fix(git): bypass external diff driver; preserve version pins and zizmor

- git: pass --no-ext-diff so difftastic/other diff.external drivers don't
  break --unified=0 parsing (was yielding zero ranges -> whole-file strip)
- config: add /regex/ preserve patterns; keep version pins (# v2.1.6) and
  zizmor: directives by default
- bump version to 0.4.2

cmd/shush/main.go

@@ -12,7 +12,7 @@ import (
 	"github.com/carlosarraes/shush/internal/types"
 )
 
-var version = "0.4.1"
+var version = "0.4.2"
 
 func main() {
 	var cliArgs types.CLI

internal/config/config.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 
 	"github.com/BurntSushi/toml"
@@ -74,6 +75,7 @@ func Default() *Config {
 			"hadolint",
 			"tflint",
 			"tfsec:",
+			"zizmor:",
 			"checkov:",
 			"yamllint",
 			"{-#",
@@ -84,6 +86,7 @@ func Default() *Config {
 			"buf:lint",
 			"@generated",
 			"DO NOT EDIT",
+			`/^#\s*v\d+(\.\d+)*$/`,
 		},
 		ContextLines: 3,
 	}
@@ -199,6 +202,14 @@ func (c *Config) ShouldPreserveComment(comment string) bool {
 
 func matchesPattern(text, pattern string) bool {
 
+	if len(pattern) >= 2 && strings.HasPrefix(pattern, "/") && strings.HasSuffix(pattern, "/") {
+		re, err := regexp.Compile(pattern[1 : len(pattern)-1])
+		if err != nil {
+			return false
+		}
+		return re.MatchString(text)
+	}
+
 	if strings.Contains(pattern, "*") {
 		return matchesWildcard(text, pattern)
 	}
@@ -250,7 +261,7 @@ func CreateExampleConfig() error {
 
 	var b strings.Builder
 	b.WriteString("# Shush Configuration\n")
-	b.WriteString("# Patterns to preserve in comments (supports wildcards with *)\n")
+	b.WriteString("# Patterns to preserve in comments (substring, * wildcards, or /regex/)\n")
 	b.WriteString("# Defaults below cover common lint/tool directives for supported languages.\n")
 	b.WriteString("preserve = [\n")
 	for _, p := range def.Preserve {

internal/config/config_test.go

@@ -48,6 +48,7 @@ func TestShouldPreserveDirectives(t *testing.T) {
 		"# credo:disable-for-next-line",
 		"// solhint-disable-next-line",
 		"# yamllint disable-line",
+		"# zizmor: ignore[template-injection] trusted infra-generated command",
 	}
 	for _, d := range directives {
 		if !cfg.ShouldPreserveComment(d) {
@@ -55,3 +56,32 @@ func TestShouldPreserveDirectives(t *testing.T) {
 		}
 	}
 }
+
+func TestShouldPreserveVersionPins(t *testing.T) {
+	cfg := Default()
+
+	preserved := []string{
+		"# v2.1.6",
+		"# v4",
+		"# v2.1",
+		"#v1.0.0",
+	}
+	for _, c := range preserved {
+		if !cfg.ShouldPreserveComment(c) {
+			t.Errorf("version pin not preserved by default: %q", c)
+		}
+	}
+
+	stripped := []string{
+		"# validate.this prose",
+		"# a regular note comment",
+		"# version bump",
+		"# 2.1.6",
+		"# v2 release notes",
+	}
+	for _, c := range stripped {
+		if cfg.ShouldPreserveComment(c) {
+			t.Errorf("non-version comment wrongly preserved: %q", c)
+		}
+	}
+}

internal/git/git.go

@@ -109,9 +109,9 @@ func GetUnstagedChanges() ([]FileChange, error) {
 func getLineRangesFromDiff(file string, staged bool) ([]LineRange, error) {
 	var cmd *exec.Cmd
 	if staged {
-		cmd = exec.Command("git", "diff", "--cached", "--unified=0", file)
+		cmd = exec.Command("git", "diff", "--no-ext-diff", "--cached", "--unified=0", file)
 	} else {
-		cmd = exec.Command("git", "diff", "--unified=0", file)
+		cmd = exec.Command("git", "diff", "--no-ext-diff", "--unified=0", file)
 	}
 
 	output, err := cmd.Output()

internal/git/git_test.go

@@ -1,9 +1,59 @@
 package git
 
 import (
+	"os"
+	"os/exec"
+	"path/filepath"
 	"testing"
 )
 
+func runGit(t *testing.T, dir string, args ...string) {
+	t.Helper()
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("git %v: %v\n%s", args, err, out)
+	}
+}
+
+func TestGetLineRangesFromDiffIgnoresExternalDiff(t *testing.T) {
+	dir := t.TempDir()
+	runGit(t, dir, "init", "-q")
+	runGit(t, dir, "config", "user.email", "t@t")
+	runGit(t, dir, "config", "user.name", "t")
+	runGit(t, dir, "config", "diff.external", "true")
+
+	path := filepath.Join(dir, "f.py")
+	if err := os.WriteFile(path, []byte("a = 1\nb = 2\nc = 3\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	runGit(t, dir, "add", "f.py")
+	runGit(t, dir, "commit", "-qm", "init")
+
+	if err := os.WriteFile(path, []byte("a = 1\nb = 2\nc = 3 changed\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.Chdir(wd)
+	if err := os.Chdir(dir); err != nil {
+		t.Fatal(err)
+	}
+
+	ranges, err := getLineRangesFromDiff("f.py", false)
+	if err != nil {
+		t.Fatalf("getLineRangesFromDiff: %v", err)
+	}
+
+	want := []LineRange{{Start: 3, End: 3}}
+	if len(ranges) != len(want) || ranges[0] != want[0] {
+		t.Fatalf("ranges = %v, want %v (external diff not bypassed)", ranges, want)
+	}
+}
+
 func TestParseGitDiffUnified(t *testing.T) {
 	tests := []struct {
 		name     string