name: Pre-Commit Checks

on:

pull_request:

types: [opened, synchronize, reopened]

concurrency:

group: pre-commit-${{ github.workflow }}-${{ github.event.pull_request.number }}

cancel-in-progress: true

# Top-level token defaults to read-only. A job-level block replaces this one

# rather than adding to it, so each job restates every scope it needs.

permissions:

contents: read

jobs:

pre-commit:

runs-on: ubuntu-22.04

env:

# The pipe falls back to direct on any proxy error (hack/common-envs.mk).

GOPROXY: "https://proxy.golang.org|direct"

permissions:

contents: read

steps:

- name: Checkout code

uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3

with:

fetch-depth: 0

fetch-tags: true

- name: Set up Python

uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4

with:

python-version: '3.11'

- name: Install pre-commit

run: pip install pre-commit

- name: Set up Go

uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5

with:

go-version-file: go.mod

cache: true

- name: Pre-fetch k8s.io/code-generator module

# The repo-root pre-commit hook (run-make-generate-root) shells out to

# hack/update-codegen.sh, which sources kube_codegen.sh from the Go

# module cache. The module is not declared in go.mod, so fetch it

# explicitly at the version pinned in the script - mirrors the

# equivalent step in codegen-drift.yml.

run: |

version=$(grep -oP 'code-generator@\Kv[0-9.]+' hack/update-codegen.sh)

tmpdir=$(mktemp -d)

cd "$tmpdir"

go mod init codegen-fetch

go get "k8s.io/code-generator@${version}"

- name: Install generate

run: |

curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.7.0/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen

- name: Run pre-commit hooks

# The complete Bats pass is a manual local hook and is therefore outside

# this changed-file lint run. pull-requests.yaml's checks job runs the

# full unit path for code and the Bats contracts for docs-only changes.

run: |

git fetch origin main || git fetch origin master

base_commit=$(git rev-parse --verify origin/main || git rev-parse --verify origin/master || echo "")

if [ -z "$base_commit" ]; then

files=$(git ls-files '*.yaml' '*.md')

else

files=$(git diff --name-only "$base_commit" -- '*.yaml' '*.md')

fi

if [ -n "$files" ]; then

echo "$files" | xargs pre-commit run --files

else

echo "No YAML or Markdown files to lint"

fi

# Commit-message lint for the attribution rules in docs/agents/contributing.md

# that a reviewer would otherwise have to read `git log` to catch. It lives

# here rather than in the unit-test job of pull-requests.yaml, which is gated

# on the diff touching code and so skips a docs-only PR entirely; a trailer is

# wrong or right regardless of which files the commit changed.

commit-trailers:

name: Commit trailers

runs-on: ubuntu-22.04

permissions:

contents: read

# A backport PR is the one shape whose author cannot fix a finding: the

# backport action cherry-picks merged commits verbatim, so their messages

# are history, and roughly a quarter of the commits on main predate the

# rule. Matched on the branch name the action generates,

# backport-<pr>-to-<branch>, rather than on the prefix alone; the label that

# asks for a backport sits on the original PR, not on the generated one, so

# a branch name is the only signal a pull_request event carries. That makes

# the exemption a convention rather than something enforced: anyone can name

# a branch this way. Every other PR, fork included, is checked.

if: ${{ !(startsWith(github.head_ref, 'backport-') && contains(github.head_ref, '-to-')) }}

steps:

- name: Checkout head

uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

with:

ref: ${{ github.event.pull_request.head.sha }}

fetch-depth: 0

persist-credentials: false

- name: Check commit trailers

env:

BASE_REF: ${{ github.event.pull_request.base.ref }}

HEAD_SHA: ${{ github.event.pull_request.head.sha }}

run: |

set -euo pipefail

# The merge base, not the base branch tip: commits landing on the base

# branch while the PR is open are not this PR's to answer for. It is

# recomputed every run, so a rebased or force-pushed branch is read as

# it now is rather than as some earlier walk back from HEAD.

# origin/$BASE_REF is already here: fetch-depth 0 makes the checkout

# fetch +refs/heads/*:refs/remotes/origin/*.

base="$(git merge-base "$HEAD_SHA" "origin/$BASE_REF")"

# The checker is read from the base branch, never from the checked-out

# PR tree. A pull_request event takes the workflow definition from the

# merge of base and head, so the moment this job exists on the base

# branch it runs on every open PR — including the ones whose head

# predates the script, where reading it from the head would be exit

# 127 and a red check saying nothing about trailers. It also puts the

# checker out of reach of the PR being measured — the job around it

# is not, since the workflow definition comes from that same merge.

# Before the script exists on the base branch there is nothing to read

# there, so that one window runs the copy under review.

checker="$RUNNER_TEMP/check-commit-trailers.sh"

if git cat-file -e "origin/$BASE_REF:hack/check-commit-trailers.sh" 2>/dev/null; then

git show "origin/$BASE_REF:hack/check-commit-trailers.sh" > "$checker"

else

echo "::notice::checker absent from $BASE_REF; running the copy from this pull request"

cp hack/check-commit-trailers.sh "$checker"

fi

bash "$checker" "$base..$HEAD_SHA"