Repository navigation
ci: remove CODEX_REVIEW_TOKEN from review request workflow #29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Reusable workflow that runs every pre-commit hook against all files. | |
| # Other repositories call it with: | |
| # uses: iwstkhr/shared-config/.github/workflows/pre-commit.yml@main | |
| # See README.md for the full caller example. | |
| name: "repo - Pre-commit" | |
| on: | |
| workflow_call: | |
| secrets: | |
| SLACK_BOT_TOKEN: | |
| description: Slack bot token for failure notifications. Notifications are skipped when omitted | |
| required: false | |
| SLACK_CHANNEL_ID: | |
| description: ID of the Slack channel for failure notifications. Notifications are skipped when omitted | |
| required: false | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| pre-commit: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| outputs: | |
| # Job-level if conditions cannot read secrets, so expose only whether Slack is configured | |
| slack-enabled: ${{ secrets.SLACK_BOT_TOKEN != '' && secrets.SLACK_CHANNEL_ID != '' }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Python | |
| id: setup-python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: 3.x | |
| # Repositories with mise.toml get the tools it pins, which hooks may rely on | |
| - name: Setup mise | |
| if: hashFiles('mise.toml') != '' | |
| uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 | |
| with: | |
| # Match minimumReleaseAge in the Renovate preset | |
| minimum_release_age: 7d | |
| # Prefer the pre-commit pinned in mise.toml, and fall back to pip otherwise | |
| - name: Install pre-commit | |
| env: | |
| # Keep in sync with mise.toml; Renovate updates both | |
| # renovate: datasource=pypi depName=pre-commit | |
| PRE_COMMIT_VERSION: 4.6.2 | |
| run: | | |
| if command -v mise >/dev/null && mise which pre-commit >/dev/null 2>&1; then | |
| echo "Using pre-commit from mise.toml" | |
| else | |
| python -m pip install "pre-commit==${PRE_COMMIT_VERSION}" | |
| fi | |
| pre-commit --version | |
| # Hook environments are rebuilt only when the config, mise.toml, or Python changes | |
| - name: Cache pre-commit environments | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/.cache/pre-commit | |
| key: pre-commit-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('.pre-commit-config.yaml', 'mise.toml') }} | |
| - name: Run pre-commit | |
| run: pre-commit run --all-files --show-diff-on-failure --color=always | |
| notify: | |
| name: Notify | |
| needs: pre-commit | |
| if: ${{ failure() && needs.pre-commit.outputs.slack-enabled == 'true' }} | |
| # Reference this repository explicitly so the call resolves the same way from every caller | |
| uses: iwstkhr/shared-config/.github/workflows/slack-notify.yml@main | |
| with: | |
| status: ${{ needs.pre-commit.result }} | |
| secrets: | |
| SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} | |
| SLACK_CHANNEL_ID: ${{ secrets.SLACK_CHANNEL_ID }} |