build: manage git hooks with husky

Replace the hand-rolled .githooks/ directory and core.hooksPath prepare
script with husky, matching ts-apt. The pre-push hook moves to
.husky/pre-push and still runs npm run check:deps-pin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.githooks/pre-push

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-# Blocks pushes while a pinned dependency (e.g. ts-apt) is locally linked or
-# not pinned to a commit SHA. Installed by the npm "prepare" script via
-# core.hooksPath.
-set -euo pipefail
-
-cd "$(git rev-parse --show-toplevel)"
-exec npm run -s check:deps-pin

.husky/pre-push

@@ -0,0 +1,3 @@
+# Blocks pushes while a pinned dependency (e.g. ts-apt) is locally linked or
+# not pinned to a commit SHA.
+npm run -s check:deps-pin

AGENTS.md

@@ -86,7 +86,7 @@ You are an expert developer focused on TypeScript, Bash, DevOps, Git, and GitHub
 - `package.json` pins ts-apt to a commit SHA; local ts-apt changes are not visible to CI.
 - MUST push the ts-apt change first, then bump the ts-apt SHA pin in the same change that uses it.
 - NEVER push action code that depends on an unpushed ts-apt change.
-- `npm run check:deps-pin` enforces the pin; it runs in CI and in the `.githooks/pre-push` hook installed by `npm install`.
+- `npm run check:deps-pin` enforces the pin; it runs in CI and in the husky `.husky/pre-push` hook installed by `npm install`.
 - NEVER bypass the pre-push hook with `--no-verify`; unlink ts-apt instead.
 
 ## Quick Commands

package-lock.json

@@ -30,6 +30,7 @@
         "@typescript-eslint/parser": "^8.62.1",
         "@vitest/coverage-v8": "^4.1.9",
         "eslint": "^10.6.0",
+        "husky": "^9.1.7",
         "npm-run-all": "^4.1.5",
         "rollup": "^4.68.0",
         "semantic-release": "^25.0.5",
@@ -5755,6 +5756,22 @@
         "node": ">=10.17.0"
       }
     },
+    "node_modules/husky": {
+      "version": "9.1.7",
+      "resolved": "https://registry.npmjs.org/husky/-/husky-9.1.7.tgz",
+      "integrity": "sha512-5gs5ytaNjBrh5Ow3zrvdUUY+0VxIuWVL4i9irt6friV+BqdCfmV11CQTWMiBYWHbXhco+J1kHfTOUkePhCDvMA==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "husky": "bin.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/typicode"
+      }
+    },
     "node_modules/ieee754": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",

package.json

@@ -50,7 +50,7 @@
     "bundle": "rollup -c rollup.config.mjs",
     "build": "npm run -s runall -- build:lib bundle build:scripts",
     "clean": "rm -rf dist coverage",
-    "prepare": "git rev-parse --git-dir >/dev/null 2>&1 && git config core.hooksPath .githooks || true",
+    "prepare": "husky",
     "check:latest-action-pin": "node --experimental-strip-types ./scripts/ops/check_latest_action_pin.mts",
     "check:latest-action-pins": "node --experimental-strip-types ./scripts/ops/check_latest_action_pin.mts --scan",
     "check:pr": "node --experimental-strip-types ./scripts/ops/pr_checks.mts",
@@ -102,6 +102,7 @@
     "@typescript-eslint/parser": "^8.62.1",
     "@vitest/coverage-v8": "^4.1.9",
     "eslint": "^10.6.0",
+    "husky": "^9.1.7",
     "npm-run-all": "^4.1.5",
     "rollup": "^4.68.0",
     "semantic-release": "^25.0.5",

scripts/ops/check_deps_pin.mts

@@ -9,7 +9,7 @@
  *   2. package.json pins <name> to a full commit SHA (`...#<40 hex chars>`).
  *   3. package-lock.json resolves <name> to that same SHA and not a link.
  *
- * Used by .githooks/pre-push and the CI action-deps-pinned job.
+ * Used by .husky/pre-push and the CI action-deps-pinned job.
  *
  * Usage: check_deps_pin.mts <dependency> [<dependency>...]
  */