Offer pre-commit hooks

.pre-commit-hooks.yaml

@@ -0,0 +1,16 @@
+# pre-commit (https://pre-commit.com) hooks. Both review the staged changes
+# (`--base HEAD`) and need TYPESAFE_API_KEY or a key saved by `jevgate auth login`.
+- id: jevgate
+  name: JevGate
+  description: Review staged changes with JevGate, built from source by pre-commit (needs a Rust toolchain)
+  entry: jevgate check --base HEAD
+  language: rust
+  pass_filenames: false
+  require_serial: true
+- id: jevgate-system
+  name: JevGate
+  description: Review staged changes with the jevgate already on PATH (Homebrew, install.sh or cargo)
+  entry: jevgate check --base HEAD
+  language: system
+  pass_filenames: false
+  require_serial: true

CHANGELOG.md

@@ -4,6 +4,7 @@ Notable changes to JevGate. Versions follow [Semantic Versioning](https://semver
 
 ## [Unreleased]
 
+- pre-commit hooks: `jevgate-system` runs the installed `jevgate` on the staged changes, and `jevgate` builds it from source with Rust first.
 - `--format sarif` writes a SARIF 2.1.0 log for GitHub code scanning, GitLab and editors: the findings `--format github` annotates, as `error` when they fail the gate and `warning` otherwise, with every rule's question, related locations, the finding's fingerprint and probability. Run errors and files that could not be judged are tool notifications.
 - Agent output is colored on a terminal: the headline by the gate's outcome, review and consider headings, and each finding's location. `--color auto|always|never` chooses, and `NO_COLOR` and `CLICOLOR_FORCE` are honored; JSON and GitHub annotations are never colored.
 - `jevgate completions SHELL` prints a completion script for bash, zsh, fish, elvish or PowerShell, and `jevgate man [COMMAND]` a man page, both generated from the same definitions as `--help`. The Homebrew formula installs them.

README.md

@@ -207,6 +207,16 @@ The action installs a checked release binary, keeps `.jevgate/cache` in the Acti
 - **Transient failures:** rate limits, overload and server or edge errors (HTTP 408, 429, 500, 502–504, 520–524, 529) are retried up to four attempts; a timeout or dropped connection is retried once, since the first send may have run.
 - **Report-only paths:** give tooling its own level with `[[scope]]` (below), so scripts are reported while product code gates.
 
+Before each commit, with [pre-commit](https://pre-commit.com), review what is staged:
+
+```yaml
+repos:
+  - repo: https://github.com/Tech-Byte-Frontier/jevgate
+    rev: v0.18.0
+    hooks:
+      - id: jevgate-system   # the jevgate on PATH; `jevgate` builds it with Rust instead
+```
+
 Other CI systems work the same way: install with `install.sh` or `cargo binstall`, set `TYPESAFE_API_KEY`, keep `.jevgate/cache` between runs, and read the exit code or the JSON report.
 
 ## Configuration