Run no hook and no signature setting when a check makes its merge

A build machine's or a clone's git configuration must not run code or change
the merge a check judges (novox/hq ADR 0323).

internal/builder/check_merge_test.go

@@ -186,3 +186,27 @@ func gitOut(t *testing.T, dir string, args ...string) string {
 	}
 	return strings.TrimSpace(string(out))
 }
+
+// No hook runs when a check makes its merge: not one in the clone, whatever the build machine's git configuration says.
+func TestACheckMergeRunsNoHook(t *testing.T) {
+	repo, head, _ := aTrunkAndABranch(t, map[string]string{"a": "1"}, map[string]string{"b": "trunk"},
+		map[string]string{"c": "head"})
+	clone := filepath.Join(t.TempDir(), "clone")
+	if out, err := exec.Command("git", "clone", "--quiet", repo, clone).CombinedOutput(); err != nil {
+		t.Fatalf("%v\n%s", err, out)
+	}
+	ran := filepath.Join(t.TempDir(), "ran")
+	for _, hook := range []string{"pre-merge-commit", "commit-msg", "prepare-commit-msg", "post-merge"} {
+		if err := os.WriteFile(filepath.Join(clone, ".git", "hooks", hook),
+			[]byte("#!/bin/sh\necho "+hook+" >> "+ran+"\n"), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	m, err := mergeIntoTrunk(t.Context(), Command, clone, "main", head)
+	if err != nil || m.Merge == "" {
+		t.Fatalf("the merge was not made: %+v, %v", m, err)
+	}
+	if said, err := os.ReadFile(ran); err == nil {
+		t.Fatalf("a hook ran when the check made its merge: %s", said)
+	}
+}