

type(scope): description

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Types: feat, fix, refactor, test, docs, chore Scopes: security, phaseX.Y, api, frontend, database, auth, workflows

Push flow (--push only)

1. Re-run Semgrep on committed files (same file-at-a-time loop, use git diff --name-only HEAD~1) 2. Detect upstream: git rev-parse --abbrev-ref @{u} 2>/dev/null 3. If no upstream: git push -u origin $BRANCH, else git push 4. Abort push on critical/high Semgrep findings — commit stays intact, do NOT undo it

Summary table

| Gate       | Status | Details                    |
|------------|--------|----------------------------|
| Lint       | PASS   | 5 files, 0 errors          |
| TypeCheck  | PASS   | api + frontend             |
| Semgrep    | PASS   | 0 findings                 |
| CodeRabbit | SKIP   | (use --review to enable)   |
| Tests      | PASS   | 3 test files, 12 tests     |
| Commit     | DONE   | abc1234                    |
| Push       | SKIP   | (use --push to enable)     |

Arguments

• (empty): lint + typecheck + semgrep + tests + commit
• --review / --full: Add CodeRabbit review
• --dry-run: Run all gates, skip actual commit and push
• --push: Commit then semgrep + push to remote
• --message "...": Use custom commit message

quality-commit - Standardized Quality Gates for Git

Version: 1.0.0 Status: Production-Ready Framework: OCI Self-Service Portal (SvelteKit + Fastify + shared packages)

What This Skill Does

Automates the multi-step commit workflow: lint staged changes, run type checks, security scan (Semgrep), execute tests, and commit with conventional message format — all in one command. Replaces manual multi-step processes that frequently cause pre-commit hook friction.

Problem It Solves

Before: Developers manually run: 1. eslint on staged files 2. tsc/svelte-check for types 3. semgrep for security 4. vitest for affected tests 5. git commit with message 6. (optional) git push

Each step can fail silently, miss files, or require manual recovery. Pre-commit hooks catch failures after work is already done.

After: Single command runs all quality gates in order, with clear exit on first failure.

Key Features

Scoped Quality Gates

• Lint: Only checks staged files, workspace-specific (frontend/api/shared)
• TypeCheck: Only affected workspaces (not entire monorepo)
• Semgrep: Scans one file at a time (bug workaround in Semgrep 1.146.0+)
• Tests: Discovers colocated .test.ts files and runs only those
• Commit: Conventional message format with Co-Authored-By trailer

Workspace Intelligence

• Detects which packages have staged changes (frontend, api, shared)
• Runs lint/tsc/tests only on affected workspaces
• Avoids full monorepo builds

Optional Enhancements

• --review: Include CodeRabbit code review (slower, ~30s)
• --push: After successful commit, run semgrep on committed files and push
• --dry-run: Validate all gates but skip commit/push
• --message "...": Custom commit message instead of auto-generate

Error Recovery

• Prints specific errors on gate failure
• Stops immediately (no auto-fix attempts)
• Leaves staged changes intact for manual remediation
• Re-run /quality-commit after fixing

Usage Examples

Standard flow (lint, typecheck, semgrep, tests, commit):

/quality-commit

Full validation with CodeRabbit review:

/quality-commit --review

Validate everything but don't commit:

/quality-commit --dry-run

Commit and push:

/quality-commit --push

Full flow with review and push:

/quality-commit --review --push

Custom commit message:

/quality-commit --message "fix(security): add IPv6 SSRF checks"

Technical Details

Monorepo Workspace Detection

STAGED=$(git diff --cached --name-only --diff-filter=ACMR)
# Categorize into frontend, api, shared

Semgrep Bug Workaround

Semgrep 1.146.0–1.151.0+ crashes with Invalid_argument: invalid path when given multiple files. Solution: Scan each file individually and aggregate findings.

Test Discovery

For each staged .ts/.svelte file, looks for colocated .test.ts:

• src/lib/auth/rbac.ts → src/lib/auth/rbac.test.ts
• src/routes/chat.ts → src/routes/chat.test.ts

Commit Message Format

type(scope): description

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Types: feat, fix, refactor, test, docs, chore Scopes: security, phaseX.Y, api, frontend, database, auth, workflows

Gate Details

1. Lint

• Frontend: cd apps/frontend && npx eslint <files>
• API: cd apps/api && npx eslint <files>
• Shared: cd packages/shared && npx eslint <files>

2. Type Check

• Frontend: npx svelte-check --tsconfig ./tsconfig.json --threshold error
• API: npx tsc --noEmit
• Shared: npx tsc --noEmit

3. Semgrep Security

• Config: auto (uses default rules)
• Scans one file at a time
• Blocks on critical/high findings
• Warns on medium/low findings

4. CodeRabbit (Optional)

• Command: coderabbit review --plain -t uncommitted
• Blocks on critical findings
• Requires --review flag to enable

5. Tests

• Discovers colocated .test.ts files
• Runs: npx vitest run <test-files> --reporter=verbose
• Blocks on test failures

6. Commit

• Stages all changes
• Commits with conventional message format

7. Push (Optional)

• Requires --push flag
• Re-scans committed files with Semgrep (security gate)
• Pushes to remote: git push or git push -u origin $BRANCH

Installation

# Copy to Claude Code skills directory
cp -r quality-commit ~/.agents/skills/

# Or for Cursor
cp -r quality-commit ~/.cursor/skills/

Requirements

• pnpm (monorepo manager)
• eslint (frontend, api, shared)
• svelte-check (frontend type check)
• tsc (api, shared type check)
• vitest (test runner)
• semgrep (optional, security scanning)
• coderabbit CLI (optional, requires --review flag)

Anti-Patterns & Gotchas

NEVER

1. Run without staging first - Ensure changes are staged with git add before calling /quality-commit 2. Auto-fix lint errors you didn't introduce - Let hook failures happen, fix them cleanly, then retry 3. Commit unrelated changes - Stage only the feature/fix you're working on 4. Skip Semgrep on security changes - Always review Semgrep findings before pushing 5. Push with critical CodeRabbit findings - Address critical issues first

Be Aware

• Lint is workspace-scoped, not global
• Tests are file-discovery based (look for .test.ts colocated with source)
• Semgrep has a known multi-file bug (scans one file at a time)
• Pre-existing lint errors in unrelated files won't block you
• TypeCheck errors will block commit (as intended)

Framework Integration

Designed for:

• Frontend: SvelteKit (adapter-node)
• API: Fastify 5
• Testing: Vitest 4
• Monorepo: pnpm
• CI/CD: GitHub Actions (compatible with pre-push hooks)

Exit Status

• 0: All gates passed, commit created (and pushed if --push was used)
• 1: A gate failed (see error output for details)
• 1: No staged changes found

Summary Output

On success, prints a gate summary table:

| Gate        | Status | Details                    |
|-------------|--------|----------------------------|
| Lint        | PASS   | 5 files, 0 errors          |
| TypeCheck   | PASS   | api + frontend             |
| Semgrep     | PASS   | 0 findings                 |
| CodeRabbit  | SKIP   | (use --review to enable)   |
| Tests       | PASS   | 3 test files, 12 tests     |
| Commit      | DONE   | abc1234                    |
| Push        | SKIP   | (use --push to enable)     |

See Also

• Conventional Commits
• Semgrep Rules
• Vitest Documentation
• ESLint Configuration