pre-commit.yml

# Pre-commit - Runs all pre-commit hooks on all files
# Enforces shellcheck, gitleaks, markdownlint, and other hooks in CI
#
# Security hardening per NIST SR-3 (Supply Chain Controls and Processes; supersedes withdrawn SA-12) and AC-6 (Least Privilege)

name: Pre-commit

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

concurrency:
  group: pre-commit-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  pre-commit:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
          # The bats suite (ADR-0025) lives in test/vendor/* submodules (bats-core,
          # bats-support, bats-assert), pinned by SHA. Fetch them so the bats hook
          # can run. Submodules are read-only test tooling.
          submodules: true
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: '3.12'
      # We double-check that shellcheck is here since the shellcheck hook needs it.
      - name: Verify shellcheck is available
        run: shellcheck --version
      # GNU parallel lets the bats suite (scripts/test-acq-bats) run test files
      # concurrently (~2x on the 2-core runner). ubuntu-latest usually ships it,
      # but install it explicitly so the parallel path is deterministic; the
      # runner falls back to serial if it is ever absent, so this is not fatal.
      - name: Ensure GNU parallel is available
        run: |
          if ! command -v parallel >/dev/null 2>&1; then
            sudo apt-get update && sudo apt-get install -y parallel
          fi
          parallel --version | head -1
      # Cache the pre-commit hook environments (node for markdownlint, etc.),
      # keyed on the config so a pin bump busts the cache.
      #
      # We invoke pre-commit directly rather than via pre-commit/action: that
      # composite pins a hardcoded actions/cache@v4 (Node.js 20), which GitHub is
      # deprecating and force-runs on Node 24 with a warning. Running the two
      # steps ourselves lets us use our SHA-pinned, Node-24 actions/cache above
      # and drops a third-party action from the supply chain (NIST SR-3).
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ~/.cache/pre-commit
          key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
          restore-keys: |
            pre-commit-${{ runner.os }}-
      - name: Install pre-commit
        run: python -m pip install pre-commit
      - name: Run pre-commit
        run: pre-commit run --all-files --show-diff-on-failure --color=always