pre-commit.yml

name: Pre-commit

on:
  pull_request:
    types: [opened, synchronize, reopened]

env:
  # Ensure pre-commit uses the right Python version
  PYTHON_VERSION: "3.11"
  # Skip hooks that are already running in other CI jobs to avoid redundant work
  # go-build-mod: Already runs in test.yml build job
  # golangci-lint: Already runs in codeql.yml lint-golangci job
  # lintroller: Already runs in codeql.yml lint-golangci job (via custom-gcl binary)
  SKIP: go-build-mod,golangci-lint,lintroller

jobs:
  pre-commit:
    name: Run pre-commit hooks
    runs-on:
      - runs-on=${{github.run_id}}
      - runner=terraform
      - tag=atmos
      - extras=s3-cache
      - private=false
    timeout-minutes: 15

    steps:
      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          # Fetch full history for proper diff checking
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Install Go tools
        run: |
          # Install gofumpt for pre-commit
          go install mvdan.cc/gofumpt@latest

          # Install golangci-lint v2
          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0

          # Add Go bin to PATH
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH

      - name: Download Go module dependencies
        run: |
          # Pre-download dependencies to prevent go mod tidy from trying to fetch internal packages
          go mod download

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Run CloudPosse pre-commit action
        uses: cloudposse/github-action-pre-commit@v4.0.0
        with:
          # Run against files changed in the PR only
          # This prevents formatting/checking unrelated files
          extra_args: --from-ref ${{ github.event.pull_request.base.sha }} --to-ref HEAD