pre-commit.yaml

---

name: Common issues check

on:
  pull_request:

permissions:
  contents: read

jobs:
  pre-commit:
    permissions:
      contents: write  # for pre-commit/action to push back fixes to PR branch
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
    - run: >-
        git fetch --no-tags --prune --depth=1 origin
        +refs/heads/*:refs/remotes/origin/*

    - name: Get changed files
      id: file_changes
      run: |
        export DIFF=$(git diff --name-only origin/${{ github.base_ref }} ${{
          github.sha
        }})
        echo "Diff between ${{ github.base_ref }} and ${{ github.sha }}"
        echo "files=$( echo "$DIFF" | xargs echo )" >> $GITHUB_OUTPUT

    - name: Install shfmt
      run: >-
        curl -L "$(
        curl -s https://api.github.com/repos/mvdan/sh/releases/latest
        | grep -o -E -m 1 "https://.+?linux_amd64"
        )"
        > shfmt
        && chmod +x shfmt && sudo mv shfmt /usr/bin/

    - name: Install shellcheck
      run: |
        sudo apt update && sudo apt install shellcheck

    - name: Install hadolint
      run: >-
        curl -L "$(
        curl -s https://api.github.com/repos/hadolint/hadolint/releases/latest
        | grep -o -E -m 1 "https://.+?/hadolint-Linux-x86_64"
        )"
        > hadolint
        && chmod +x hadolint && sudo mv hadolint /usr/bin/
    # Need to success pre-commit fix push
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        fetch-depth: 0
        ref: ${{ github.event.pull_request.head.sha }}
    # Skip terraform_tflint which interferes to commit pre-commit auto-fixes
    # yamllint disable-line rule:line-length
    - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b  # v5.3.0
      with:
        python-version: '3.9'
    - name: Execute pre-commit
      uses: pre-commit/action@9b88afc9cd57fd75b655d5c71bd38146d07135fe  # v2.0.3
      env:
        SKIP: no-commit-to-branch,hadolint
      with:
        token: ${{ secrets.GITHUB_TOKEN }}
        extra_args: >-
          --color=always
          --show-diff-on-failure
          --files ${{ steps.file_changes.outputs.files }}
    # Run only skipped checks
    - name: Execute pre-commit check that have no auto-fixes
      if: always()
      uses: pre-commit/action@9b88afc9cd57fd75b655d5c71bd38146d07135fe  # v2.0.3
      env:
        SKIP: >-
          check-added-large-files,
          check-merge-conflict,
          check-vcs-permalinks,
          forbid-new-submodules,
          no-commit-to-branch,
          end-of-file-fixer,
          trailing-whitespace,
          check-yaml,
          check-merge-conflict,
          check-executables-have-shebangs,
          check-case-conflict,mixed-line-ending,
          detect-aws-credentials,
          detect-private-key,
          shfmt,
          shellcheck,
      with:
        extra_args: >-
          --color=always
          --show-diff-on-failure
          --files ${{ steps.file_changes.outputs.files }}