Add validate result recording and GitHub commit status reporting

- ComputeTreeSHA: uses a temp index copy (GIT_INDEX_FILE) to compute the
  git tree SHA of the full worktree including untracked files, without
  touching the real index
- validate.CommandResult + SaveResults/LoadResults: persist per-command
  pass/fail results keyed to tree SHA in /tmp/chunk-run/trees/
- RunAll/RunNamed/RunInline now return ([]CommandResult, error)
- chunk validate records results after every local run
- chunk validate post-commit: reads stored results by HEAD^{tree} SHA
  and posts a GitHub commit status per command
- chunk init writes .git/hooks/post-commit to call post-commit automatically

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: webster

internal/cmd/init.go

@@ -14,6 +14,7 @@ import (
 	"github.com/CircleCI-Public/chunk-cli/internal/anthropic"
 	"github.com/CircleCI-Public/chunk-cli/internal/config"
 	"github.com/CircleCI-Public/chunk-cli/internal/gitremote"
+	"github.com/CircleCI-Public/chunk-cli/internal/gitutil"
 	"github.com/CircleCI-Public/chunk-cli/internal/iostream"
 	"github.com/CircleCI-Public/chunk-cli/internal/settings"
 	"github.com/CircleCI-Public/chunk-cli/internal/tui"
@@ -139,6 +140,36 @@ func writeSettingsExample(dir string, data []byte, streams iostream.Streams) err
 	return nil
 }
 
+const postCommitHookContent = "#!/bin/sh\nchunk validate post-commit\n"
+
+// writePostCommitHook writes .git/hooks/post-commit to call chunk validate post-commit.
+// Skips if the file already contains the hook. Warns if the file exists with different content.
+func writePostCommitHook(workDir string, streams iostream.Streams) error {
+	root, err := gitutil.RepoRoot(workDir)
+	if err != nil {
+		return fmt.Errorf("find repo root: %w", err)
+	}
+	hookPath := filepath.Join(root, ".git", "hooks", "post-commit")
+
+	existing, readErr := os.ReadFile(hookPath)
+	if readErr == nil {
+		if strings.Contains(string(existing), "chunk validate post-commit") {
+			return nil
+		}
+		streams.ErrPrintf("%s\n", ui.Warning(fmt.Sprintf("Skipping post-commit hook: %s already exists with different content", hookPath)))
+		return nil
+	}
+	if !errors.Is(readErr, fs.ErrNotExist) {
+		return fmt.Errorf("read post-commit hook: %w", readErr)
+	}
+
+	if err := os.WriteFile(hookPath, []byte(postCommitHookContent), 0o755); err != nil {
+		return fmt.Errorf("write post-commit hook: %w", err)
+	}
+	streams.ErrPrintln(ui.Success("Wrote .git/hooks/post-commit"))
+	return nil
+}
+
 var sidecarGitignoreEntries = []string{
 	".chunk/sidecar.json",
 	".chunk/sidecar.*.json",
@@ -282,11 +313,14 @@ hook config files.`,
 				streams.ErrPrintf("%s\n", ui.Warning(fmt.Sprintf("Could not update .gitignore: %v", err)))
 			}
 
-			// Step 3: Write .claude/settings.json
+			// Step 3: Write .claude/settings.json and git hooks
 			if !skipHooks {
 				if err := writeSettings(workDir, cfg.Commands, streams, tui.Confirm); err != nil {
 					return err
 				}
+				if err := writePostCommitHook(workDir, streams); err != nil {
+					streams.ErrPrintf("%s\n", ui.Warning(fmt.Sprintf("Could not write post-commit hook: %v", err)))
+				}
 			}
 
 			// Step 4: Shell completions

internal/cmd/validate.go

@@ -8,12 +8,15 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"os/exec"
 	"strings"
 
 	"github.com/spf13/cobra"
 	"golang.org/x/term"
 
 	"github.com/CircleCI-Public/chunk-cli/internal/config"
+	"github.com/CircleCI-Public/chunk-cli/internal/gitremote"
+	"github.com/CircleCI-Public/chunk-cli/internal/gitutil"
 	"github.com/CircleCI-Public/chunk-cli/internal/iostream"
 	"github.com/CircleCI-Public/chunk-cli/internal/sidecar"
 	"github.com/CircleCI-Public/chunk-cli/internal/tui"
@@ -141,7 +144,13 @@ func newValidateCmd() *cobra.Command {
 				}
 			}
 
-			execErr := runValidate(cmd.Context(), workDir, name, inlineCmd, save, sidecarID, identityFile, workdir, cfg, statusFn, streams)
+			results, execErr := runValidate(cmd.Context(), workDir, name, inlineCmd, save, sidecarID, identityFile, workdir, cfg, statusFn, streams)
+
+			if results != nil {
+				if treeSHA, treeErr := gitutil.ComputeTreeSHA(workDir); treeErr == nil {
+					_ = validate.SaveResults(treeSHA, results)
+				}
+			}
 
 			if hook != nil {
 				maxAttempts := cfg.StopHookMaxAttempts
@@ -164,12 +173,15 @@ func newValidateCmd() *cobra.Command {
 	cmd.Flags().BoolVar(&save, "save", false, "Save --cmd to .chunk/config.json")
 	cmd.Flags().StringVar(&projectDir, "project", "", "Override project directory")
 
+	cmd.AddCommand(newPostCommitCmd())
+
 	return cmd
 }
 
 // runValidate dispatches to the appropriate Run* function based on the
 // provided options. It is shared by both direct and hook invocations.
-func runValidate(ctx context.Context, workDir, name, inlineCmd string, save bool, sidecarID, identityFile, workdir string, cfg *config.ProjectConfig, statusFn iostream.StatusFunc, streams iostream.Streams) error {
+// Returns nil results for remote/sidecar runs (no result recording on those paths).
+func runValidate(ctx context.Context, workDir, name, inlineCmd string, save bool, sidecarID, identityFile, workdir string, cfg *config.ProjectConfig, statusFn iostream.StatusFunc, streams iostream.Streams) ([]validate.CommandResult, error) {
 	// --cmd: inline command
 	if inlineCmd != "" {
 		cmdName := name
@@ -178,16 +190,16 @@ func runValidate(ctx context.Context, workDir, name, inlineCmd string, save bool
 		}
 		if save {
 			if err := config.SaveCommand(workDir, cmdName, inlineCmd); err != nil {
-				return &userError{msg: "Could not save command to .chunk/config.json.", err: err}
+				return nil, &userError{msg: "Could not save command to .chunk/config.json.", err: err}
 			}
 			streams.ErrPrintf("%s\n", ui.Success(fmt.Sprintf("Saved %s to .chunk/config.json", cmdName)))
 		}
 		if sidecarID != "" {
 			execFn, dest, err := openSSHSession(ctx, sidecarID, identityFile, workdir, streams)
 			if err != nil {
-				return err
+				return nil, err
 			}
-			return validate.RunRemoteInline(ctx, execFn, cmdName, inlineCmd, dest, streams)
+			return nil, validate.RunRemoteInline(ctx, execFn, cmdName, inlineCmd, dest, streams)
 		}
 		return validate.RunInline(ctx, workDir, cmdName, inlineCmd, statusFn, streams)
 	}
@@ -196,16 +208,16 @@ func runValidate(ctx context.Context, workDir, name, inlineCmd string, save bool
 	if sidecarID != "" {
 		execFn, dest, err := openSSHSession(ctx, sidecarID, identityFile, workdir, streams)
 		if err != nil {
-			return err
+			return nil, err
 		}
-		return validate.RunRemote(ctx, execFn, cfg, name, dest, streams)
+		return nil, validate.RunRemote(ctx, execFn, cfg, name, dest, streams)
 	}
 
