mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Myasnikov DaniilandClaude Opus 4.8
a3f97e5a0c
Review feedback (non-blocking): - .pre-commit-config.yaml pinned zizmor at v1.22.0 while the CI gate installs 1.26.1; the zizmorcore/zizmor-pre-commit rev is the zizmor version 1:1, so the gap meant local and CI runs could differ. Align the hook to v1.26.1. - ui-test.yaml's checkout did not set persist-credentials: false, unlike the other two workflows hardened here (build-main.yaml, zizmor.yml). Set it so the token is not left in .git/config for the later pnpm install step to read. Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com> Assisted-By: Claude <noreply@anthropic.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
37 lines
1.5 KiB
YAML
37 lines
1.5 KiB
YAML
repos:
|
|
- repo: local
|
|
hooks:
|
|
- id: run-make-generate-root
|
|
name: Run 'make generate' at repo root
|
|
entry: |
|
|
flock -x .git/pre-commit.lock sh -c '
|
|
echo "Running make generate at repo root"
|
|
make generate || exit $?
|
|
git diff --color=always | cat
|
|
'
|
|
language: system
|
|
files: ^(api/|pkg/apis/|pkg/generated/|internal/crdinstall/manifests/|packages/system/cozystack-controller/definitions/|packages/system/application-definition-crd/definition/|packages/system/backup-controller/definitions/|packages/system/backupstrategy-controller/definitions/|hack/update-codegen\.sh$|hack/boilerplate\.go\.txt$|Makefile$)
|
|
pass_filenames: false
|
|
- id: run-make-generate
|
|
name: Run 'make generate' in all app directories
|
|
entry: |
|
|
flock -x .git/pre-commit.lock sh -c '
|
|
for dir in ./packages/apps/*/ ./packages/extra/*/; do
|
|
if [ -d "$dir" ]; then
|
|
echo "Running make generate in $dir"
|
|
make generate -C "$dir" || exit $?
|
|
fi
|
|
done
|
|
git diff --color=always | cat
|
|
'
|
|
language: system
|
|
files: ^.*$
|
|
# Lints changed GitHub Actions workflows for unpinned actions and excessive token
|
|
# permissions (audit scope is set in .github/zizmor.yml). Runs offline so it needs
|
|
# no GitHub token locally. The same gate runs tree-wide in .github/workflows/zizmor.yml.
|
|
- repo: https://github.com/zizmorcore/zizmor-pre-commit
|
|
rev: v1.26.1
|
|
hooks:
|
|
- id: zizmor
|
|
args: [--offline]
|