b631bdae24
## Summary
- Adds `scripts/check_ci_images.sh`: extracts every `From("...")` image reference from `ci/main.go` and runs `skopeo inspect --no-creds` on each one (manifest-only, no layer pull, no daemon required)
- Adds `task check-ci-images` task in `Taskfile.yml` that runs the script
- Adds `ci-image-exists` hook to `.pre-commit-config.yaml` that fires only when `ci/main.go` is staged (using `files: ^ci/main\.go$` rather than `always_run`, to avoid a network round-trip on every unrelated commit)
- Adds `skopeo` to the Nix devShell so the tool is on PATH when the hook runs via `nix develop --command`
This catches a bad image tag (like `ghcr.io/cirruslabs/flutter:3.44.1` not yet published) at commit time, before the push reaches CI.
## Test plan
- Stage a change to `ci/main.go` bumping a `From("...")` tag to a non-existent version → hook rejects commit with NOT FOUND
- Stage a change with valid image tags → hook prints OK for each image and allows the commit
- Stage a change to any other file → `ci-image-exists` hook is skipped entirely
Closes #407
Co-authored-by: Thomas SharedInbox <sharedinbox@thomas-guettler.de>
Reviewed-on: https://codeberg.org/guettli/sharedinbox/pulls/413
51 lines
2.2 KiB
YAML
51 lines
2.2 KiB
YAML
repos:
|
|
- repo: https://github.com/pre-commit/pre-commit-hooks
|
|
rev: v4.6.0
|
|
hooks:
|
|
- id: check-added-large-files
|
|
args: ['--maxkb=500']
|
|
- id: check-merge-conflict
|
|
- id: check-case-conflict
|
|
- id: detect-private-key
|
|
- id: end-of-file-fixer
|
|
- id: trailing-whitespace
|
|
|
|
- repo: local
|
|
hooks:
|
|
- id: check-no-binary
|
|
name: check for binary files (build artifacts, databases)
|
|
language: system
|
|
entry: bash -c 'cd "$(git rev-parse --show-toplevel)" && scripts/check_no_binary.sh'
|
|
pass_filenames: false
|
|
always_run: true
|
|
- id: forbidden-files-hook
|
|
name: check for forbidden home-directory files
|
|
language: system
|
|
entry: bash -c 'cd "$(git rev-parse --show-toplevel)" && nix develop --command task check-hygiene'
|
|
pass_filenames: false
|
|
always_run: true
|
|
- id: dart-check
|
|
name: dart format (autofix) + check-fast (parallel)
|
|
language: system
|
|
entry: bash -c 'cd "$(git rev-parse --show-toplevel)" && nix develop --command scripts/pre_commit_check.sh'
|
|
pass_filenames: false
|
|
always_run: true
|
|
- id: ci-no-direct-dagger
|
|
name: check for direct dagger calls in workflows (use Task instead)
|
|
language: system
|
|
entry: "bash -c 'git --no-pager grep \"dagger call\" .forgejo/workflows/ && echo \"ERROR: Direct dagger calls found in workflows. Use Taskfile instead.\" && exit 1 || exit 0'"
|
|
pass_filenames: false
|
|
always_run: true
|
|
- id: dagger-progress-plain
|
|
name: ensure all dagger calls use --progress=plain
|
|
language: system
|
|
entry: "bash -c 'git --no-pager grep \"dagger call\" -- \":!.pre-commit-config.yaml\" | grep -v \"\\-\\-progress=plain\" && echo \"ERROR: All dagger calls must include --progress=plain\" && exit 1 || exit 0'"
|
|
pass_filenames: false
|
|
always_run: true
|
|
- id: ci-image-exists
|
|
name: verify container images in ci/main.go are reachable
|
|
language: system
|
|
entry: bash -c 'cd "$(git rev-parse --show-toplevel)" && nix develop --command task check-ci-images'
|
|
pass_filenames: false
|
|
files: ^ci/main\.go$
|