docs: How to use pre-commit-terraform image to run pre-commit in CI #983
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
name: Common issues check | |
on: [pull_request] | |
jobs: | |
pre-commit: | |
runs-on: ubuntu-latest | |
steps: | |
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 | |
- run: | | |
git fetch --no-tags --prune --depth=1 origin +refs/heads/*:refs/remotes/origin/* | |
- name: Get changed files | |
id: file_changes | |
run: | | |
export DIFF=$(git diff --name-only origin/${{ github.base_ref }} ${{ github.sha }}) | |
echo "Diff between ${{ github.base_ref }} and ${{ github.sha }}" | |
echo "files=$( echo "$DIFF" | xargs echo )" >> $GITHUB_OUTPUT | |
- name: Install shfmt | |
run: | | |
curl -L "$(curl -s https://api.github.com/repos/mvdan/sh/releases/latest | grep -o -E -m 1 "https://.+?linux_amd64")" > shfmt \ | |
&& chmod +x shfmt && sudo mv shfmt /usr/bin/ | |
- name: Install shellcheck | |
run: | | |
sudo apt update && sudo apt install shellcheck | |
- name: Install hadolint | |
run: | | |
curl -L "$(curl -s https://api.github.com/repos/hadolint/hadolint/releases/latest | grep -o -E -m 1 "https://.+?/hadolint-Linux-x86_64")" > hadolint \ | |
&& chmod +x hadolint && sudo mv hadolint /usr/bin/ | |
# Need to success pre-commit fix push | |
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 | |
with: | |
fetch-depth: 0 | |
ref: ${{ github.event.pull_request.head.sha }} | |
# Skip terraform_tflint which interferes to commit pre-commit auto-fixes | |
- uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 | |
with: | |
python-version: '3.9' | |
- name: Execute pre-commit | |
uses: pre-commit/action@9b88afc9cd57fd75b655d5c71bd38146d07135fe # v2.0.3 | |
env: | |
SKIP: no-commit-to-branch,hadolint | |
with: | |
token: ${{ secrets.GITHUB_TOKEN }} | |
extra_args: --color=always --show-diff-on-failure --files ${{ steps.file_changes.outputs.files }} | |
# Run only skipped checks | |
- name: Execute pre-commit check that have no auto-fixes | |
if: always() | |
uses: pre-commit/action@9b88afc9cd57fd75b655d5c71bd38146d07135fe # v2.0.3 | |
env: | |
SKIP: check-added-large-files,check-merge-conflict,check-vcs-permalinks,forbid-new-submodules,no-commit-to-branch,end-of-file-fixer,trailing-whitespace,check-yaml,check-merge-conflict,check-executables-have-shebangs,check-case-conflict,mixed-line-ending,detect-aws-credentials,detect-private-key,shfmt,shellcheck | |
with: | |
extra_args: --color=always --show-diff-on-failure --files ${{ steps.file_changes.outputs.files }} | |
pre-commit-container: | |
runs-on: ubuntu-latest | |
container: | |
image: ghcr.io/antonbabenko/pre-commit-terraform:latest | |
defaults: | |
run: | |
shell: bash | |
steps: | |
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 | |
- run: | | |
git fetch --no-tags --prune --depth=1 origin +refs/heads/*:refs/remotes/origin/* | |
- name: Get changed files | |
id: file_changes | |
run: | | |
export DIFF=$(git diff --name-only origin/${{ github.base_ref }} ${{ github.sha }}) | |
echo "Diff between ${{ github.base_ref }} and ${{ github.sha }}" | |
echo "files=$( echo "$DIFF" | xargs echo )" >> $GITHUB_OUTPUT | |
- name: fix tar dependency in alpine container image | |
run: | | |
apk --no-cache add tar | |
# check python modules installed versions | |
python -m pip freeze --local | |
git config --global --add safe.directory $GITHUB_WORKSPACE | |
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 | |
with: | |
fetch-depth: 0 | |
ref: ${{ github.event.pull_request.head.sha }} | |
- name: Cache pre-commit since we use pre-commit from container | |
uses: actions/cache@v4 | |
with: | |
path: ~/.cache/pre-commit | |
key: pre-commit-3|${{ hashFiles('.pre-commit-config.yaml') }} | |
- name: Execute pre-commit | |
env: | |
SKIP: no-commit-to-branch,hadolint | |
run: | | |
pre-commit run --color=always --show-diff-on-failure --files ${{ steps.file_changes.outputs.files }} | |
# Run only skipped checks | |
- name: Execute pre-commit check that have no auto-fixes | |
if: always() | |
env: | |
SKIP: check-added-large-files,check-merge-conflict,check-vcs-permalinks,forbid-new-submodules,no-commit-to-branch,end-of-file-fixer,trailing-whitespace,check-yaml,check-merge-conflict,check-executables-have-shebangs,check-case-conflict,mixed-line-ending,detect-aws-credentials,detect-private-key,shfmt,shellcheck | |
run: | | |
pre-commit run --color=always --show-diff-on-failure --files ${{ steps.file_changes.outputs.files }} |