ci: gate on prek, shared between pre-commit and CI#3
Merged
Conversation
The repo had no automated checks: every regression found so far was found
by hand. Add prek.toml as the single description of the gate, and a
workflow that installs the tools and defers to `prek run --all-files`.
CI owns no rules of its own, so the local hook and the pipeline cannot
drift; tightening a check is one line in one file.
Hooks: whitespace and line-ending hygiene, YAML/TOML validity, merge
markers, shellcheck, actionlint, gitleaks, and a parse of the script
under sh, bash, dash, zsh and ksh. That last one carries the weight: the
script is sourced, so a syntax error breaks the user's login shell rather
than failing a command, and the five-shell claim in the file header was
until now unverified.
shellcheck runs at --severity=warning with two exclusions. SC3043
(`local` is not POSIX) fires on nearly every helper and is accepted:
every shell the project targets implements it, and removing it would leak
helper variables into the user's interactive shell. SC3045 (`type -t`) is
a false positive — its only call site is inside an
`elif [ -n "${BASH_VERSION-}" ]` branch.
No third-party action is used. j178/prek-action does this in one line but
executes 2.4 MB of bundled JavaScript from both a `main:` and a `post:`
entry point, behind a mutable tag; the release tarball plus its published
SHA-256 gives the same result with a reviewable surface. actions/checkout
is pinned by commit SHA for the same reason.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The install step assumed prek ships its binary at the archive root, as gitleaks and actionlint do. It nests it under prek-x86_64-unknown-linux-musl/, so tar exited 2 with "prek: Not found in archive" after the checksum had already verified. Name the member and strip the leading component. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contexte
Le dépôt n'avait aucun contrôle automatisé — toutes les régressions trouvées jusqu'ici l'ont été à la main.
Chez
grob,prekest local-only et la CI a son propre job shellcheck : deux listes de règles qui dérivent l'une de l'autre. Ici la CI ne définit aucune règle : elle installe les outils puis délègue àprek run --all-files, qui lit le mêmeprek.tomlqueprek installbranche en pre-commit. Resserrer un contrôle = une ligne, un fichier, deux endroits couverts.Hooks
Hygiène (espaces, newline finale, fins de ligne), validité YAML/TOML, marqueurs de conflit,
shellcheck,actionlint,gitleaks, et le parsing du script sous sh, bash, dash, zsh, ksh.Ce dernier porte l'essentiel : le script est sourcé, donc une erreur de syntaxe casse le shell de login de l'utilisateur au lieu de faire échouer une commande — et la compatibilité 5 shells annoncée en tête de fichier n'était jusqu'ici vérifiée par rien.
Choix sur shellcheck
--severity=warningavec deux exclusions documentées :localnon POSIX) : ~70 occurrences. Accepté — les cinq shells visés l'implémentent, et s'en passer ferait fuiter chaque variable de helper dans le shell interactif de l'utilisateur. Le vrai garde-fou de portabilité est le hook 5 shells.type -t) : faux positif. Son unique site d'appel est dans une brancheelif [ -n "${BASH_VERSION-}" ], donc jamais exécutée hors bash. Vérifié : sous dash la branche n'est simplement pas prise, sans crash.Chaîne d'approvisionnement
Aucune action tierce.
j178/prek-actionferait le job en une ligne, mais :v2.0.6dist/index.cjs, 2,46 Mo de JS bundlémain:etpost:— du code tourne aussi après le jobRemplacé par le tarball de release amont + vérification du SHA-256 publié : même résultat, surface relisible.
actions/checkoutest épinglé par SHA de commit (d23441a…) et non par tag, pour la même raison.gitleaksetactionlintsont épinglés par version.Vérifications
prek run --all-files: 10/10 hooks verts en localactionlintsur le workflow : aucun problème.sha256publié en amontpermissions: contents: read,concurrencyavec annulation