Pre-push hook leaks repository-local Git environment into child tests

[flyingrobots]

Problem\n\nGit exports repository-local GIT_* variables to pre-push hooks. The current hook forwards that environment into Vitest, contaminating tests and examples that create or access temporary repositories. The same unit suite passes standalone but fails under git push with fatal: not a git repository, fatal: not in a git directory, and downstream EPIPE errors.\n\n## Required fix\n\n- Clear variables reported by git rev-parse --local-env-vars before launching lint/tests.\n- Keep the quality gates enabled; do not bypass the hook.\n- Add a regression contract for the hook boundary.\n- Demonstrate a normal push with the full hook passing.\n\n## Acceptance criteria\n\n- [ ] Hook sanitizes repository-local Git variables before child commands.\n- [ ] Focused regression and previously failing Git-backed tests pass.\n- [ ] Normal git push completes with lint and the full unit suite enabled.\n

[coderabbitai]

🔗 Related PRs

#3 - feat(cas): M3 Launchpad — native Bun/Deno adapters, async crypto, and OIDC/JSR release workflow [merged]
#19 - docs: rewrite roadmap and prepare v5.3.2 [closed]
#21 - chore: prepare v5.3.3 ledger closeout [closed]
#66 - feat: add repository usage diagnostics [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[flyingrobots]

Closure evidence:\n\n- The pre-push boundary now validates Git-local environment discovery, fails closed on discovery failure, unsets every discovered variable, and only then launches lint and unit tests. [cite: scripts/hooks/pre-push#8-27@eac13afe74f927c739c601b9f1c3688bf4022511]\n- Behavioral regression coverage proves both successful sanitation and prevention of quality-gate execution when discovery fails. [cite: test/unit/scripts/pre-push-hook.test.js#19-48@eac13afe74f927c739c601b9f1c3688bf4022511]\n\nPR #71 merged after all Node/Bun/Deno CI jobs passed, CodeRabbit approved, its only thread was resolved, and an independent Code Lawyer returned CLEAN.