chore: install pre-commit/pre-push git hooks - #96
Open
PenguinzTech wants to merge 1 commit into
Open
Conversation
Adds the PenguinTech-standard pre-commit framework config (hygiene, gitleaks, shellcheck, ruff, hadolint, actionlint, bandit, Dockerfile rootless check) plus the install-hooks/verify-hooks Makefile targets. Replaces the broken hand-rolled setup-git-hooks target (referenced a nonexistent scripts/git-hooks/pre-commit) and the flake8/black/isort config in pyproject.toml with the canonical ruff block. Also fixes an unrelated .gitignore bug where a bare `lib/` pattern was silently excluding scripts/lib/ from version control. Note: `pre-commit run --all-files` surfaces substantial pre-existing lint debt (876 ruff findings, mostly missing/malformed docstrings and hardcoded-test-credential S105/S106/S101 flags in test files; plus hadolint Dockerfile pin warnings and actionlint/shellcheck findings in existing workflows) that predates this change. Fixing it here would touch hundreds of unrelated files across ~25 in-flight feature branches, so it is intentionally out of scope for this hooks-install change and is reported separately as a follow-up.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.pre-commit-config.yaml): hygiene, gitleaks, shellcheck, ruff, hadolint, actionlint on pre-commit; bandit + Dockerfile-rootless check on pre-push.install-hooks/verify-hooksMakefile targets;make setupnow callsinstall-hooksinstead of the broken hand-rolledsetup-git-hooks(which referenced a nonexistentscripts/git-hooks/pre-commit).pyproject.toml's[tool.isort]/[tool.black]with the canonical[tool.ruff]block; updatesMakefile'ssetup-pythonto installruffinstead ofblack/isort/flake8..gitignorebug where a barelib/pattern silently excludedscripts/lib/from version control.Known blocker (not fixed here — out of scope)
pre-commit run --all-filessurfaces substantial pre-existing lint debt that predates this branch:D1xx/D4xx) and hardcoded-test-credential flags (S101/S105/S106) in test files.app-skeleton/Dockerfileandservices/flask-backend/Dockerfile..github/workflows/build.ymlandversion-release.yml.This was not fixed in this PR because it touches hundreds of unrelated files across ~25 in-flight feature branches off this release branch — a dedicated cleanup PR is the safer path. The hook mechanism itself is verified working (real
git commit/git pushtriggered the actual hooks, not justpre-commit run).Test plan
make install-hooks— hooks registered, config validatesmake verify-hooks— pre-commit + pre-push both report installedgit committriggered the pre-commit hook (not justpre-commit run --all-files)git pushtriggered the pre-push hook