feat(guardrails): serve the git hooks to lefthook repositories as a remote

.changes/actionlint/feat-guardrails-lefthook-remote-663be064.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The vendored git-hook installer (`lib/git-hooks/install.mjs`) accepts an optional `remote` block in `git-hooks/entries.json` and a `plan --scope remote` that returns a lefthook `remotes:` entry for it; a plugin without the block behaves as before, and `copy --scope remote` is a usage error.

.changes/bash-format/feat-guardrails-lefthook-remote-66f960c2.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The vendored git-hook installer (`lib/git-hooks/install.mjs`) accepts an optional `remote` block in `git-hooks/entries.json` and a `plan --scope remote` that returns a lefthook `remotes:` entry for it; a plugin without the block behaves as before, and `copy --scope remote` is a usage error.

.changes/biome-format/feat-guardrails-lefthook-remote-4ac659d2.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The vendored git-hook installer (`lib/git-hooks/install.mjs`) accepts an optional `remote` block in `git-hooks/entries.json` and a `plan --scope remote` that returns a lefthook `remotes:` entry for it; a plugin without the block behaves as before, and `copy --scope remote` is a usage error.

.changes/go-format/feat-guardrails-lefthook-remote-12d43cd7.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The vendored git-hook installer (`lib/git-hooks/install.mjs`) accepts an optional `remote` block in `git-hooks/entries.json` and a `plan --scope remote` that returns a lefthook `remotes:` entry for it; a plugin without the block behaves as before, and `copy --scope remote` is a usage error.

.changes/guardrails/feat-guardrails-lefthook-remote-51ab54cf.md

@@ -0,0 +1,7 @@
+---
+bump: minor
+---
+
+### Added
+
+- `apply install-git-hooks scope=shared` in a lefthook repository, or one with no hook manager yet, now adds one `remotes:` entry to the committed `lefthook.yml` instead of committing copies under `.githooks/guardrails/`: lefthook fetches `git-hooks/lefthook-remote.yml` and its scripts from this marketplace repository's `main` branch and refetches them every 24 hours, so every clone runs the hooks as merged to `main`, with no refresh pull request and no lint exclusion. `install.mjs plan --scope remote` returns the snippet; `verify` reports each entry `ok` once the config carries the remote, `lefthook install` has written the event hook and the remote is fetched, and `missing` with "run lefthook install" otherwise, so the session-start notice also catches a first install made offline. A repository holding the earlier shared copies gets a `migrate` decision (`from: shared`) naming `.githooks/guardrails/` and the old `guardrails-<entry>` jobs to remove. Husky and plain hooks keep the shared copies, and so does a lefthook config that sets its own `source_dir` (a `remote-source-dir` decision), because lefthook then looks for the remote's scripts in a directory the fetched copy does not have.

.changes/instruction-placement/feat-guardrails-lefthook-remote-6f491184.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The vendored git-hook installer (`lib/git-hooks/install.mjs`) accepts an optional `remote` block in `git-hooks/entries.json` and a `plan --scope remote` that returns a lefthook `remotes:` entry for it; a plugin without the block behaves as before, and `copy --scope remote` is a usage error.

.changes/markdown-format/feat-guardrails-lefthook-remote-821cb784.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The vendored git-hook installer (`lib/git-hooks/install.mjs`) accepts an optional `remote` block in `git-hooks/entries.json` and a `plan --scope remote` that returns a lefthook `remotes:` entry for it; a plugin without the block behaves as before, and `copy --scope remote` is a usage error.

.changes/powershell-format/feat-guardrails-lefthook-remote-433a1c9a.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The vendored git-hook installer (`lib/git-hooks/install.mjs`) accepts an optional `remote` block in `git-hooks/entries.json` and a `plan --scope remote` that returns a lefthook `remotes:` entry for it; a plugin without the block behaves as before, and `copy --scope remote` is a usage error.

.changes/ruff-format/feat-guardrails-lefthook-remote-f22965d4.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The vendored git-hook installer (`lib/git-hooks/install.mjs`) accepts an optional `remote` block in `git-hooks/entries.json` and a `plan --scope remote` that returns a lefthook `remotes:` entry for it; a plugin without the block behaves as before, and `copy --scope remote` is a usage error.

.changes/typos-format/feat-guardrails-lefthook-remote-5598ea80.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The vendored git-hook installer (`lib/git-hooks/install.mjs`) accepts an optional `remote` block in `git-hooks/entries.json` and a `plan --scope remote` that returns a lefthook `remotes:` entry for it; a plugin without the block behaves as before, and `copy --scope remote` is a usage error.

