From b4fac0932f59e340dc64f2a1e2c8a771b6ac96be Mon Sep 17 00:00:00 2001
From: jedarden <github@jedarden.com>
Date: Sun, 17 May 2026 23:50:28 -0400
Subject: [PATCH] fix(pdftract-5z5d8): add pre-commit hook for provenance
 validation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add pre-commit hook that runs check-provenance.sh before each commit
to ensure fixture files always have valid provenance entries. Update
PROVENANCE.md with validation section documenting the hook usage.

Acceptance criteria:
- PROVENANCE.md exists with one row per fixture file ✓
- Every fixture file enumerated; no orphans ✓
- License column populated; only approved licenses ✓
- SHA256 column populated; matches actual content ✓
- check-provenance.sh validates manifest; CI gate green ✓
- Synthetic fixtures point at generation scripts ✓

Refs: pdftract-5z5d8

Co-Authored-By: Claude Code <noreply@anthropic.com>
---
 .git-hooks/pre-commit                 | 14 ++++++++++++++
 tests/fixtures/profiles/PROVENANCE.md | 20 ++++++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100755 .git-hooks/pre-commit

diff --git a/.git-hooks/pre-commit b/.git-hooks/pre-commit
new file mode 100755
index 0000000..e29ab3b
--- /dev/null
+++ b/.git-hooks/pre-commit
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Pre-commit hook: Validate fixture provenance before allowing commits.
+# This ensures every fixture file has a corresponding PROVENANCE.md entry.
+#
+# To install this hook:
+#   ln -s ../../.git-hooks/pre-commit .git/hooks/pre-commit
+# Or run: make install-hooks (if Makefile exists)
+
+set -e
+
+# Run the provenance validation script
+bash scripts/check-provenance.sh
+
+exit 0
diff --git a/tests/fixtures/profiles/PROVENANCE.md b/tests/fixtures/profiles/PROVENANCE.md
index 3ab477b..4858168 100644
--- a/tests/fixtures/profiles/PROVENANCE.md
+++ b/tests/fixtures/profiles/PROVENANCE.md
@@ -2,6 +2,26 @@
 
 This manifest tracks the origin and licensing of every fixture file in `tests/fixtures/`.
 
+## Validation
+
+A pre-commit hook automatically validates this manifest before each commit:
+
+```bash
+# Install the hook (one-time setup)
+ln -s ../../.git-hooks/pre-commit .git/hooks/pre-commit
+```
+
+The hook runs `scripts/check-provenance.sh` to ensure:
+- Every fixture file has a corresponding entry in this manifest
+- SHA256 hashes match the actual file content
+- All licenses are from the approved list
+
+To manually validate the manifest:
+
+```bash
+bash scripts/check-provenance.sh
+```
+
 ## Format
 
 | Path | Source URL | License | Downloaded Date | SHA256 | Notes |