CLI-9 PR review

Author: sophio-japharidze-sonarsource

.npmrc

@@ -1,2 +1 @@
 save-exact=true
-registry=https://repox.jfrog.io/artifactory/api/npm/npm/

package.json

@@ -71,7 +71,6 @@
     "istanbul-lib-instrument": "6.0.3",
     "istanbul-lib-report": "3.0.1",
     "istanbul-reports": "3.2.0",
-    "js-yaml": "^4.1.1",
     "lcov-result-merger": "5.0.1",
     "@types/js-yaml": "^4.0.9",
     "lint-staged": "16.2.7",

src/cli/command-tree.ts

@@ -109,7 +109,7 @@ integrateCommand
     '--global',
     'Install hook globally for all repositories (sets git config --global core.hooksPath)',
   )
-  .action((options: IntegrateGitOptions) => runCommand(() => integrateGit(options)));
+  .authenticatedAction((auth, options: IntegrateGitOptions) => integrateGit(options, auth));
 
 // List Sonar resources
 const list = COMMAND_TREE.command('list').description('List Sonar resources');

src/cli/commands/_common/discovery.ts

@@ -162,7 +162,7 @@ export async function discoverProject(startDir: string): Promise<DiscoveredProje
   return config;
 }
 
-function findGitRoot(startDir: string): { gitRoot: string; isGit: boolean } {
+export function findGitRoot(startDir: string): { gitRoot: string; isGit: boolean } {
   let dir = startDir;
 
   for (;;) {

src/cli/commands/_common/git-repo.ts

@@ -0,0 +1,111 @@
+/*
+ * SonarQube CLI
+ * Copyright (C) 2026 SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+// Git repository abstraction for hook installation: root dir, hooks path, and framework detection.
+
+import { existsSync, statSync } from 'node:fs';
+import { isAbsolute, join } from 'node:path';
+import { CommandFailedError } from './error';
+import { spawnProcess } from '../../../lib/process';
+
+const PRE_COMMIT_CONFIG_FILE = '.pre-commit-config.yaml';
+export const toForwardSlash = (p: string) => p.replaceAll('\\', '/');
+
+/**
+ * Resolves the directory git uses for hooks (core.hooksPath or .git/hooks).
+ */
+export async function resolveGitHooksDir(root: string): Promise<string> {
+  let configResult;
+  try {
+    configResult = await spawnProcess('git', ['config', 'core.hooksPath'], { cwd: root });
+  } catch {
+    configResult = null;
+  }
+  if (configResult?.exitCode === 0) {
+    const configured = configResult.stdout.trim();
+    if (configured) {
+      return isAbsolute(configured) ? configured : join(root, configured);
+    }
+  }
+
+  const dotGit = join(root, '.git');
+  try {
+    if (statSync(dotGit).isDirectory()) {
+      return join(dotGit, 'hooks');
+    }
+  } catch {
+    // .git is a file (worktree) or missing — use git rev-parse
+  }
+
+  let result;
+  try {
+    result = await spawnProcess('git', ['rev-parse', '--git-path', 'hooks'], { cwd: root });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new CommandFailedError(`Failed to run git [${message}]`);
+  }
+  if (result.exitCode !== 0) {
+    const detail = [result.stderr, result.stdout].filter((s) => s.length > 0).join('\n');
+    throw new CommandFailedError(
+      `Could not resolve git hooks directory (exit code ${result.exitCode}) ${detail}`,
+    );
+  }
+  const resolved = result.stdout.trim();
+  return isAbsolute(resolved) ? resolved : join(root, resolved);
+}
+
+/**
+ * Represents a git repository at a given root. Use to decide hook installation strategy
+ * without resolving all state up front (e.g. only resolve hooks dir when not using pre-commit).
+ */
+export class GitRepo {
+  readonly rootDir: string;
+  private _hooksDir: Promise<string> | null = null;
+
+  constructor(rootDir: string) {
+    this.rootDir = rootDir;
+  }
+
+  /** True if the repo uses the pre-commit framework (.pre-commit-config.yaml). */
+  usesPreCommitFramework(): boolean {
+    return existsSync(join(this.rootDir, PRE_COMMIT_CONFIG_FILE));
+  }
+
+  private async getHooksDirOnce(): Promise<string> {
+    this._hooksDir ??= resolveGitHooksDir(this.rootDir);
+    return this._hooksDir;
+  }
+
+  /** True if git's hooks path points to .husky (Husky is in use). */
+  async usesHusky(): Promise<boolean> {
+    const hooksDir = await this.getHooksDirOnce();
+    return toForwardSlash(hooksDir).startsWith(toForwardSlash(join(this.rootDir, '.husky')));
+  }
+
+  /** Resolved git hooks directory (core.hooksPath or .git/hooks). */
+  async getHooksDir(): Promise<string> {
+    return this.getHooksDirOnce();
+  }
+
+  /** Path to the Husky hook file for the given hook name (e.g. 'pre-commit', 'pre-push'). */
+  getHuskyHookPath(hook: string): string {
+    return join(this.rootDir, '.husky', hook);
+  }
+}

