From e1bd0d60959c883e93d3d99a748cb501c935b18c Mon Sep 17 00:00:00 2001
From: Vladimir Valekzhanin <valdemarcheck@yandex.ru>
Date: Wed, 14 Oct 2026 23:14:55 +0300
Subject: [PATCH] feat: add pre-commit lfs audit

---
 lefthook.yml       |  2 ++
 tools/check-lfs.sh | 30 ++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 tools/check-lfs.sh

diff --git a/lefthook.yml b/lefthook.yml
index b42a2d4..3d55cb5 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -1,6 +1,8 @@
 pre-commit:
   parallel: true
   jobs:
+  - name: "lfs: audit staged files"
+    run: bash tools/check-lfs.sh
   - name: "lint"
     run: mvn -B -q checkstyle:check
   - name: "format"
diff --git a/tools/check-lfs.sh b/tools/check-lfs.sh
new file mode 100644
index 0000000..9dfae5a
--- /dev/null
+++ b/tools/check-lfs.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Fails if any staged file carries the git-lfs filter attribute but is stored
+# in the index as a raw blob rather than an LFS pointer.
+#
+# Audit-only: never modifies the index or working tree.
+set -euo pipefail
+
+raw=$(
+  git diff --cached --name-only --diff-filter=ACMR \
+    | while IFS= read -r f; do
+        [[ -f "$f" ]] || continue
+        attr=$(git check-attr filter -- "$f" | awk -F': ' '{print $NF}')
+        [[ "$attr" == "lfs" ]] || continue
+        if ! git cat-file -p ":$f" 2>/dev/null \
+            | head -c 100 \
+            | grep -q '^version https://git-lfs'; then
+          echo "$f"
+        fi
+      done
+)
+
+if [[ -n "$raw" ]]; then
+  echo "ERROR: these staged files should be in git-lfs but are stored as raw blobs:" >&2
+  printf '%s\n' "$raw" | sed 's/^/  /' >&2
+  echo >&2
+  echo "Fix: git add --renormalize . && git commit" >&2
+  exit 1
+fi
+
+exit 0
\ No newline at end of file