From 988adb726db5ee6c89a0fb2d4dd9b40288a40fa5 Mon Sep 17 00:00:00 2001 From: mkultraWasHere Date: Sun, 26 Jul 2026 22:06:55 -0400 Subject: [PATCH 1/2] fix(ci): split pre-commit hooks into auto-fix (local) and check-only (CI) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit markdownlint --fix and terraform_validate both modify files on disk, which always reports "files were modified by this hook" in CI and fails the required status check. This is unfixable by committing locally because CI environments regenerate different artifacts (terraform lock hashes, .terraform/ dirs). Fix by splitting the CI run into two stages: 1. Default stage: runs all hooks except markdownlint and terraform_validate (skipped via SKIP env var) 2. Manual stage: runs markdownlint in check-only mode (no --fix) terraform_validate has no check-only counterpart — tflint already covers validation in CI. Local workflow is unchanged: `git commit` triggers auto-fix hooks as before. Co-Authored-By: Claude --- .github/workflows/pre-commit.yaml | 13 ++++++++++++- .pre-commit-config.yaml | 12 ++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml index c806a997..a1f7ec55 100644 --- a/.github/workflows/pre-commit.yaml +++ b/.github/workflows/pre-commit.yaml @@ -128,12 +128,23 @@ jobs: - name: Run pre-commit id: precommit + env: + # Skip hooks that auto-fix files — markdownlint (uses --fix) and + # terraform_validate (runs terraform init which writes .terraform/). + # Their check-only counterparts run in the next step. + SKIP: markdownlint,terraform_validate run: | pre-commit run --show-diff-on-failure --color=always --all-files + - name: Run check-only hooks + id: precommit-check + if: ${{ !cancelled() }} + run: | + pre-commit run --show-diff-on-failure --color=always --all-files --hook-stage manual + - name: Capture autofix patch id: capture - if: ${{ failure() && steps.precommit.outcome == 'failure' }} + if: ${{ failure() && (steps.precommit.outcome == 'failure' || steps.precommit-check.outcome == 'failure') }} run: | if git diff --quiet HEAD; then echo "pre-commit failed without modifying tracked files; no autofix possible" diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 837d3fd8..cfe532a1 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -47,8 +47,17 @@ repos: - repo: https://github.com/igorshubovych/markdownlint-cli rev: v0.49.1 hooks: + # Local: auto-fix markdown issues on commit. - id: markdownlint args: ['--fix', '--config', '.hooks/linters/markdownlint.json'] + stages: [pre-commit] + # CI: check-only (no file modifications) so the hook never reports + # "files were modified" in read-only CI environments. + - id: markdownlint + alias: markdownlint-check + name: markdownlint (check-only) + args: ['--config', '.hooks/linters/markdownlint.json'] + stages: [manual] - repo: https://github.com/ansible/ansible-lint rev: v26.6.0 @@ -74,6 +83,9 @@ repos: files: ^(modules|infra)/ - id: terragrunt_fmt files: ^infra/ + # Skipped in CI (SKIP=terraform_validate) because terraform init + # writes .terraform/ which triggers "files were modified". tflint + # covers validation in CI instead. - id: terraform_validate files: ^modules/ args: From 1e7f7dbeb3209a1de4914a3a0b692db580104f89 Mon Sep 17 00:00:00 2001 From: mkultraWasHere Date: Sun, 26 Jul 2026 22:21:21 -0400 Subject: [PATCH 2/2] =?UTF-8?q?fix:=20correct=20SKIP=20comment=20=E2=80=94?= =?UTF-8?q?=20only=20markdownlint=20has=20a=20check-only=20counterpart?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude --- .github/workflows/pre-commit.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml index a1f7ec55..dc701fc5 100644 --- a/.github/workflows/pre-commit.yaml +++ b/.github/workflows/pre-commit.yaml @@ -131,7 +131,8 @@ jobs: env: # Skip hooks that auto-fix files — markdownlint (uses --fix) and # terraform_validate (runs terraform init which writes .terraform/). - # Their check-only counterparts run in the next step. + # markdownlint's check-only counterpart runs in the next step; + # terraform_validate is covered by tflint instead. SKIP: markdownlint,terraform_validate run: | pre-commit run --show-diff-on-failure --color=always --all-files