Sean P. KaneandGitHub
9dde1cef21
* feat: container vulnerability scanning * fix: Skip safety for dependabot
59 lines
1.9 KiB
YAML
59 lines
1.9 KiB
YAML
name: Pre-commit Checks
|
|
|
|
on:
|
|
push:
|
|
branches: [main, master]
|
|
pull_request:
|
|
branches: [main, master]
|
|
workflow_dispatch:
|
|
workflow_call:
|
|
|
|
# Cancel in-progress runs for the same branch
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
pre-commit:
|
|
name: Run Pre-commit Hooks
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Install mise
|
|
uses: jdx/mise-action@v3
|
|
|
|
- name: Cache uv dependencies
|
|
uses: astral-sh/setup-uv@v7
|
|
with:
|
|
enable-cache: true
|
|
cache-dependency-glob: "**/uv.lock"
|
|
|
|
- name: Install dependencies
|
|
run: uv sync --all-extras
|
|
|
|
- name: Cache pre-commit hooks
|
|
uses: actions/cache@v5
|
|
with:
|
|
path: ~/.cache/pre-commit
|
|
key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
|
|
restore-keys: |
|
|
pre-commit-${{ runner.os }}-
|
|
|
|
- name: Run pre-commit on all files
|
|
env:
|
|
# Skip hooks that don't work well in CI:
|
|
# - no-commit-to-branch: Always fails in CI (we're on main/master)
|
|
# - trufflehog: Has wasm/go-re2 panic bug in GitHub Actions environment
|
|
# - safety: Skipped if SAFETY_API_KEY secret is not configured
|
|
# Note: shellcheck, hadolint, trivy use mise-managed binaries which ARE
|
|
# installed by mise-action above, so they should work in CI.
|
|
SKIP: no-commit-to-branch,trufflehog${{ secrets.SAFETY_API_KEY == '' && ',safety' || '' }}
|
|
# Safety CLI API key for dependency vulnerability scanning
|
|
# Get your key at: https://safetycli.com/ (free account)
|
|
# Add as repository secret: Settings → Secrets → Actions → SAFETY_API_KEY
|
|
SAFETY_API_KEY: ${{ secrets.SAFETY_API_KEY }}
|
|
run: uv run pre-commit run --all-files --show-diff-on-failure
|