ci: run pre-commit on pull requests (#18)

## What / why

This repo ships a `.pre-commit-config.yaml` whose hooks were not
consistently enforced. This PR makes the pre-commit hooks run reliably
in CI and green.

## Changes

### 1. `ci: skip: [go-fmt, go-vet]` in `.pre-commit-config.yaml`
This is the key fix. Go formatting/vetting is **already enforced by the
golangci-lint workflow (`lint.yml`)**, and the
`dnephin/pre-commit-golang` **`go-vet` hook is broken for this repo's
layout** — it fails with `no Go files in <root>` because the packages
live in subdirectories under a single root `go.mod`. Skipping both Go
hooks on pre-commit.ci makes that status green; Go quality stays covered
by golangci-lint.

### 2. A native `pre-commit` GitHub Actions workflow
Runs `uvx pre-commit run --all-files --show-diff-on-failure` via
`astral-sh/setup-uv` on PRs and pushes to `main` (pre-commit.ci only
covers PRs). Read-only, SHA-pinned, caches `~/.cache/pre-commit`. It
uses `SKIP: go-fmt,go-vet` for the same reason as above. (If you'd
rather rely solely on pre-commit.ci, this workflow can be dropped — the
`ci: skip` change above is the essential part.)

### 3. check-yaml multi-document support
Added `args: [--allow-multiple-documents]` — the repo's k8s manifests
(`config/manager/manager.yaml`, `deploy/install.yaml`,
`examples/git-sync-sidecar/notebook.yaml`) are valid multi-document YAML
that the default hook rejected.

### 4. Mechanical hook autofixes (previously unenforced)
- **ruff (auto):** removed unused imports (`F401`) in
`plugin/examples/with-cw.py`, `plugin/tests/test_status.py`; removed
extraneous f-string prefixes (`F541`) in
`plugin/kubectl_marimo/deploy.py`.
- **ruff (manual, trivial):** dropped an unused `mock_echo` assignment
(`F841`) in `plugin/tests/test_deploy.py` (kept the `mocker.patch(...)`
call).
- **whitespace/EOF fixers:** trailing blank line in
`.devcontainer/devcontainer.json`, missing trailing newline in
`hack/boilerplate.go.txt`.

### Verification (local, Go hooks skipped as scoped)

```
trim trailing whitespace.................................................Passed
fix end of files.........................................................Passed
check yaml...............................................................Passed
check for merge conflicts................................................Passed
ruff.....................................................................Passed
ruff-format..............................................................Passed
go fmt..................................................................Skipped
go vet..................................................................Skipped
```

Part of the marimo-team engineering-excellence initiative to make sure
every repo's declared quality gates actually run — and pass — in CI.

Author: mscolnick

.devcontainer/devcontainer.json

@@ -22,4 +22,3 @@
 
   "onCreateCommand": "bash .devcontainer/post-install.sh"
 }
-

.github/workflows/pre-commit.yml

@@ -0,0 +1,33 @@
+name: pre-commit
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    # The Go hooks (go-fmt, go-vet) are skipped here: Go formatting and vetting
+    # are already enforced by the golangci-lint workflow (lint.yml), and the
+    # dnephin/pre-commit-golang go-vet hook is incompatible with this repo's
+    # module layout (fails with "no Go files in <root>"). This job scopes
+    # pre-commit to the Python (ruff) and generic hooks that run reliably.
+    env:
+      SKIP: go-fmt,go-vet
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
+      - run: uvx pre-commit run --all-files --show-diff-on-failure

.pre-commit-config.yaml

@@ -1,10 +1,18 @@
+ci:
+  # Go formatting/vetting is enforced by the golangci-lint workflow (lint.yml).
+  # The dnephin/pre-commit-golang go-vet hook is also incompatible with this
+  # repo's single-root-go.mod layout (fails with "no Go files in <root>"), so
+  # skip both Go hooks on pre-commit.ci to keep it green.
+  skip: [go-fmt, go-vet]
+
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
       - id: check-yaml
+        args: [--allow-multiple-documents]
       - id: check-merge-conflict
 
   - repo: https://github.com/astral-sh/ruff-pre-commit

hack/boilerplate.go.txt

@@ -12,4 +12,4 @@ distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
-*/
+*/

plugin/examples/with-cw.py

@@ -14,7 +14,6 @@
 @app.cell
 def check_mount():
     import os
-    import subprocess
 
     # Check default mount location
     mount_dir = "/home/marimo/notebooks/mounts"

plugin/kubectl_marimo/deploy.py

@@ -122,11 +122,11 @@ def ensure_cw_credentials(namespace: str | None) -> bool:
         return False
 
     # Step 4: Show what we're about to do
-    click.echo(f"\nS3 Credentials:")
+    click.echo("\nS3 Credentials:")
     click.echo(f"  Namespace:    {ns_display}")
     click.echo(f"  Secret:       {secret_name} (will create)")
     click.echo(f"  Source:       ~/.s3cfg [{section}]")
-    click.echo(f"  Access Key:   ***")
+    click.echo("  Access Key:   ***")
 
     # Step 5: Confirm with user if in interactive terminal
     if sys.stdin.isatty():

plugin/tests/test_deploy.py

@@ -482,7 +482,7 @@ def test_uses_namespace_for_section_lookup(self, mocker, tmp_path):
         mocker.patch("os.path.expanduser", return_value=str(s3cfg))
         mocker.patch("os.path.exists", return_value=True)
         mocker.patch("sys.stdin.isatty", return_value=False)
-        mock_echo = mocker.patch("kubectl_marimo.deploy.click.echo")
+        mocker.patch("kubectl_marimo.deploy.click.echo")
 
         mock_result = mocker.Mock()
         mock_result.returncode = 0

plugin/tests/test_status.py

@@ -1,9 +1,7 @@
 """Tests for status command."""
 
 import json
-from pathlib import Path
 
-from click.testing import CliRunner
 
 from kubectl_marimo.status import show_status, format_elapsed