Skip to content

Enforce pre-commit in CI#76

Draft
bschwedler wants to merge 1 commit intomainfrom
add-pre-commit
Draft

Enforce pre-commit in CI#76
bschwedler wants to merge 1 commit intomainfrom
add-pre-commit

Conversation

@bschwedler
Copy link
Copy Markdown
Contributor

Summary

  • Adds .pre-commit-config.yaml with standard hooks
  • Adds a lint job to production.yml with SHA-pinned actions and permissions: contents: read, gated by the ci meta-job's needs:
  • Marks shell-script Jinja2 templates executable so rendered scripts inherit the exec bit via bakery's template-mode propagation
  • Drops the .jinja2 suffix from vscode-user-settings.json.jinja2 — the file had no Jinja2 syntax at all, matching the convention of its sibling positron-user-settings.json
  • Reformats the JSON to 2-space indent with alphabetized keys so pretty-format-json passes
  • Marks justfile executable + adds a setup recipe
  • check-executables-have-shebangs excludes *.sh.jinja2
  • pretty-format-json excludes .claude/settings.json

Merge dependency

Depends on posit-dev/images-shared#469 for bakery's template-mode propagation.

Test plan

  • pre-commit run --all-files passes locally on this branch
  • lint job in CI passes on this PR
  • Zizmor job passes (SHA pins satisfy the hash-pin policy)

Adds .pre-commit-config.yaml with standard hooks (check-json,
check-merge-conflict, check-yaml, check-executables-have-shebangs,
check-shebang-scripts-are-executable, end-of-file-fixer, trailing-
whitespace, pretty-format-json, shellcheck, actionlint, etc.) and an
inline `lint` job in production.yml gated by the `ci` meta-job's
`needs:`. Lint job uses SHA-pinned actions (checkout@v6.0.2,
setup-python@v5.6.0, pre-commit/action@v3.0.1) with
`permissions: contents: read` and `persist-credentials: false`.

Template and rendered-file changes to make pre-commit pass:
- Mark shell-script Jinja2 templates (*.sh.jinja2) executable so
  rendered scripts inherit the exec bit via bakery's template-mode
  propagation (posit-dev/images-shared#469)
- Mark justfile executable + add a `setup` recipe to install hooks
- Add `# shellcheck disable=SC2045`, `# shellcheck disable=SC2046`,
  and quoted variables across startup.sh.jinja2 and
  install_workbench.sh.jinja2
- Strip leading whitespace from `{% for %}`/`{% endfor %}`/`{% raw %}`
  blocks in goss.yaml template so rendered output doesn't regress into
  trailing whitespace on re-render
- Drop `.jinja2` suffix from vscode-user-settings.json.jinja2 (no
  Jinja2 syntax; matches positron-user-settings.json convention);
  reformat to 2-space indent with alphabetized keys so
  pretty-format-json passes
- Exclude *.sh.jinja2 from check-executables-have-shebangs
- Exclude .claude/settings.json from pretty-format-json

README: add `pre-commit` bullet to the Prerequisites list pointing
contributors at `just setup`.

Various trailing-newline and trailing-whitespace fixes across rendered
and non-rendered files surfaced by the new hooks.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant