From e4e5daf6c647b300646f8adac9790c6c1dff6cf9 Mon Sep 17 00:00:00 2001 From: Chris Taylor Date: Fri, 29 May 2026 14:10:33 -0500 Subject: [PATCH 1/3] feat: add reusable pre-commit workflow --- .../pull-request-precommit-checks.yml | 66 +------------- .../workflows/reusable-pre-commit-checks.yml | 90 +++++++++++++++++++ docs/reusable-pre-commit-checks.md | 60 +++++++++++++ 3 files changed, 152 insertions(+), 64 deletions(-) create mode 100644 .github/workflows/reusable-pre-commit-checks.yml create mode 100644 docs/reusable-pre-commit-checks.md diff --git a/.github/workflows/pull-request-precommit-checks.yml b/.github/workflows/pull-request-precommit-checks.yml index 5cffca1..a20d2c3 100644 --- a/.github/workflows/pull-request-precommit-checks.yml +++ b/.github/workflows/pull-request-precommit-checks.yml @@ -9,69 +9,7 @@ jobs: pre-commit: name: Pre-Commit Checks permissions: - pull-requests: read contents: read + pull-requests: read statuses: write - runs-on: ubuntu-latest - steps: - - id: checkout - name: Checkout code - uses: actions/checkout@v6 - - - id: setup-python - name: Set up Python 3.14 - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b - with: - python-version: 3.14 - - - id: install-tools - name: Install Tools with uv - run: | - uv tool install pre-commit --with pre-commit-uv - - # If we've cached the pre-commit environment, restore it based on the hash of the pre-commit config. - - id: cache - name: Restore cached pre-commit environment - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae - with: - path: ~/.cache/pre-commit - key: ${{ runner.os }}-pre-commit-${{ hashFiles('.pre-commit-config.yaml') }} - - id: setup-asdf - name: Setup ASDF - uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47 - - - id: restore-asdf-tools - name: Restore ASDF tools from cache - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae - with: - key: ${{ runner.os }}-asdf-${{ hashFiles('.tool-versions') }} - restore-keys: | - ${{ runner.os }}-asdf- - path: | - ~/.asdf/plugins - ~/.asdf/installs - - - id: install-asdf - name: Install ASDF tools on cache-miss - if: ${{ steps.restore-asdf-tools.outputs.cache-hit != 'true' }} - uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 - - - id: asdf-reshim - name: Reshim installed ASDF tools - run: asdf reshim - - - id: pre-commit - name: Run pre-commit checks - run: uv run pre-commit run --all-files - - - id: set-status-check - name: Set Status Check - if: always() - uses: launchbynttdata/launch-workflows/.github/actions/update-status-check@edddecdce4590f94f30d0fdfdf991d8a692fe8dd - with: - check_name: "Pre-Commit Checks" - status: ${{ steps.pre-commit.outcome == 'success' && 'success' || - steps.pre-commit.outcome == 'failure' && 'failure' || 'error' }} - description: "Pre-Commit Checks ${{steps.pre-commit.outcome }}" - target_url: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ - github.run_id }}" + uses: ./.github/workflows/reusable-pre-commit-checks.yml diff --git a/.github/workflows/reusable-pre-commit-checks.yml b/.github/workflows/reusable-pre-commit-checks.yml new file mode 100644 index 0000000..8ad3ee2 --- /dev/null +++ b/.github/workflows/reusable-pre-commit-checks.yml @@ -0,0 +1,90 @@ +name: Dependabot Auto-Merge + +on: + workflow_call: + inputs: + # Placeholder input: this workflow currently takes no real inputs, but + # `workflow_call` requires the `inputs` map to be present. + _placeholder: + description: "Unused. Reserved for future use; do not set." + required: false + type: string + default: "" + +permissions: + contents: read + pull-requests: read + statuses: write + +jobs: + pre-commit: + name: Pre-Commit Checks + permissions: + contents: read + pull-requests: read + statuses: write + runs-on: ubuntu-latest + steps: + - id: checkout + name: Checkout code + uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 + + - id: setup-python + name: Set up Python 3.14 + uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b + with: + python-version: 3.14 + + - id: install-tools + name: Install Tools with uv + run: | + uv tool install pre-commit --with pre-commit-uv + + # If we've cached the pre-commit environment, restore it based on the hash of the pre-commit config. + - id: cache + name: Restore cached pre-commit environment + uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae + with: + path: ~/.cache/pre-commit + key: ${{ runner.os }}-pre-commit-${{ hashFiles('.pre-commit-config.yaml') }} + + - id: setup-asdf + name: Setup ASDF + uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47 + + - id: restore-asdf-tools + name: Restore ASDF tools from cache + uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae + with: + key: ${{ runner.os }}-asdf-${{ hashFiles('.tool-versions') }} + restore-keys: | + ${{ runner.os }}-asdf- + path: | + ~/.asdf/plugins + ~/.asdf/installs + + - id: install-asdf + name: Install ASDF tools on cache-miss + if: ${{ steps.restore-asdf-tools.outputs.cache-hit != 'true' }} + uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 + + - id: asdf-reshim + name: Reshim installed ASDF tools + run: asdf reshim + + - id: pre-commit + name: Run pre-commit checks + run: | + uv run pre-commit run --all-files + + - id: set-status-check + name: Set Status Check + if: always() + uses: launchbynttdata/launch-workflows/.github/actions/update-status-check@edddecdce4590f94f30d0fdfdf991d8a692fe8dd + with: + check_name: "Pre-Commit Checks" + status: ${{ steps.pre-commit.outcome == 'success' && 'success' || + steps.pre-commit.outcome == 'failure' && 'failure' || 'error' }} + description: "Pre-Commit Checks ${{steps.pre-commit.outcome }}" + target_url: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ + github.run_id }}" diff --git a/docs/reusable-pre-commit-checks.md b/docs/reusable-pre-commit-checks.md new file mode 100644 index 0000000..b0099fa --- /dev/null +++ b/docs/reusable-pre-commit-checks.md @@ -0,0 +1,60 @@ +# Pre-Commit Checks + +Runs the repository's [`pre-commit`](https://pre-commit.com/) hooks against all files in CI. This is useful for enforcing linting, formatting, and other repository-defined checks on every pull request without relying on contributors to have a working local `pre-commit` install. + +The workflow uses [`uv`](https://docs.astral.sh/uv/) (via [`astral-sh/setup-uv`](https://github.com/astral-sh/setup-uv)) to install and run `pre-commit` with the [`pre-commit-uv`](https://github.com/tox-dev/pre-commit-uv) plugin, and [`asdf`](https://asdf-vm.com/) (via [`asdf-vm/actions`](https://github.com/asdf-vm/actions)) to provision any additional tools declared in a `.tool-versions` file at the repository root. Both the `pre-commit` environment and `asdf`-installed tools are cached between runs to keep execution fast. + +On completion, the workflow publishes a `Pre-Commit Checks` commit status to the head SHA via the [`update-status-check`](../.github/actions/update-status-check) action so the result is visible on the pull request even when the underlying job is skipped or re-run. + +## Usage + +Add the following workflow to your repository (suggested name: `.github/workflows/pull-request-precommit-checks.yml`): + +```yaml +name: Pre-Commit Checks + +on: + pull_request: + types: [opened, reopened, synchronize, ready_for_review] + branches: [main] + +jobs: + pre-commit: + name: Pre-Commit Checks + permissions: + contents: read + pull-requests: read + statuses: write + uses: launchbynttdata/launch-workflows/.github/workflows/reusable-pre-commit-checks.yml@ref +``` + +Be sure you replace `ref` with an appropriate ref to this repository. + +Your repository must contain a valid `.pre-commit-config.yaml` at the root. If