 	// Named command
 	if name != "" {
 		if cfg.FindCommand(name) == nil {
 			if !term.IsTerminal(int(os.Stdin.Fd())) {
-				return &userError{
+				return nil, &userError{
 					msg:        fmt.Sprintf("Command %q is not configured.", name),
 					suggestion: "Add it to .chunk/config.json.",
 					errMsg:     fmt.Sprintf("command %q is not configured", name),
@@ -216,28 +228,99 @@ func runValidate(ctx context.Context, workDir, name, inlineCmd string, save bool
 			streams.ErrPrintf("What command should %s run? ", ui.Bold(name))
 			scanner := bufio.NewScanner(os.Stdin)
 			if !scanner.Scan() {
-				return &userError{msg: "No command entered.", errMsg: "no input received"}
+				return nil, &userError{msg: "No command entered.", errMsg: "no input received"}
 			}
 			input := strings.TrimSpace(scanner.Text())
 			if input == "" {
 				streams.ErrPrintln(ui.Dim("No command entered, aborting."))
-				return &userError{msg: "No command entered.", errMsg: "no command entered"}
+				return nil, &userError{msg: "No command entered.", errMsg: "no command entered"}
 			}
 			if err := config.SaveCommand(workDir, name, input); err != nil {
-				return &userError{msg: "Could not save command to .chunk/config.json.", err: err}
+				return nil, &userError{msg: "Could not save command to .chunk/config.json.", err: err}
 			}
 			streams.ErrPrintf("%s\n", ui.Success(fmt.Sprintf("Saved %s to .chunk/config.json", name)))
 			var err error
 			cfg, err = config.LoadProjectConfig(workDir)
 			if err != nil {
-				return err
+				return nil, err
 			}
 		}
-		return mapValidateError(validate.RunNamed(ctx, workDir, name, cfg, statusFn, streams))
+		results, err := validate.RunNamed(ctx, workDir, name, cfg, statusFn, streams)
+		return results, mapValidateError(err)
 	}
 
 	// Run all
-	return mapValidateError(validate.RunAll(ctx, workDir, cfg, statusFn, streams))
+	results, err := validate.RunAll(ctx, workDir, cfg, statusFn, streams)
+	return results, mapValidateError(err)
+}
+
+func newPostCommitCmd() *cobra.Command {
+	var projectDir string
+
+	cmd := &cobra.Command{
+		Use:          "post-commit",
+		Short:        "Report validate results as GitHub commit statuses",
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			streams := iostream.FromCmd(cmd)
+			ctx := cmd.Context()
+
+			workDir := projectDir
+			if workDir == "" {
+				var err error
+				workDir, err = os.Getwd()
+				if err != nil {
+					return err
+				}
+			}
+
+			treeOut, err := exec.Command("git", "-C", workDir, "rev-parse", "HEAD^{tree}").Output()
+			if err != nil {
+				return fmt.Errorf("resolve HEAD tree: %w", err)
+			}
+			treeSHA := strings.TrimSpace(string(treeOut))
+
+			results, found, err := validate.LoadResults(treeSHA)
+			if err != nil {
+				return fmt.Errorf("load validate results: %w", err)
+			}
+			if !found {
+				return nil
+			}
+
+			commitOut, err := exec.Command("git", "-C", workDir, "rev-parse", "HEAD").Output()
+			if err != nil {
+				return fmt.Errorf("resolve HEAD: %w", err)
+			}
+			commitSHA := strings.TrimSpace(string(commitOut))
+
+			org, repo, err := gitremote.DetectOrgAndRepo(workDir)
+			if err != nil {
+				return fmt.Errorf("detect repo: %w", err)
+			}
+
+			ghClient, err := ensureGitHubClient(ctx, streams, tui.PromptHidden)
+			if err != nil {
+				return err
+			}
+
+			for _, r := range results {
+				state := "success"
+				if !r.Passed {
+					state = "failure"
+				}
+				if postErr := ghClient.CreateCommitStatus(ctx, org, repo, commitSHA, state, "chunk/"+r.Name, "chunk validate: "+r.Name); postErr != nil {
+					streams.ErrPrintf("  %s\n", ui.Warning(fmt.Sprintf("could not post status for %s: %v", r.Name, postErr)))
+					continue
+				}
+				streams.ErrPrintf("  %s %s/%s → %s\n", ui.Success("posted"), org, repo, r.Name)
+			}
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVar(&projectDir, "project", "", "Override project directory")
+	return cmd
 }
 
 // openSSHSession establishes an SSH session to the sidecar and returns an

internal/github/statuses.go

@@ -0,0 +1,28 @@
+package github
+
+import (
+	"context"
+	"fmt"
+
+	hc "github.com/CircleCI-Public/chunk-cli/internal/httpcl"
+)
+
+// CreateCommitStatus posts a commit status for the given SHA.
+// state must be one of: "pending", "success", "failure", "error".
+// statusContext is the check name shown in GitHub (e.g. "chunk/test").
+func (c *Client) CreateCommitStatus(ctx context.Context, owner, repo, sha, state, statusContext, description string) error {
+	body := map[string]string{
+		"state":       state,
+		"context":     statusContext,
+		"description": description,
+	}
+	req := hc.NewRequest("POST", "/repos/%s/%s/statuses/%s",
+		hc.RouteParams(owner, repo, sha),
+		hc.Body(body),
+	)
+	_, err := c.http.Call(ctx, req)
+	if err == nil {
+		return nil
+	}
+	return mapErr(fmt.Sprintf("create commit status %s", statusContext), err)
+}