.github/scripts/pr-require-checks/install-lefthook.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Install the pinned lefthook on a Linux x86_64 runner, checksum-verified, into ~/.local/bin and
+# onto $GITHUB_PATH: the lefthook the guardrails remote's end-to-end test
+# (plugins/guardrails/git-hooks/lefthook-remote.test.sh) runs in pr-require-checks.yml's
+# test-bash lane.
+# The version is the one the fleet runs; the hash is the release's published SHA-256 for
+# lefthook_<version>_Linux_x86_64. A cached download under ~/.cache/ci-tools is reused and
+# checked the same way.
+set -euo pipefail
+
+LEFTHOOK_VERSION=2.2.2
+LEFTHOOK_SHA256=4fbf89eb7748c6aed84d833ee1a29edac48fae614468ca9a82896ec32f2800b6
+
+asset="lefthook_${LEFTHOOK_VERSION}_Linux_x86_64"
+mkdir -p "$HOME/.local/bin" "$HOME/.cache/ci-tools"
+cached="$HOME/.cache/ci-tools/$asset"
+[[ -f "$cached" ]] || curl -fSL --no-progress-meter --retry 3 --retry-all-errors -o "$cached" \
+  "https://github.com/evilmartians/lefthook/releases/download/v$LEFTHOOK_VERSION/$asset"
+cp "$cached" "$HOME/.local/bin/lefthook"
+echo "$LEFTHOOK_SHA256  $HOME/.local/bin/lefthook" | sha256sum -c -
+chmod +x "$HOME/.local/bin/lefthook"
+[[ -z "${GITHUB_PATH:-}" ]] || echo "$HOME/.local/bin" >>"$GITHUB_PATH"
+test "$("$HOME/.local/bin/lefthook" version)" = "$LEFTHOOK_VERSION"

.github/workflows/pr-require-checks.yml

@@ -2589,7 +2589,7 @@ jobs:
           rcfile: .shellcheckrc
       # The eval-coverage gate's suite reads `shfmt --to-json` and exits 2 when
       # shfmt is missing, so this job installs the same v3.14.1 pin as
-      # check-skills. The shfmt and DuckDB downloads are cached by version (four
+      # check-skills. The shfmt, DuckDB and lefthook downloads are cached by version (four
       # red main runs in two weeks were these downloads failing), and a miss
       # retries transient failures. `--no-progress-meter` instead of `-s` keeps
       # curl's "Will retry" warning in the log. The SHA-256 check runs on a hit
@@ -2599,7 +2599,7 @@ jobs:
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/ci-tools
-          key: ci-tools-${{ runner.os }}-shfmt-v3.14.1-duckdb-v1.5.5
+          key: ci-tools-${{ runner.os }}-shfmt-v3.14.1-duckdb-v1.5.5-lefthook-2.2.2
       - name: Install pinned shfmt
         env:
           SHFMT_VERSION: v3.14.1
@@ -2689,6 +2689,17 @@ jobs:
           gunzip "$RUNNER_TEMP/duckdb/duckdb.gz"
           chmod +x "$RUNNER_TEMP/duckdb/duckdb"
           echo "$RUNNER_TEMP/duckdb" >> "$GITHUB_PATH"
+      # The guardrails remote's end-to-end suite runs real lefthook against a
+      # stand-in remote; a broken lefthook-remote.yml would block every
+      # consumer's commits, so it fails here instead of skipping
+      # (GUARDRAILS_REQUIRE_LEFTHOOK).
+      - name: Install pinned lefthook
+        run: |
+          if [[ "$(jq -r --arg leg "$LEG" '.[$leg] // ""' <<<"$LEG_PLAN")" != *lefthook* ]]; then
+            echo "No suite on this leg runs lefthook."
+            exit 0
+          fi
+          bash .github/scripts/pr-require-checks/install-lefthook.sh
       - name: Save the pinned tool downloads
         if: github.ref == 'refs/heads/main' && steps.tools_cache.outputs.cache-hit != 'true'
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -2710,6 +2721,8 @@ jobs:
           # The check-visual-parity pixel cases fail on a missing pixelmatch or pngjs here instead of skipping green.
           VISUAL_COMPARE_REQUIRE: '1'
           VISUAL_COMPARE_DEPS_DIR: .work
+          # The guardrails remote's end-to-end cases fail on a missing lefthook here instead of skipping green.
+          GUARDRAILS_REQUIRE_LEFTHOOK: '1'
           # On main (schedule, dispatch) a failing suite in
           # scripts/run-plugin-tests-advisory.txt warns instead of failing the
           # leg; pull requests and merge groups still fail on it.

.lefthook/commit-msg/guardrails-commit-msg-convention.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# The guardrails commit-msg-convention entry for consumers of the plugin's lefthook remote
+# (plugins/guardrails/git-hooks/lefthook-remote.yml). Lefthook looks up a remote's scripts
+# under this repository's root .lefthook/, so this runs the plugin's own script, which finds its libs beside it.
+exec bash "${BASH_SOURCE[0]%/*}/../../plugins/guardrails/git-hooks/commit-msg-convention.sh" "$@"

.lefthook/pre-commit/guardrails-pre-commit-content.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# The guardrails pre-commit-content entry for consumers of the plugin's lefthook remote
+# (plugins/guardrails/git-hooks/lefthook-remote.yml). Lefthook looks up a remote's scripts
+# under this repository's root .lefthook/, so this runs the plugin's own script, which finds its libs beside it.
+exec bash "${BASH_SOURCE[0]%/*}/../../plugins/guardrails/git-hooks/pre-commit-content.sh" "$@"

.lefthook/pre-push/guardrails-reference-verify.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# The guardrails reference-verify entry for consumers of the plugin's lefthook remote
+# (plugins/guardrails/git-hooks/lefthook-remote.yml). Lefthook looks up a remote's scripts
+# under this repository's root .lefthook/, so this runs the plugin's own script, which finds its libs beside it.
+exec bash "${BASH_SOURCE[0]%/*}/../../plugins/guardrails/git-hooks/reference-verify.sh" "$@"