chore: centralize shared hooks and publish certkit@nightly cask

[danielewood]

Summary

• remove external/local pre-commit hook repos from .pre-commit-config.yaml
• keep hook execution centralized in https://github.com/sensiblebit/.github
• consume shared hooks from merged .github main commit ddffb3a (includes markdownlint hook + golangci cache-parity updates)
• reorder hook execution so dependency updates run first (go-mod-update, npm-update) before lint/build/test hooks
• add Nightly Cask workflow that updates Casks/certkit@nightly.rb in sensiblebit/homebrew-tap on every push to main
• nightly workflow builds multi-arch CLI tarballs, publishes them to the nightly prerelease tag, and updates cask checksums
• nightly workflow now uses concurrency control, secure tap checkout, bootstrap-safe change detection, and nightly macOS quarantine-clearing postflight
• nightly cask installs the same certkit command and declares conflicts_with cask: "certkit"
• record resulting pre-commit/dependency and nightly automation changes in CHANGELOG.md

Related

• Shared hook source PR (merged): sensiblebit/.github#2 — "chore: add shared markdownlint pre-commit hook"
• Shared hook cache parity PR (merged): sensiblebit/.github#3 — "ci: disable golangci cache and clean cache in hooks"

Runtime requirement

• Uses existing HOMEBREW_TAP_TOKEN secret to push updates to sensiblebit/homebrew-tap

Validation

• pre-commit run --all-files

[Copilot]

Pull request overview

Centralizes this repo’s pre-commit hook definitions by consuming them from the shared sensiblebit/.github repository, while keeping repo-specific markdownlint rules via .markdownlint.yaml.

Changes:

• Removed locally-defined/external hook repos from .pre-commit-config.yaml and switched to a single shared hook source (sensiblebit/.github).
• Added shared markdownlint hook invocation while preserving local configuration (--config .markdownlint.yaml).
• Updated CLAUDE.md’s documented configured-hook list to reflect the new setup (but it still needs to be brought fully in sync).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
CLAUDE.md	Updates documented pre-commit hook list (currently incomplete vs actual config).
.pre-commit-config.yaml	Removes local/external repos and pins all hooks to sensiblebit/.github, adding shared markdownlint with repo-specific config args.

[danielewood]

Addressed the review comments in commit 6089dba:

1. CLAUDE.md hook list sync

• Updated CLAUDE.md configured hooks line to include go-mod-update, npm-update, and govulncheck (and to match current order).

2. CHANGELOG for dependency-touching changes

• Added an Unreleased -> Changed entry for the pre-commit centralization + update-first flow and resulting dependency refresh.
• Added missing link reference [#128].

3. PR dependency/reference clarity

• Updated PR description Related section to explicitly reference the merged shared-hook PR with full repo-qualified link and title:
  • sensiblebit/.github#2 (merged)

Validation rerun:

• pre-commit run --all-files

[Copilot]

Pull request overview

Copilot reviewed 4 out of 6 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• web/package-lock.json: Language not supported

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 83717383b9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 6 out of 8 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• web/package-lock.json: Language not supported

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 615837d3c2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 621f34f572

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7f031524dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• web/package-lock.json: Language not supported

[Copilot]

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• web/package-lock.json: Language not supported

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.