mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 19:47:12 +01:00
Krzysztof kuhy Rudnicki
23fdfcf867
Root cause behind the outage9dd9aebcleaned up. The workflow never installed shellcheck: it inherited whatever ubuntu-latest shipped (0.9.0), while developer machines get 0.11.0 from pacman. The hook is `language: system`, so each side linted with a different binary, and the two disagree -- 0.11.0 demoted SC2002 and several SC2015/SC2119 cases as noise. A commit could pass every local gate and then fail CI on findings that could not be reproduced locally. That is what kept the workflow red fromb83ce5donward, and why it took fetching shellcheck 0.9.0 by hand to see the 11 findings at all. CI now downloads shellcheck v0.11.0 from the official release, verifies it against a recorded sha256, installs it, and asserts the version that PATH actually resolves to. That last check matters: without it a stale copy earlier on PATH would silently win and reproduce the same class of confusion. The local hooks gain a matching EXPECTED_SHELLCHECK_VERSION and warn when the installed version differs, naming both files to update. Warn, not abort -- shellcheck comes from pacman on a rolling distro, so a bump is routine and should not block a commit; what must not happen is the disagreement going unnoticed. Verified: workflow YAML parses with the pin ahead of the hook step; the install steps run verbatim locally with the checksum reporting OK and the version gate passing; the drift warning was observed firing against a stubbed 0.9.0 and staying silent against the real 0.11.0; common.sh is shellcheck clean; 1193 Python tests at 100% coverage. Pre-commit checks on9dd9aebwent green -- this change protects that rather than producing it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018ReVsw7qovYkkGbqcU9tn7
64 lines
2.5 KiB
YAML
64 lines
2.5 KiB
YAML
name: Pre-commit checks
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
pre-commit:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install system dependencies
|
|
run: sudo apt-get update && sudo apt-get install -y zsh
|
|
|
|
# Pin shellcheck instead of inheriting whatever ubuntu-latest ships.
|
|
#
|
|
# The runner image carried 0.9.0 while developer machines have 0.11.0
|
|
# from pacman, and the shellcheck hook is `language: system` -- so it
|
|
# used whichever binary happened to be on PATH. The two versions
|
|
# disagree (0.11.0 demoted SC2002 and several SC2015/SC2119 cases as
|
|
# noise), which meant a commit could pass every local check and still
|
|
# fail CI on findings the developer could not reproduce. That is exactly
|
|
# what kept this workflow red from b83ce5d onward.
|
|
#
|
|
# Keep SHELLCHECK_VERSION in step with the version developers install;
|
|
# the verification below fails loudly rather than silently drifting.
|
|
- name: Install shellcheck (pinned)
|
|
env:
|
|
SHELLCHECK_VERSION: v0.11.0
|
|
SHELLCHECK_SHA256: 8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198
|
|
run: |
|
|
set -euo pipefail
|
|
tarball="shellcheck-${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
|
|
curl -fsSL -o "$tarball" \
|
|
"https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/${tarball}"
|
|
echo "${SHELLCHECK_SHA256} ${tarball}" | sha256sum --check --strict
|
|
tar -xJf "$tarball"
|
|
sudo install -m 0755 "shellcheck-${SHELLCHECK_VERSION}/shellcheck" /usr/local/bin/shellcheck
|
|
# Fail here, not 40 hooks later, if PATH still resolves to another copy.
|
|
installed="$(shellcheck --version | awk '/^version:/ { print $2 }')"
|
|
expected="${SHELLCHECK_VERSION#v}"
|
|
if [ "$installed" != "$expected" ]; then
|
|
echo "::error::shellcheck on PATH is ${installed}, expected ${expected}" >&2
|
|
command -v -a shellcheck >&2
|
|
exit 1
|
|
fi
|
|
echo "shellcheck ${installed} pinned and on PATH"
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pip install -r requirements.txt
|
|
pip install pre-commit
|
|
|
|
- name: Run pre-commit hooks
|
|
run: pre-commit run --all-files --show-diff-on-failure
|