ci(dependabot): track pre-commit hook versions - #235
Open
rominf wants to merge 1 commit into
Open
Conversation
The hook pins in .pre-commit-config.yaml were bumped by hand and drifted between releases. Dependabot's pre-commit ecosystem resolves each rev against the hook repository's tags, and skips the builtin and local blocks, which have no upstream release to track. Weekly and grouped, with the same 7-day cooldown as the other two ecosystems: a hook is executable code that runs on every contributor's machine at commit time and in the prek CI job, so a compromised release would run before anyone reads the bump. Signed-off-by: Roman Inflianskas <Roman.Inflianskas@amd.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
pre-commitentry to.github/dependabot.ymlso the hook pins in.pre-commit-config.yamlstop drifting.Those
revs (currentlyruff-pre-commitandshellcheck-py) have only everbeen bumped by hand, which means the linters CI enforces are whatever version
someone last remembered to update. Dependabot added a
pre-commitecosystem
that parses the config, resolves each
revagainst the hook repository's tags,and opens a PR when one moves.
Notably it skips the
repo: builtinandrepo: localblocks, so prek's nativehooks and the
cargo xtaskhooks are untouched — they have no upstream releaseto track.
Weekly, grouped into a single PR, with the same
cooldown: 7as the other twoecosystems. The cooldown reasoning is a bit sharper here than for actions or
crates: a hook is executable code that runs on every contributor's machine at
commit time and in the
prekCI job, so a compromised release executes beforeanyone has read the bump. Cooldown never delays security updates.
Risk: low. Config-only; the worst case is that no PRs are opened.
Test plan
prek run --all-files --no-group local-toolspasses (check-yamlparses thefile).
Not verifiable before merge: whether GitHub accepts
pre-commitwithoutenable-beta-ecosystems. The changelog and the supported-ecosystems referenceboth list it as generally available, and the flag is documented as beta-only,
so it should not be needed — but the authoritative signal is the repo's
Dependabot tab after this lands. If it is rejected there, the fix is a
one-line follow-up.
Not a bug fix; no
tests/e2e-cucumber/expectations.tomlxfail rows to narrow.