ci: Introduce pre-commit hooks (#765)

* add pre-commit config

* ignore yaml list indentation style

* ignore long lines in python (because we want inline comments for version info)

* fix lint issues

fix python lint

* move actionlint.yaml to the right place

* add shellcheck pre-commit hook

* replace flake8 with ruff

* remove flake8 config

* ci: add pre-commit checks on pull request

* ci: disable pr-commit action until after the workflow is registered

* ci: rename reviewdog workflow to be grouped with other PR workflows

* fix lint issues

Author: NickLarsenNZ

.github/pull_request_template.md

@@ -2,12 +2,11 @@
 
 *Please add a description here.*
 
-
 ## Definition of Done Checklist
 
 - Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
 - Please make sure all these things are done and tick the boxes
- 
+
 ```[tasklist]
 - [ ] Changes are OpenShift compatible
 - [ ] All added packages (via microdnf or otherwise) have a comment on why they are added

.github/workflows/pr_pre-commit.yaml

@@ -0,0 +1,16 @@
+---
+name: pre-commit
+
+on:
+  pull_request:
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
+        with:
+          python-version: '3.12'
+#       NOTE (@NickLarsenNZ): Disabled until the workflow is registered in Github Actions (after merge to main)
+#       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

.github/workflows/reviewdog.yaml renamed to .github/workflows/pr_reviewdog.yaml

@@ -1,4 +1,3 @@
 # Byte-compiled / optimized / DLL files
 __pycache__/
 *.py[cod]
-

.gitignore

@@ -18,3 +18,7 @@ MD013:
 MD024:
   # Only check sibling headings
   siblings_only: true
+
+# MD033/no-inline-html Inline HTML
+MD033:
+  allowed_elements: [details, summary, img]

.markdownlint.yaml

@@ -0,0 +1,52 @@
+---
+# See https://pre-commit.com for more information
+fail_fast: false
+
+exclude: \.patch$
+
+# See https://pre-commit.com/hooks.html for more hooks
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.2.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: detect-aws-credentials
+        args: ["--allow-missing-credentials"]
+      - id: detect-private-key
+
+  - repo: https://github.com/adrienverge/yamllint
+    rev: v1.26.3
+    hooks:
+      - id: yamllint
+
+  - repo: https://github.com/igorshubovych/markdownlint-cli
+    rev: v0.31.1
+    hooks:
+      - id: markdownlint
+
+  - repo: https://github.com/koalaman/shellcheck-precommit
+    rev: v0.10.0
+    hooks:
+      - id: shellcheck
+        args: ["--severity=info"]
+
+  # WARNING (@NickLarsenNZ): Nix users need to install ruff first.
+  # If you do not, you will need to delete the cached ruff binary shown in the
+  # error message
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.5.1
+    hooks:
+      # Run the linter.
+      - id: ruff
+      # Run the formatter.
+      - id: ruff-format
+
+  - repo: local
+    hooks:
+      - id: update-readme-badges
+        name: update-readme-badges
+        language: system
+        entry: .scripts/update_readme_badges.sh
+        stages: [commit, merge-commit, manual]
+        pass_filenames: false

.pre-commit-config.yaml

@@ -22,9 +22,9 @@
 ]
 
 for product in conf.products:
-    product_name = product['name']
+    product_name = product["name"]
     if product_name not in PRODUCTS:
         continue
 
-    for version in product['versions']:
+    for version in product["versions"]:
         print(f"{product_name}#{version['product']}")

.scripts/enumerate-product-versions.py

@@ -38,7 +38,7 @@ for arch in "${ARCHITECTURES[@]}"; do
   # tini does not currently publish signatures or SBOMs
   # renaming binary because original file name has no version
   echo "Downloading TINI"
-  curl --fail -Ls -o "tini-$VERSION-$arch" "https://github.com/krallin/tini/releases/download/v$VERSION/tini-$arch" 
+  curl --fail -Ls -o "tini-$VERSION-$arch" "https://github.com/krallin/tini/releases/download/v$VERSION/tini-$arch"
 
   echo "Uploading to Nexus"
   curl --fail -u "$NEXUS_USER:$NEXUS_PASSWORD" --upload-file "tini-$VERSION-$arch" 'https://repo.stackable.tech/repository/packages/tini/'

.scripts/upload_new_tini_version.sh

@@ -1,3 +1,5 @@
+# shellcheck disable=all
+#
 # Don't do this on your machine, as we need to sign the mirrored image, which should be done by a GitHub CI.
 # Use the action "Mirror container image" in the docker-images repo for that.
 # You can e.g. pull the image from

.scripts/upload_sig_storage_driver.sh

@@ -10,3 +10,4 @@ rules:
     check-keys: false
   comments:
     min-spaces-from-content: 1  # Needed due to https://github.com/adrienverge/yamllint/issues/443
+  indentation: disable