name: Pre-commit Checks

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  workflow_dispatch:
  workflow_call:

# Cancel in-progress runs for the same branch
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  pre-commit:
    name: Run Pre-commit Hooks
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Install mise
        uses: jdx/mise-action@v3

      - name: Cache uv dependencies
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: "**/uv.lock"

      - name: Install dependencies
        run: uv sync --all-extras

      - name: Cache pre-commit hooks
        uses: actions/cache@v5
        with:
          path: ~/.cache/pre-commit
          key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
          restore-keys: |
            pre-commit-${{ runner.os }}-

      - name: Run pre-commit on all files
        env:
          # Skip hooks that don't work well in CI:
          # - no-commit-to-branch: Always fails in CI (we're on main/master)
          # - trufflehog: Has wasm/go-re2 panic bug in GitHub Actions environment
          # - safety: Skipped if SAFETY_API_KEY secret is not configured
          # Note: shellcheck, hadolint, trivy use mise-managed binaries which ARE
          # installed by mise-action above, so they should work in CI.
          SKIP: no-commit-to-branch,trufflehog${{ secrets.SAFETY_API_KEY == '' && ',safety' || '' }}
          # Safety CLI API key for dependency vulnerability scanning
          # Get your key at: https://safetycli.com/ (free account)
          # Add as repository secret: Settings → Secrets → Actions → SAFETY_API_KEY
          SAFETY_API_KEY: ${{ secrets.SAFETY_API_KEY }}
        run: uv run pre-commit run --all-files --show-diff-on-failure