pre-commit.yml

# ⚠️ DO NOT EDIT THIS FILE, IT IS GENERATED BY COPIER ⚠️
# Changes here will be lost on a future update.
# See: https://github.com/ingadhoc/addons-repo-template

name: pre-commit

on:
  push:
    branches:
      - "1[8-9].0"
      - "[2-9][0-9].0"
  pull_request_target:
    branches:
      - "1[8-9].0*"
      - "[2-9][0-9].0*"

jobs:
  pre-commit:
    runs-on: ubuntu-latest
    steps:
      -
        name: Block sensitive file changes from fork PRs
        if: >-
          github.event_name == 'pull_request_target' &&
          github.event.pull_request.head.repo.full_name != github.repository
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          changed=$(gh api --paginate \
            "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" \
            --jq '.[].filename')
          if echo "$changed" | grep -qE '^(\.github/workflows/|\.pre-commit-config\.yaml$)'; then
            echo "::error::Fork PRs may not modify workflows or the pre-commit config. Blocked for security."
            exit 1
          fi
      -
        name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
          allow-unsafe-pr-checkout: true
      -
        id: setup-python
        name: Setup Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.10"
          cache: "pip"
      -
        name: Pre-commit cache
        uses: actions/cache@v6
        with:
          path: ~/.cache/pre-commit
          key: pre-commit|${{ steps.setup-python.outputs.python-version }}|${{ hashFiles('.pre-commit-config.yaml') }}
      -
        id: precommit
        name: Pre-commit
        run: |
          pip install pre-commit
          pre-commit run --all-files --show-diff-on-failure --color=always
      -
        name: Create commit status
        if: github.event_name == 'pull_request_target'
        run: |
          curl -L \
          -X POST \
          -H "Accept: application/vnd.github+json" \
          -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
          -H "X-GitHub-Api-Version: 2022-11-28" \
          https://api.github.com/repos/${{ github.repository }}/statuses/${{ github.event.pull_request.head.sha }} \
          -d '{"state":"${{ steps.precommit.outcome }}","context":"mergebot/pre-commit"}' \
          --fail