internal/github/statuses_test.go

@@ -0,0 +1,52 @@
+package github_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/CircleCI-Public/chunk-cli/internal/github"
+	"gotest.tools/v3/assert"
+)
+
+func TestCreateCommitStatus(t *testing.T) {
+	var gotMethod, gotPath string
+	var gotBody map[string]string
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		gotPath = r.URL.Path
+		b, _ := io.ReadAll(r.Body)
+		_ = json.Unmarshal(b, &gotBody)
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer srv.Close()
+
+	c, err := github.New(github.Config{Token: "test-token", BaseURL: srv.URL})
+	assert.NilError(t, err)
+
+	err = c.CreateCommitStatus(context.Background(), "myorg", "myrepo", "abc123", "success", "chunk/test", "chunk validate: test")
+	assert.NilError(t, err)
+
+	assert.Equal(t, gotMethod, "POST")
+	assert.Equal(t, gotPath, "/repos/myorg/myrepo/statuses/abc123")
+	assert.Equal(t, gotBody["state"], "success")
+	assert.Equal(t, gotBody["context"], "chunk/test")
+	assert.Equal(t, gotBody["description"], "chunk validate: test")
+}
+
+func TestCreateCommitStatus_Error(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusUnprocessableEntity)
+	}))
+	defer srv.Close()
+
+	c, err := github.New(github.Config{Token: "test-token", BaseURL: srv.URL})
+	assert.NilError(t, err)
+
+	err = c.CreateCommitStatus(context.Background(), "org", "repo", "sha", "success", "chunk/test", "desc")
+	assert.Assert(t, err != nil)
+}

internal/gitutil/gitutil.go

@@ -2,6 +2,7 @@ package gitutil
 
 import (
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -102,6 +103,53 @@ func GeneratePatch(base string) (string, error) {
 	return string(out), nil
 }
 
+// ComputeTreeSHA computes the git tree SHA for the current worktree state
+// (including untracked files) without modifying the real index.
+// It copies the index to a temp file, stages all files into the copy,
+// and calls git write-tree against it.
+func ComputeTreeSHA(workDir string) (string, error) {
+	root, err := RepoRoot(workDir)
+	if err != nil {
+		return "", fmt.Errorf("compute tree sha: %w", err)
+	}
+
+	src, err := os.Open(filepath.Join(root, ".git", "index"))
+	if err != nil {
+		return "", fmt.Errorf("compute tree sha: open index: %w", err)
+	}
+	tmp, err := os.CreateTemp("", "chunk-index-*")
+	if err != nil {
+		_ = src.Close()
+		return "", fmt.Errorf("compute tree sha: create temp index: %w", err)
+	}
+	tmpPath := tmp.Name()
+	defer func() { _ = os.Remove(tmpPath) }()
+
+	if _, err := io.Copy(tmp, src); err != nil {
+		_ = src.Close()
+		_ = tmp.Close()
+		return "", fmt.Errorf("compute tree sha: copy index: %w", err)
+	}
+	_ = src.Close()
+	_ = tmp.Close()
+
+	indexEnv := "GIT_INDEX_FILE=" + tmpPath
+
+	addCmd := exec.Command("git", "-C", workDir, "add", "--all")
+	addCmd.Env = append(os.Environ(), indexEnv)
+	if out, err := addCmd.CombinedOutput(); err != nil {
+		return "", fmt.Errorf("compute tree sha: git add: %w: %s", err, out)
+	}
+
+	treeCmd := exec.Command("git", "-C", workDir, "write-tree")
+	treeCmd.Env = append(os.Environ(), indexEnv)
+	out, err := treeCmd.Output()
+	if err != nil {
+		return "", fmt.Errorf("compute tree sha: git write-tree: %w", err)
+	}
+	return strings.TrimSpace(string(out)), nil
+}
+
 func splitNonEmpty(s string) []string {
 	if s == "" {
 		return nil