name: pre-commit

# The local hooks can be skipped -- a fresh clone that never ran ./install.sh
# has no hooks at all -- so the gate needs a second home that nobody can
# forget to install.
on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

jobs:
  pre-commit:
    runs-on: ubuntu-latest
    env:
      # scripts/check_md_naming.sh is a thin shim that execs the shared gate
      # out of the utils repo. A runner has no ~/src/utils, so without this the
      # hook fails with "shared gate not found".
      UTILS_ROOT: ${{ github.workspace }}/.utils
    steps:
      # fetch-depth 1: the history here is ~494 MB and no gate reads it.
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Check out the shared gates
        uses: actions/checkout@v4
        with:
          repository: kuhyx/utils
          path: .utils

      - uses: actions/setup-python@v5
        with:
          python-version: "3.x"

      # Pinned, not apt-installed. `language: system` hooks run whatever is on
      # PATH, so an unpinned shellcheck makes CI disagree with every developer
      # machine: Ubuntu's package flagged SC2236 in a file that 0.11.0 locally
      # does not, and the build went red for a difference in tool version
      # rather than in the code.
      - name: Install shellcheck (pinned)
        env:
          SHELLCHECK_VERSION: v0.11.0
          SHELLCHECK_SHA256: 8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198
        run: |
          set -euo pipefail
          url="https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/shellcheck-${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
          curl -fsSL "$url" -o /tmp/sc.tar.xz
          echo "${SHELLCHECK_SHA256}  /tmp/sc.tar.xz" | sha256sum -c -
          tar -xJf /tmp/sc.tar.xz -C /tmp
          sudo install -m 0755 "/tmp/shellcheck-${SHELLCHECK_VERSION}/shellcheck" /usr/local/bin/shellcheck
          shellcheck --version

      - uses: actions/cache@v4
        with:
          path: ~/.cache/pre-commit
          key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}

      - name: Install pre-commit
        run: python -m pip install --quiet pre-commit

      - name: Run the hooks
        run: pre-commit run --all-files --show-diff-on-failure