mirror of
https://github.com/kuhyx/WUT_Computer_Science.git
synced 2026-11-10 20:07:11 +01:00
Krzysztof kuhy Rudnicki
50263f075a
`pre-commit run --all-files` is green. The config only carries hooks whose subject is already clean, so it stays green at every commit -- file-length, ruff/mypy and dependency-freshness are listed as blocked, each on its own cleanup, and the file-REWRITING hooks (trailing-whitespace, end-of-file-fixer) are held back for their own reviewed commit. Turning it on found four real things: 1. A committed private key: ERSMS-project/nginx/ssl/nginx.key. It is a self-signed CN=localhost cert that had already expired (notAfter 2025-06-16), so the risk is nil -- but it is regenerable in one openssl call, so it is replaced by generate-cert.sh rather than excluded from the hook. The script says plainly that removing it from HEAD does NOT unpublish it: history is deliberately not rewritten, which is acceptable only because nothing ever trusted this key. 2. Four files with unresolved merge conflict markers committed, left over from the subtree merges. EARIN/.gitignore and .vscode/extensions.json are resolved as the union of both sides. The two Unity folder .meta files each had two candidate GUIDs; grepping showed neither is referenced anywhere (folder GUIDs rarely are), so either is safe and the HEAD side is kept -- an arbitrary choice, but a checked one rather than a guess. 3. 62 shellcheck findings across 11 scripts, all fixed, no disables added. The interesting pattern was `cd X; cmd &; PID=$!; cd ..`, which trips both SC2164 and SC2103 and cannot use a plain subshell without losing the PID. `( cd X && exec cmd ) &` keeps the directory, the PID and the semantics. EOPSY lab1's submitted solution was verified by RUNNING it afterwards: a->A, B->b, foldera->FOLDERA, FOLDERB->folderb, exactly as before. 4. check-json failing on 11 files, which was the wrong parser rather than a defect -- tsconfig*.json and .vscode/*.json are JSONC, where TypeScript and VS Code both allow comments. Those two path classes are excluded and every other .json is still checked. Excluding them is what surfaced the merge conflict in (2) as the one genuine failure. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
72 lines
2.8 KiB
YAML
72 lines
2.8 KiB
YAML
# Install: ./install.sh (or: pre-commit install && pre-commit install --hook-type pre-push)
|
|
# Fast lint: pre-commit run --all-files
|
|
#
|
|
# Ordering rule for this repo: a hook lands only once the thing it gates is
|
|
# already clean, so `pre-commit run --all-files` is green at every commit.
|
|
# Hooks still to come, each blocked on its own cleanup:
|
|
# - file-length blocked on the .tex/code splits and TODO-file-length-250.md
|
|
# - ruff / mypy blocked on the root pyproject.toml (Milestone 4)
|
|
# - dependency-freshness blocked on the upgrade itself; the gate and the
|
|
# upgrade must land in the SAME commit or the repo is
|
|
# instantly and permanently red
|
|
# - trailing-whitespace / end-of-file-fixer these REWRITE files, so they get
|
|
# their own reviewed cleanup commit first
|
|
default_language_version:
|
|
python: python3
|
|
default_stages: [pre-commit]
|
|
fail_fast: false
|
|
|
|
repos:
|
|
- repo: https://github.com/pre-commit/pre-commit-hooks
|
|
rev: v4.6.0
|
|
hooks:
|
|
# Structural checks only -- none of these rewrite a file.
|
|
- id: check-merge-conflict
|
|
- id: check-case-conflict
|
|
- id: check-symlinks
|
|
- id: destroyed-symlinks
|
|
- id: detect-private-key
|
|
# tsconfig*.json and .vscode/*.json are JSONC -- both TypeScript and
|
|
# VS Code document comments and trailing commas as valid there, and
|
|
# check-json uses a strict RFC parser. This is the wrong parser for
|
|
# those files, not a defect being suppressed; every other .json is
|
|
# still checked. (The one real failure this hook found, a committed
|
|
# merge conflict in EARIN/.vscode/extensions.json, is fixed.)
|
|
- id: check-json
|
|
exclude: |
|
|
(?x)^(
|
|
.*/tsconfig[^/]*\.json|
|
|
.*/\.vscode/[^/]*\.json
|
|
)$
|
|
- id: check-toml
|
|
- id: check-yaml
|
|
args: [--unsafe]
|
|
# 2 MB. The four 39 MB movies.csv copies are already tracked and stay
|
|
# (approved decision 6); this stops the NEXT one.
|
|
- id: check-added-large-files
|
|
args: [--maxkb=2000]
|
|
|
|
- repo: local
|
|
hooks:
|
|
# Coursework deliverables are allowed under the two course trees;
|
|
# compiled output is allowed nowhere. See .binary-allowlist.
|
|
- id: no-binaries
|
|
name: block binary files outside the allowlist
|
|
entry: scripts/check_no_binaries.sh
|
|
language: script
|
|
pass_filenames: true
|
|
|
|
# Thin shim into ~/utils, which owns the four markdown namespaces.
|
|
- id: md-naming
|
|
name: markdown naming convention
|
|
entry: scripts/check_md_naming.sh
|
|
language: system
|
|
files: \.(md|markdown)$
|
|
|
|
- id: shellcheck
|
|
name: shellcheck
|
|
entry: bash -c 'printf "%s\0" "$@" | xargs -0 -n 40 shellcheck' --
|
|
language: system
|
|
types: [shell]
|
|
exclude_types: [zsh]
|