From c25c35f82c04b728a73589996d4f877224356618 Mon Sep 17 00:00:00 2001
From: Mihaela Mihaljevic <mihaelamj@me.com>
Date: Fri, 5 Jun 2026 10:24:04 +0200
Subject: [PATCH] ci(gates): add full local verification script

---
 .githooks/pre-push                 | 26 +-------------------------
 CHANGELOG.md                       |  4 ++++
 README.md                          | 14 ++++++++++++--
 scripts/check-all.sh               | 25 +++++++++++++++++++++++++
 scripts/check-changelog-touched.sh | 11 +++++++----
 5 files changed, 49 insertions(+), 31 deletions(-)
 create mode 100755 scripts/check-all.sh

diff --git a/.githooks/pre-push b/.githooks/pre-push
index 0e2172f..c1648f1 100755
--- a/.githooks/pre-push
+++ b/.githooks/pre-push
@@ -10,28 +10,4 @@ set -u
 ROOT=$(git rev-parse --show-toplevel 2>/dev/null || echo .)
 cd "$ROOT" || exit 1
 
-FAIL=0
-
-# Always: repo-wide style and namespacing gates.
-bash scripts/check-style.sh || FAIL=1
-bash scripts/check-namespacing.sh || FAIL=1
-bash scripts/check-changelog-touched.sh || FAIL=1
-
-if command -v swiftformat >/dev/null 2>&1; then
-  swiftformat . --config .swiftformat --lint || FAIL=1
-else
-  echo "pre-push: swiftformat not installed, skipping format check" >&2
-fi
-if command -v swiftlint >/dev/null 2>&1; then
-  swiftlint --config .swiftlint.yml --strict || FAIL=1
-else
-  echo "pre-push: swiftlint not installed, skipping lint check" >&2
-fi
-swift build || FAIL=1
-swift test || FAIL=1
-bash scripts/check-wasm.sh || FAIL=1
-
-if [ "$FAIL" -ne 0 ]; then
-  echo "pre-push: one or more gates failed; push aborted." >&2
-  exit 1
-fi
+bash scripts/check-all.sh
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 325b292..3f72b14 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -34,6 +34,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   suites.
 - Add macOS, Linux, and WASM verification gates and CI jobs, plus a local Linux
   check that can run through Claw Mini's Lima VM.
+- Add a single full local verification script and wire pre-push through the
+  macOS, Claw Mini Linux, and WASM gate sequence.
+- Harden the changelog gate so local verification also sees unstaged source
+  edits, not only committed or staged changes.
 - Add Yams and CYaml attribution without copying their implementation into
   `Sources/`.
 
diff --git a/README.md b/README.md
index 7ff29c0..d0bc5b8 100644
--- a/README.md
+++ b/README.md
@@ -45,7 +45,7 @@ flowchart TB
   classDef epic fill:#f2e5ff,stroke:#af52de,color:#111827
   classDef todo fill:#f2f4f7,stroke:#8e8e93,color:#111827
   SuperEpic8["#8 Parser Replacement Roadmap"]:::epic
-  Epic1["#1 Pure Swift Parse Core"]:::epic
+  Epic1["#1 Pure Swift Parse Core"]:::done
   SuperEpic8 --> Epic1
 ```
 
@@ -62,7 +62,7 @@ flowchart TB
   Issue4["#4 Token Stream to Events"]:::done
   Issue5["#5 Events to PureYAML Values"]:::done
   Issue6["#6 Scalars Tags and Aliases"]:::done
-  Issue7["#7 macOS Linux and WASM Hardening"]:::todo
+  Issue7["#7 macOS Linux and WASM Hardening"]:::done
   Issue2 --> Issue3
   Issue3 --> Issue4
   Issue4 --> Issue5
@@ -114,6 +114,12 @@ try PureYAML.validate(document)
 
 PureYAML must stay dependency-free and portable. Before merging changes:
 
+```sh
+bash scripts/check-all.sh
+```
+
+That command expands to:
+
 ```sh
 bash scripts/check-style.sh
 bash scripts/check-namespacing.sh
@@ -127,6 +133,10 @@ bash scripts/check-linux.sh
 bash scripts/check-wasm.sh
 ```
 
+The pre-push hook runs `scripts/check-all.sh` so local pushes exercise macOS,
+Claw Mini Linux, and WASM before hosted CI repeats the macOS, Linux, and WASM
+matrix.
+
 `scripts/check-wasm.sh` expects a Swift toolchain with a matching Swift Wasm SDK.
 For Swift 6.3.2, install the SDK with:
 
diff --git a/scripts/check-all.sh b/scripts/check-all.sh
new file mode 100755
index 0000000..74c3486
--- /dev/null
+++ b/scripts/check-all.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Full local verification gate for PureYAML.
+#
+# Runs the checks required before completion, including the Claw Mini Linux
+# check when executed from macOS and the WASM SDK build check.
+
+set -euo pipefail
+
+run_gate() {
+  name="$1"
+  shift
+  printf '\n==> %s\n' "$name"
+  "$@"
+}
+
+run_gate "style" bash scripts/check-style.sh
+run_gate "namespacing" bash scripts/check-namespacing.sh
+run_gate "changelog" bash scripts/check-changelog-touched.sh
+run_gate "roadmap" bash scripts/check-roadmap.sh
+run_gate "swiftformat" swiftformat . --config .swiftformat --lint
+run_gate "swiftlint" swiftlint --config .swiftlint.yml --strict
+run_gate "swift build" swift build
+run_gate "swift test" swift test
+run_gate "linux" bash scripts/check-linux.sh
+run_gate "wasm" bash scripts/check-wasm.sh
diff --git a/scripts/check-changelog-touched.sh b/scripts/check-changelog-touched.sh
index 32e3c9f..d7d9c11 100755
--- a/scripts/check-changelog-touched.sh
+++ b/scripts/check-changelog-touched.sh
@@ -18,10 +18,13 @@ if ! git rev-parse --verify "$BASE_REF" >/dev/null 2>&1; then
   fi
 fi
 
-changed=$(git diff --name-only "$BASE_REF"...HEAD --)
-if [ -z "$changed" ]; then
-  changed=$(git diff --cached --name-only --)
-fi
+changed=$(
+  {
+    git diff --name-only "$BASE_REF"...HEAD --
+    git diff --cached --name-only --
+    git diff --name-only --
+  } | awk 'NF && !seen[$0]++'
+)
 
 source_touched=0
 while IFS= read -r path; do