src/cli/commands/analyze/secrets.ts

@@ -311,13 +311,9 @@ function handleScanFailure(
   }
 
   if (exitCode === EXIT_CODE_SECRETS_FOUND) {
-    error(`Secrets found (${scanDurationMs}ms)`);
-    logger.error(`Secrets found, exit code: ${exitCode}`);
     throw new CommandFailedError(`Secrets found (${scanDurationMs}ms)`, exitCode);
   }
 
-  error(`Scan error (exit code ${exitCode}, ${scanDurationMs}ms)`);
-  logger.error(`Scan failed with exit code: ${exitCode}`);
   throw new CommandFailedError(`Scan error (exit code ${exitCode})`, exitCode);
 }
 

src/cli/commands/integrate/git/git-husky.ts

@@ -23,20 +23,25 @@
 import { info, success } from '../../../../ui';
 import { HOOK_MARKER, getHuskySnippet } from './git-shell-fragments';
 import type { GitHookType } from '.';
+import { readFile, writeFile } from 'node:fs/promises';
 
 export async function installViaHusky(huskyHookPath: string, hook: GitHookType): Promise<void> {
-  const fs = await import('node:fs/promises');
   let content: string;
   try {
-    content = await fs.readFile(huskyHookPath, 'utf-8');
-  } catch {
-    content = '';
+    content = await readFile(huskyHookPath, 'utf-8');
+  } catch (error) {
+    const err = error as NodeJS.ErrnoException;
+    if (err.code === 'ENOENT') {
+      content = '';
+    } else {
+      throw error;
+    }
   }
   if (content.includes(HOOK_MARKER)) {
     info(`Secrets check already present in .husky/${hook}.`);
     return;
   }
   const newContent = content ? content.trimEnd() + getHuskySnippet(hook) : getHuskySnippet(hook);
-  await fs.writeFile(huskyHookPath, newContent, { encoding: 'utf-8', mode: 0o755 });
+  await writeFile(huskyHookPath, newContent, { encoding: 'utf-8', mode: 0o755 });
   success(`${hook} hook installed (Husky detected: added to .husky/${hook}).`);
 }

src/cli/commands/integrate/git/git-precommit-framework.ts

@@ -25,7 +25,7 @@ import { join } from 'node:path';
 import yaml from 'js-yaml';
 import { spawnProcess } from '../../../../lib/process';
 import { CommandFailedError } from '../../_common/error';
-import { error, success } from '../../../../ui';
+import { success } from '../../../../ui';
 import type { GitHookType } from '.';
 
 export const PRE_COMMIT_CONFIG_FILE = '.pre-commit-config.yaml';
@@ -113,10 +113,18 @@ export function upsertPreCommitConfig(root: string, stage: GitHookType): void {
 }
 
 async function runPreCommitCommand(args: string[], cwd: string): Promise<void> {
-  const result = await spawnProcess('pre-commit', args, { cwd });
+  let result;
+  try {
+    result = await spawnProcess('pre-commit', args, { cwd });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new CommandFailedError(`Failed to run pre-commit [${message}]`);
+  }
   if (result.exitCode !== 0) {
     const detail = [result.stderr, result.stdout].filter(Boolean).join('\n');
-    throw new Error(`pre-commit ${args.join(' ')} failed (exit code ${result.exitCode}) ${detail}`);
+    throw new CommandFailedError(
+      `pre-commit ${args.join(' ')} failed (exit code ${result.exitCode}) ${detail}`,
+    );
   }
 }
 
@@ -144,7 +152,6 @@ export async function installViaPreCommitFramework(root: string, hook: GitHookTy
     await runPreCommitInstall(root, hook);
   } catch {
     const errorMessage = `Updated ${PRE_COMMIT_CONFIG_FILE} but pre-commit commands failed. Install the pre-commit framework (e.g. pip install pre-commit) and run: pre-commit uninstall && pre-commit clean && pre-commit install${hook === 'pre-push' ? ' && pre-commit install --hook-type pre-push' : ''}`;
-    error(errorMessage);
     throw new CommandFailedError(errorMessage);
   }
   success(`${hook} hook installed (pre-commit framework: added to ${PRE_COMMIT_CONFIG_FILE}).`);