additional CLI tooling is required by your hooks (e.g. `terraform`, `tflint`, `terragrunt`), declare it in a `.tool-versions` file at the repository root and `asdf` will install it before the hooks run. + +> [!CAUTION] +> By default, we are not enforcing pre-commit as a required quality gate to merge PRs into _most_ repositories. This will change as we finish migrating to the new workflows and pre-commit runs in more places. +> +> If you need to enforce this on a particular repository in the meantime, reach out to an Organization Admin (generally via Slack) and have them add your repository to the [pre-commit-checks-validation](https://github.com/organizations/launchbynttdata/settings/rules/15529245) branch protection rule. + +To make this workflow required, visit your repository's settings and create a new Ruleset with a required status check pointing at `Pre-Commit Checks`. + +## Inputs + +| Input | Type | Required | Default | Description | +|-------|------|----------|---------|-------------| +| `_placeholder` | `string` | No | `""` | Unused. Reserved for future use; do not set. | + +## Secrets + +This workflow does not consume any secrets. + +## Required Permissions + +The calling workflow must grant the following permissions: + +| Permission | Level | Reason | +|------------|-------|--------| +| `contents` | `read` | Check out the repository at the PR head. | +| `pull-requests` | `read` | Read PR metadata when invoked from a `pull_request` event. | +| `statuses` | `write` | Publish the `Pre-Commit Checks` commit status to the head SHA. | From 715c9cef89197f95da09f2f7b383b0c18bc32f9b Mon Sep 17 00:00:00 2001 From: Chris Taylor <132399041+chris11-taylor-nttd@users.noreply.github.com> Date: Mon, 1 Jun 2026 08:28:25 -0500 Subject: [PATCH 2/3] fix: workflow name Missed this during copy/paste cleanup. Signed-off-by: Chris Taylor <132399041+chris11-taylor-nttd@users.noreply.github.com> --- .github/workflows/reusable-pre-commit-checks.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/reusable-pre-commit-checks.yml b/.github/workflows/reusable-pre-commit-checks.yml index 8ad3ee2..cc7664b 100644 --- a/.github/workflows/reusable-pre-commit-checks.yml +++ b/.github/workflows/reusable-pre-commit-checks.yml @@ -1,4 +1,4 @@ -name: Dependabot Auto-Merge +name: Pre-Commit Checks on: workflow_call: From 7de2dc4758e517e11af6630a6670e91c85b3bded Mon Sep 17 00:00:00 2001 From: Chris Taylor Date: Mon, 1 Jun 2026 09:17:23 -0500 Subject: [PATCH 3/3] fix: drop placeholder input --- .github/workflows/reusable-pre-commit-checks.yml | 8 -------- docs/reusable-pre-commit-checks.md | 4 +--- 2 files changed, 1 insertion(+), 11 deletions(-) diff --git a/.github/workflows/reusable-pre-commit-checks.yml b/.github/workflows/reusable-pre-commit-checks.yml index cc7664b..e6eb285 100644 --- a/.github/workflows/reusable-pre-commit-checks.yml +++ b/.github/workflows/reusable-pre-commit-checks.yml @@ -2,14 +2,6 @@ name: Pre-Commit Checks on: workflow_call: - inputs: - # Placeholder input: this workflow currently takes no real inputs, but - # `workflow_call` requires the `inputs` map to be present. - _placeholder: - description: "Unused. Reserved for future use; do not set." - required: false - type: string - default: "" permissions: contents: read diff --git a/docs/reusable-pre-commit-checks.md b/docs/reusable-pre-commit-checks.md index b0099fa..58686a0 100644 --- a/docs/reusable-pre-commit-checks.md +++ b/docs/reusable-pre-commit-checks.md @@ -41,9 +41,7 @@ To make this workflow required, visit your repository's settings and create a ne ## Inputs -| Input | Type | Required | Default | Description | -|-------|------|----------|---------|-------------| -| `_placeholder` | `string` | No | `""` | Unused. Reserved for future use; do not set. | +This workflow does not have any inputs. ## Secrets