What problem does it solve? Repositories without a pinned toolchain and enforced gates suffer from locally-green/CI-red failures, skipped lint checks, and undetected committed secrets. This Skill establishes one canonical gate command (mise run check) that every agent and CI run executes against identical tool versions. ## Core Features & Use Cases - Pinned toolchain via mise: Pin every tool (language, linters, lefthook, betterleaks) in [tools] with exact versions matching CI, including tools absent from the mise registry via explicit github:/aqua: backends. - Hook enforcement via lefthook: Wire pre-commit (fast staged-file subset with {staged_files} and stage_fixed) and pre-push (heavier subset) hooks that workers cannot silently skip. - Secrets gate via betterleaks: Scan Git-visible files as a check leaf and pre-push hook with an explicit --config flag that defeats drop-in config neutering; keep full-history scans as a separate pre-publish step. - Worktree wave support: Handle the two propagation facts — shared .git/hooks but per-path mise trust — when running parallel waves in git worktrees. - Use Case: A wave of agents ships code that passes locally but fails CI because golangci-lint drifted from the CI action version; this Skill pins both together and adds a mutation test that fails on any future drift. ## Quick Start Set up this repository so that mise run check is the single enforced gate with pinned tools, lefthook hooks, and a betterleaks secrets scan.
