53 lines
1.9 KiB
YAML
53 lines
1.9 KiB
YAML
name: pre-commit
|
|
|
|
on:
|
|
# pull_request_target instead of pull_request: the workflow definition and
|
|
# the hook config are always taken from the BASE branch, so fork /
|
|
# first-time-contributor PRs run immediately without a maintainer clicking
|
|
# "Approve and run". The PR head is checked out as data only.
|
|
pull_request_target:
|
|
branches: [main]
|
|
workflow_call:
|
|
inputs:
|
|
ref:
|
|
description: 'Git ref to checkout (defaults to github.ref)'
|
|
required: false
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
pre-commit:
|
|
if: github.event.pull_request.draft != true
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ inputs.ref || '' }}
|
|
# For PR events, lint the PR head — but keep the hook definitions from
|
|
# the base branch so an untrusted PR cannot alter what gets executed.
|
|
- name: Save trusted hook config
|
|
if: github.event_name == 'pull_request_target'
|
|
run: cp .pre-commit-config.yaml "$RUNNER_TEMP/trusted-pre-commit-config.yaml"
|
|
- uses: actions/checkout@v4
|
|
if: github.event_name == 'pull_request_target'
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha }}
|
|
persist-credentials: false
|
|
- name: Restore trusted hook config
|
|
if: github.event_name == 'pull_request_target'
|
|
run: cp "$RUNNER_TEMP/trusted-pre-commit-config.yaml" .pre-commit-config.yaml
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
- run: echo "::add-matcher::.github/workflows/matchers/actionlint.json"
|
|
- run: echo "::add-matcher::.github/workflows/matchers/mypy.json"
|
|
- run: echo "::add-matcher::.github/workflows/matchers/ruff.json"
|
|
- uses: pre-commit/action@v3.0.1
|
|
with:
|
|
extra_args: --all-files --hook-stage manual
|
|
# After pre-commit so a self-test failure cannot mask lint failures.
|
|
- name: Full-suite gate self-test
|
|
run: bash .github/scripts/test_gate_full_suite.sh
|