chore(project): update hooks

Author: krokoko

.pre-commit-config.yaml

@@ -11,9 +11,9 @@ repos:
     hooks:
       - id: trailing-whitespace
         # Skip generated trees and paths often checked in read-only (0444); mutating hooks must not touch them.
-        exclude: (cdk/cdk\.out/|node_modules/|(^|/)LICENSE$|(^|/)\.gitattributes$|(^|/)\.npmignore$|(^|/)\.gitignore$|^cli/header\.js$|^docs/astro\.config\.mjs$|^docs/tsconfig\.json$|^docs/src/content\.config\.ts$|\.(snap|lock)$)
+        exclude: (cdk/cdk\.out/|node_modules/|^docs/src/content/docs/.*\.md$|(^|/)LICENSE$|(^|/)\.gitattributes$|(^|/)\.npmignore$|(^|/)\.gitignore$|^cli/header\.js$|^docs/astro\.config\.mjs$|^docs/tsconfig\.json$|^docs/src/content\.config\.ts$|\.(snap|lock)$)
       - id: end-of-file-fixer
-        exclude: (cdk/cdk\.out/|node_modules/|(^|/)LICENSE$|(^|/)\.gitattributes$|(^|/)\.npmignore$|(^|/)\.gitignore$|^cli/header\.js$|^docs/astro\.config\.mjs$|^docs/tsconfig\.json$|^docs/src/content\.config\.ts$)
+        exclude: (cdk/cdk\.out/|node_modules/|^docs/src/content/docs/.*\.md$|(^|/)LICENSE$|(^|/)\.gitattributes$|(^|/)\.npmignore$|(^|/)\.gitignore$|^cli/header\.js$|^docs/astro\.config\.mjs$|^docs/tsconfig\.json$|^docs/src/content\.config\.ts$)
       - id: check-merge-conflict
       - id: check-yaml
         exclude: ^(cdk/cdk\.out/|cdk\.out/|node_modules/|agent/\.venv/)
@@ -65,7 +65,14 @@ repos:
 
       - id: monorepo-security-pre-push
         name: security scans (pre-push)
-        entry: bash -lc 'cd "$(git rev-parse --show-toplevel)" && mise run security'
+        entry: bash -lc 'cd "$(git rev-parse --show-toplevel)" && mise run hooks:pre-push:security'
+        language: system
+        pass_filenames: false
+        stages: [pre-push]
+
+      - id: monorepo-tests-pre-push
+        name: package tests (pre-push)
+        entry: bash -lc 'cd "$(git rev-parse --show-toplevel)" && mise run hooks:pre-push:tests'
         language: system
         pass_filenames: false
         stages: [pre-push]

CONTRIBUTING.md

@@ -63,7 +63,11 @@ mise run hooks:install
 | Stage | What runs |
 |-------|-----------|
 | **pre-commit** | Trailing whitespace / EOF / merge-conflict / YAML+JSON checks; **gitleaks** on **staged** changes only; **eslint** (cdk, cli), **ruff** (agent), **astro check** (docs) when matching paths are touched. |
-| **pre-push** | **`mise run security`** — same as the root security task (gitleaks, OSV, Semgrep, Grype, Retire.js, agent Bandit + image scan when Docker is available). |
+| **pre-push** | Two pre-push hooks run in order:
+1. **`mise run hooks:pre-push:security`** — root security scans.
+2. **`mise run hooks:pre-push:tests`** — tests in `cdk`, `cli`, and `agent` packages.
+
+For convenience, **`mise run hooks:pre-push`** runs both steps sequentially. |
 
 Dry-run or reproduce locally without committing:
 

docs/src/content/docs/developer-guide/Contributing.md

@@ -12,4 +12,4 @@ Before editing, decide which part of the monorepo owns the behavior. This keeps
 | Agent runtime | `agent/` | Bundled into the image CDK deploys; run `mise run quality` in `agent/` or root build. |
 | Docs (source) | `docs/guides/`, `docs/design/` | After edits, run **`mise //docs:sync`** or **`mise //docs:build`**. Do not edit `docs/src/content/docs/` directly. |
 
-For a concise duplicate of this table, common pitfalls, and a CDK test file map, see **[AGENTS.md](/design/agents)** at the repo root (oriented toward automation-assisted contributors).
+For a concise duplicate of this table, common pitfalls, and a CDK test file map, see **[AGENTS.md](/design/agents)** at the repo root (oriented toward automation-assisted contributors).