Skip to content

HYPERFLEET-1806 - ci: add pre-commit secondary checks #344

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rafabene wants to merge 5 commits into from
Closed

HYPERFLEET-1806 - ci: add pre-commit secondary checks #344

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
1517003
HYPERFLEET-1806 - ci: add pre-commit secondary checks
rafabene Oct 21, 2026
3b473e4
HYPERFLEET-1806 - ci: scope permissions and install project hooks
rafabene Oct 21, 2026
18f0062
HYPERFLEET-1806 - ci: keep generation only in the API workflow
rafabene Oct 21, 2026
9a664f2
HYPERFLEET-1806 - ci: cache compatible pre-commit environments
rafabene Oct 21, 2026
8e773a7
HYPERFLEET-1806 - ci: omit unnecessary Git hook registration
rafabene Oct 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 53 additions & 0 deletions .github/workflows/pre-commit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
name: pre-commit

on:
pull_request:

permissions: {}

concurrency:
group: pre-commit-${{ github.ref }}
cancel-in-progress: true

jobs:
pre-commit:
permissions:
contents: read
runs-on: ubuntu-24.04
timeout-minutes: 30
env:
CGO_ENABLED: "0"
PRE_COMMIT_VERSION: "4.6.2"
steps:
- name: Check out source
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Set up Go
id: go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache-dependency-path: |
go.sum
tools/go.sum

- name: Set up Python
id: python
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.12"

- name: Cache pre-commit environments

@pnguyen44 pnguyen44 Oct 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cache step only saves on success, so any run where the hooks fail throws away the environments it just built, and failing on unformatted code is this check's normal outcome, so fix-and-repush cycles rebuild from scratch every time. Consider splitting it into actions/cache/restore + actions/cache/save with if: always() per the upstream docs.

uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.cache/pre-commit
key: pre-commit-v1-${{ runner.os }}-${{ runner.arch }}-go${{ steps.go.outputs.go-version }}-py${{ steps.python.outputs.python-version }}-pc${{ env.PRE_COMMIT_VERSION }}-${{ hashFiles('.pre-commit-config.yaml') }}

- name: Install pre-commit
run: python -m pip install "pre-commit==${PRE_COMMIT_VERSION}"

# This runs pre-commit-stage hooks; PR-title validation stays in Prow.
- name: Run pre-commit hooks

@rh-amarin rh-amarin Oct 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tip

nit — non-blocking suggestion

Category: Pattern

The architecture CI integration guide (pre-commit-hooks.md, Step 4) recommends caching the pre-commit environment so LeakTK isn't recompiled on every run: "The first run compiles LeakTK (3-5 minutes) — cache to avoid recompilation on subsequent runs ... reduces subsequent runs from minutes to seconds." This repo's .pre-commit-config.yaml uses leaktk.git.pre-commit, so without the cache every PR run here recompiles it.

The setup-go cache only covers the Go module/build cache keyed on go.sum/tools/go.sum, not ~/.cache/pre-commit/. Consider adding a cache step before this one:

      - name: Cache pre-commit environment
        uses: actions/cache@<pinned-sha> # v4
        with:
          path: ~/.cache/pre-commit
          key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}

Not blocking — the workflow is correct as-is and stays within the 30-minute timeout; this just trims a few minutes off each run and follows the documented pattern.

@rafabene rafabene Oct 21, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added in 9a664f2, matching the equivalent API/Sentinel suggestions. The workflow now caches ~/.cache/pre-commit through a full-SHA pinned actions/cache release. The key includes runner OS/architecture, effective Go and Python versions, PRE_COMMIT_VERSION and the config hash, with no broad restore-key fallback. This preserves hook environments separately from setup-go’s module/build cache and avoids incompatible reuse after upgrades. Applied across all ten PRs, keeping the API-only generation exception. actionlint, YAML/structural checks and selected-file hooks passed; actual cache-hit/time savings have not yet been measured.

run: pre-commit run --all-files --show-diff-on-failure