pre-commit.yml

# Pre-commit - Runs all pre-commit hooks on all files
# Enforces shellcheck, gitleaks, markdownlint, and other hooks in CI
#
# Security hardening per NIST SR-3 (Supply Chain Controls and Processes; supersedes withdrawn SA-12) and AC-6 (Least Privilege)

name: Pre-commit

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
  merge_group:
    branches: [main]

concurrency:
  group: pre-commit-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  pre-commit:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
          # The bats suite (ADR-0025) lives in test/vendor/* submodules (bats-core,
          # bats-support, bats-assert), pinned by SHA. Fetch them so the bats hook
          # can run. Submodules are read-only test tooling.
          submodules: true
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: '3.12'
      # We double-check that shellcheck is here since the shellcheck hook needs it.
      - name: Verify shellcheck is available
        run: shellcheck --version
      # GNU parallel lets the bats suite (scripts/test-acq-bats) run test files
      # concurrently (~2x on the 2-core runner). ubuntu-latest usually ships it,
      # but install it explicitly so the parallel path is deterministic; the
      # runner falls back to serial if it is ever absent, so this is not fatal.
      - name: Ensure GNU parallel is available
        run: |
          if ! command -v parallel >/dev/null 2>&1; then
            sudo apt-get update && sudo apt-get install -y parallel
          fi
          parallel --version | head -1
      # Cache the pre-commit hook environments (node for markdownlint, etc.),
      # keyed on the config so a pin bump busts the cache.
      #
      # We invoke pre-commit directly rather than via pre-commit/action: that
      # composite pins a hardcoded actions/cache@v4 (Node.js 20), which GitHub is
      # deprecating and force-runs on Node 24 with a warning. Running the two
      # steps ourselves lets us use our SHA-pinned, Node-24 actions/cache above
      # and drops a third-party action from the supply chain (NIST SR-3).
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ~/.cache/pre-commit
          key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
          restore-keys: |
            pre-commit-${{ runner.os }}-
      - name: Install pre-commit
        run: python -m pip install pre-commit
      # The pinned Patterns provider-input validator is invoked by the offline
      # suite. Install and select setup-python's exact runtime instead of the
      # runner's ambient system interpreter.
      - name: Install Patterns provider-input validator dependencies
        run: |
          "$pythonLocation/bin/python" -m pip install --require-hashes --requirement scripts/provider-input-validator-requirements-linux.txt
          printf 'ACQ_PROVIDER_INPUT_PYTHON=%s\n' "$pythonLocation/bin/python" >> "$GITHUB_ENV"
      - name: Check out pinned Patterns validator contract
        run: |
          set -euo pipefail
          patterns_ref=$(sed -n 's/^PATTERNS_KIT_REF="\([0-9a-f]\{40\}\)"$/\1/p' acq.backends/common.sh)
          [ -n "$patterns_ref" ]
          patterns_dir="$RUNNER_TEMP/agentic-coding-patterns"
          git -C "$RUNNER_TEMP" init -q agentic-coding-patterns
          git -C "$patterns_dir" remote add origin https://github.com/GSA-TTS/agentic-coding-patterns.git
          git -C "$patterns_dir" fetch -q --depth 1 origin "$patterns_ref"
          git -C "$patterns_dir" checkout -q --detach FETCH_HEAD
          [ "$(git -C "$patterns_dir" rev-parse HEAD)" = "$patterns_ref" ]
          test -z "$(git -C "$patterns_dir" status --porcelain)"
          chmod -R a-w "$patterns_dir"
      - name: Install markdown linter dependencies
        run: npm ci --prefix .github/linters
      - name: Run pre-commit
        env:
          ACQ_TEST_PATTERNS_REPO: ${{ runner.temp }}/agentic-coding-patterns
          ACQ_TEST_PROVIDER_INPUT_PYTHON: ${{ env.pythonLocation }}/bin/python
          ACQ_BATS_TIMING: '1'
        run: pre-commit run --all-files --show-diff-on-failure --color=always --verbose