BUILD-12282: Upgrade pre-commit CI to gh-action_pre-commit@v2

[matemoln]

BUILD-12282: Upgrade pre-commit CI to gh-action_pre-commit@v2

Summary

• Rewrite .github/workflows/pre-commit.yml to the v2 README skeleton
• Add workflow-level permissions (id-token: write, contents: read) and concurrency (cancel-in-progress: true); remove job-level permissions
• Triggers: pull_request, merge_group, and push to the GitHub default branch
• Run on sonar-xs
• SHA-pin actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with fetch-depth: 0
• Float SonarSource/gh-action_pre-commit@v2
• Drop PR-only extra-args, ignore-failure helpers, and caller-side Repox/registry auth (bundled in v2)
• Replace local language: system shellcheck with gruntwork-io hook; mise already provides shellcheck

Depends on Vault Artifactory reader grants from the re-terraform-aws-vault order update.

Test plan

• Pre-commit job is green on this PR
• After merge, a push to the default branch runs --all-files

[hashicorp-vault-sonar-prod]

BUILD-12282

[gitar-bot]

Code Review ✅ Approved 4 resolved / 4 findings

Upgrades pre-commit CI to gh-action_pre-commit@v2 with v2 skeleton, sonar-xs runner support, and local shellcheck hook replacing the Docker image. The hook now uses whatever shellcheck is on PATH, which may differ from the pinned 0.11.0 in mise.toml if mise is not activated or installed — consider routing through mise or documenting the prerequisite in CONTRIBUTE.md to ensure consistent diagnostics across local and CI environments.

✅ 4 resolved

✅ Quality: pre-commit no longer runs on pushes to branch-* maintenance branches

📄 .github/workflows/pre-commit.yml:4-6
The new push filter only lists master, while the sibling CI workflow in this repo covers master and branch-* (test-shell-scripts.yml). Pushes to maintenance branches therefore get no pre-commit run at all (only PRs targeting them are covered), which is an inconsistency introduced by this rewrite rather than a documented exclusion. Add branch-* to the push branch list to match the repo's other CI workflows.

✅ Bug: sonar-xs runner cannot run the docker_image shellcheck hook

📄 .github/workflows/pre-commit.yml:12 🔗 language: docker_image
The job moves from warp-custom-ubuntu-24-04 (custom GitHub-hosted, DIND-capable) to the self-hosted sonar-xs runner, but .pre-commit-config.yaml includes the koalaman/shellcheck-precommit hook, whose .pre-commit-hooks.yaml declares language: docker_image / entry: docker.io/koalaman/shellcheck:v0.11.0 — it needs a working Docker daemon. This repo's own runner guidance states the sonar-* self-hosted runners do not support Docker-in-Docker and that github-ubuntu-latest-s must be used "regardless of repo visibility" when Docker is needed, so every run (PR diff containing shell files, and --all-files on push/merge_group where this repo has many *.sh files) will fail when pre-commit tries to docker run the shellcheck image. Either keep a DIND-capable runner or switch the hook to a non-Docker variant (e.g. the shellcheck binary already pinned in mise.toml).

✅ Bug: Vault-authenticating job has id-token: write but no environment:

📄 .github/workflows/pre-commit.yml:13-15
gh-action_pre-commit@v2 performs the Vault OIDC exchange itself (that is why the job now needs id-token: write), but the job declares no environment:. The sibling workflow in this repo documents the contract for exactly this situation: "Per the SonarSource OIDC standard, the environment claim is mandatory: Vault role bindings include it in include_claim_keys by default. A job with id-token: write but no environment: produces a token without the claim, and Vault rejects it: 'OIDC error: the claim environment cannot be null or empty'." Since this PR depends on a freshly created Artifactory-reader grant (per the description), confirm the new role binding drops the environment claim; otherwise add an environment: (as check-sca.yml does with sca-checking + deployment: false) or the job will fail at the Vault step.

✅ Quality: Local shellcheck hook silently uses whatever shellcheck is on PATH

📄 .pre-commit-config.yaml:20-27
The hook is now language: system with entry: shellcheck, so pre-commit no longer controls the version: in a shell where mise's tools are not on PATH (mise installed but not activated, or mise install never run — CONTRIBUTE.md only mentions it as a prerequisite for the shellspec tests), git commit aborts with "Executable shellcheck not found", and a contributor whose distro provides e.g. shellcheck 0.9.0 gets different diagnostics than CI, which gets 0.11.0 from mise via mise-action-wrapper. The previous docker_image hook was self-contained and version-pinned by rev, and the hardcoded "0.11.0" in the new description will also drift the next time renovate bumps mise.toml. Route the hook through mise so the pinned version is used everywhere (and drop the version from the description), or document the mise-on-PATH prerequisite for pre-commit in CONTRIBUTE.md.

Implementation Status ◻️ 4 of 5 objectives covered

◻️ BUILD-12282 - 4 of 5 objectives covered

This PR covers routing pip and npm hook installs through Repox, configuring workflow permissions, updating the README, and keeping nodeenv on nodejs.org/dist.

Other objectives on this issue, possibly covered elsewhere:

• ◻️ Ensure it-tests-repox-runner covers a sonar-xs runner

✅ 4 covered here

• ✅ Route pip and npm hook installs through Repox from inside the action without nested config-pip or config-npm
• ✅ Configure action IT and self-pre-commit workflows with id-token: write
• ✅ Keep nodeenv using https://nodejs.org/dist/
• ✅ Document required permissions and covered registries in the README

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud