From dac8c616ce25a1b0aeebe17f4d7d4d224ed7ab6f Mon Sep 17 00:00:00 2001 From: Blair Hamilton Date: Wed, 2 Sep 2026 16:15:22 -0400 Subject: [PATCH] ci: run the org pre-commit advisory workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pre-commit-hooks carries a .pre-commit-config.yaml but had no CI job running it, so only the hooks that CI happened to duplicate had any backstop. The rest — gitleaks and detect-private-key among them — were enforced only by whoever remembered to run `pre-commit install`; anyone who had not, or who used --no-verify, had nothing checking them. This calls the org's reusable pre-commit-advisory workflow, the same one covenant, dis, dispatch, herald, k4a, k5s, legate, magellan, quorum, replay, trader-tools, trading and understudy already use. It is advisory by design: scoped to the PR diff, posts a sticky comment, and is not in branch protection, so it surfaces a failure without blocking merge. No `private-modules`: no Go module here. Worth noting this repo *hosts* the org's own hooks, so running pre-commit against itself is dogfooding the thing it publishes. pre-commit run --all-files is clean on main (8 hooks all passing), so this starts green. --- .github/workflows/ci.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 998784d..a53e658 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,6 +7,17 @@ on: branches: [main] jobs: + pre-commit: + # Runs on PRs (the actual advisory check) and on push to main + # (seeds ~/.cache/pre-commit into the default-branch cache scope + # so PR branches can restore from it — see + # pinpredict/.github/.github/workflows/pre-commit-advisory.yml). + if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main') + permissions: + contents: read + pull-requests: write + uses: pinpredict/.github/.github/workflows/pre-commit-advisory.yml@main + tests: runs-on: ubuntu-latest strategy: