chore: add commit hooks

[boneskull]

This change:

• adds a pre-commit hook that runs eslint --fix on any JS file on the stage.
• adds a commit message check that verifies the commit message is in conventional commits format.
• adds a new CI workflow to check commit messages in pull requests which target main

We will definitely want this if we want better automation of our releases. Please see these docs for more info about commitlint and how we can further configure it. I have created a configuration which adopts the conventional commits format but also relaxes some of the more pedantic default rules.

Note: I'm unsure if using a prepare script is OK here. This command tells husky to install the hooks into the .git/ directory, and is only run in a development environment upon npm install

[boneskull]

Current dependencies on/for this PR:

• main
  • PR chore: replace yarn with npm #629
    • PR fix(lavamoat): allow prefixed builtins #653
    • PR chore: normalize test config #643
      • PR feat(core): add a schema for policy files #620
    • PR chore: add commit hooks #632 👈
    • PR chore: reconfigure lerna for releases #631
    • PR chore(ci): add a release-please configuration #630
    • PR chore: consolidate eslint config #627
      • PR chore(deps): remove @metamask/eslint-config-nodejs #639
      • PR feat(allow-scripts): generate & ship typescript declarations #617

This comment was auto-generated by Graphite.

[naugtur]

prepare runs on publishing too. Why not postinstall?

sidenote: husky is fairly complex. Do we need more than https://www.npmjs.com/package/pre-commit ?
(edit)
Oh, wait - pre-commit won't handle checking the message. nevermind

[legobeat]

I went for https://github.com/toplenboren/simple-git-hooks last time I had to pick one FWIW. pre-commit drags along a bit too much deps too be worth it imo.

[naugtur]

sounds good. husky is also fine.

Let's address the lifecycle script choice though.

[boneskull]

I think you may be right about postinstall if we want to avoid husky install on publish--but only because we're in a workspace root. prepare should probably be calling npm run rebuild instead of preversion, then.

wait, because we have allow-scripts configured, it doesn't run automatically anyway.

anyhow, I've changed it to this:

• postinstall runs husky install
• prepare runs rebuild, which calls the rebuild script in workspaces where it is extant
• preversion removed
• add $root = true to allowScripts config

[naugtur]

+1 to running it as early as possible, not only for things targeting master.
This may occasionally be annoying when doing messy experiments, but it's totally worth it.

[boneskull]

lol, I just reverted this. I'm not sure it is worth it, honestly. but I'll put it back.

note that it does not run on push because, well, if you've pushed to main it's too late anyway. maybe we need a branch protection rule (if we don't have one already) that disallows direct pushes to main.

[naugtur]

Please add a section to the README documenting the commit convention matching commitlint.config.js

[boneskull]

Here's an example of the commitlint job running: https://github.com/LavaMoat/LavaMoat/actions/runs/5685783177/job/15411381654?pr=632