pre-commit.yml

name: Pre-commit Checks

on:
  workflow_dispatch:  # Manual triggering ONLY - automatic runs disabled
  # Automatic runs disabled - pre-commit hooks should run locally before commit
  # Re-enable when GitHub plan supports sufficient runner resources
  # push:
  #   branches: [master, main, develop]
  # pull_request:
  #   branches: [master, main, develop]

jobs:
  pre-commit:
    name: Run Pre-commit Hooks
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y shellcheck

      - name: Install Python dependencies
        run: |
          python -m pip install --upgrade pip
          pip install pre-commit

      - name: Cache pre-commit environments
        uses: actions/cache@v4
        with:
          path: ~/.cache/pre-commit
          key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
          restore-keys: |
            pre-commit-

      - name: Run pre-commit
        run: pre-commit run --all-files --show-diff-on-failure

      - name: Generate pre-commit summary
        if: always()
        run: |
          echo "## Pre-commit Check Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Pre-commit hooks executed on all files." >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Hooks Executed:" >> $GITHUB_STEP_SUMMARY
          echo "- Code formatting (Ruff, Prettier)" >> $GITHUB_STEP_SUMMARY
          echo "- Linting (Ruff, mypy, ESLint)" >> $GITHUB_STEP_SUMMARY
          echo "- Security checks (Gitleaks, Bandit)" >> $GITHUB_STEP_SUMMARY
          echo "- Shell script validation (shellcheck)" >> $GITHUB_STEP_SUMMARY
          echo "- Dockerfile linting (Hadolint)" >> $GITHUB_STEP_SUMMARY