feat(dev-base): warm the fleet pre-commit hook cache into the image #1030

Merged

coilysiren merged 2 commits from fix/bake-precommit-hooks into main

2026-08-12 19:45:36 +00:00

coilyco-ops commented

2026-08-12 18:46:38 +00:00

Member

Why

Nine repos across the four orgs run pre-commit in CI, and all nine run it inside agentic-os:release. Every job paid a cold hook install. On this repo that install is roughly 5 minutes of a 5m30s lint job.

It is also a correctness problem, not only a speed one. Runner egress has no direct route out, so a cold install reaches github.com unproxied and resets. coilyco-bridge/deploy#402 has the trace:

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
fatal: unable to access '...': Recv failure: Connection reset by peer

That failure is invisible while a cache stays warm, which is why it reads as intermittent.

What

PRE_COMMIT_HOME=/opt/pre-commit, warmed at build time from docker/dev-base/fleet-precommit-hooks.yaml. That manifest carries the externally hosted pins the fleet shares:

pre-commit-hooks@v6.0.0 - 8 of 9 repos
forgejo/runner@v12.10.1 and shellcheck-py@v0.11.0.1 - 6 of 9
typos@v1.48.0 and actionlint@v1.7.12 - 5 of 9
ruff-pre-commit@v0.15.20 - 2 of 9
mirrors-mypy@v1.20.0, pre-commit-shfmt@v3.13.1-1, yamllint@v1.38.0 - 1 each

Hooks served from forgejo.coilysiren.me stay out. That host is on the runners' NO_PROXY path and installs in seconds, and its revs churn per repo.

Cost and failure mode

Adds roughly 420 MB to the full image. Largest contributors are shellcheck-py at 124 MB, mypy at 70 MB, and typos at 66 MB.

A pin this manifest misses still installs at CI time, so drift costs speed and never correctness.

Verification

pre-commit validate-config passes on the manifest.
pre-commit install-hooks against it completes clean in a throwaway repo, producing a 421 MB cache. Every hook environment resolved.
Repo hooks pass on both changed files.

Live verification of a warm cache in CI is not possible until this lands and dev-base-publish ships a new :release.

Follow-ups, not in this PR

The actions/cache blocks in ci.yml, promote.yml, mirror-to-github.yml, and aos-cli-release.yml point at ~/.cache/pre-commit and become no-ops once this ships. They should be removed after a CI run confirms the baked cache is being read, not before.
This repo still has no egress proxy wrapper on its pre-commit path. That is the correctness half and is tracked separately.
deploy pins pre-commit-hooks@v5.0.0 and eco-app pins ruff-pre-commit@v0.15.10. Both miss the bake until their pins move.

## Why Nine repos across the four orgs run pre-commit in CI, and all nine run it inside `agentic-os:release`. Every job paid a cold hook install. On this repo that install is roughly 5 minutes of a 5m30s lint job. It is also a correctness problem, not only a speed one. Runner egress has no direct route out, so a cold install reaches github.com unproxied and resets. `coilyco-bridge/deploy#402` has the trace: ``` [INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks. fatal: unable to access '...': Recv failure: Connection reset by peer ``` That failure is invisible while a cache stays warm, which is why it reads as intermittent. ## What `PRE_COMMIT_HOME=/opt/pre-commit`, warmed at build time from `docker/dev-base/fleet-precommit-hooks.yaml`. That manifest carries the externally hosted pins the fleet shares: * `pre-commit-hooks@v6.0.0` - 8 of 9 repos * `forgejo/runner@v12.10.1` and `shellcheck-py@v0.11.0.1` - 6 of 9 * `typos@v1.48.0` and `actionlint@v1.7.12` - 5 of 9 * `ruff-pre-commit@v0.15.20` - 2 of 9 * `mirrors-mypy@v1.20.0`, `pre-commit-shfmt@v3.13.1-1`, `yamllint@v1.38.0` - 1 each Hooks served from forgejo.coilysiren.me stay out. That host is on the runners' NO_PROXY path and installs in seconds, and its revs churn per repo. ## Cost and failure mode Adds roughly 420 MB to the full image. Largest contributors are shellcheck-py at 124 MB, mypy at 70 MB, and typos at 66 MB. A pin this manifest misses still installs at CI time, so drift costs speed and never correctness. ## Verification * `pre-commit validate-config` passes on the manifest. * `pre-commit install-hooks` against it completes clean in a throwaway repo, producing a 421 MB cache. Every hook environment resolved. * Repo hooks pass on both changed files. Live verification of a warm cache in CI is not possible until this lands and `dev-base-publish` ships a new `:release`. ## Follow-ups, not in this PR * The `actions/cache` blocks in `ci.yml`, `promote.yml`, `mirror-to-github.yml`, and `aos-cli-release.yml` point at `~/.cache/pre-commit` and become no-ops once this ships. They should be removed after a CI run confirms the baked cache is being read, not before. * This repo still has no egress proxy wrapper on its pre-commit path. That is the correctness half and is tracked separately. * `deploy` pins `pre-commit-hooks@v5.0.0` and `eco-app` pins `ruff-pre-commit@v0.15.10`. Both miss the bake until their pins move.

coilyco-ops added 1 commit

2026-08-12 18:46:38 +00:00

feat(dev-base): warm the fleet pre-commit hook cache into the image

ci / ward-doctor (pull_request) Successful in 14s

Details

ci / aos-cli-tests (pull_request) Successful in 41s

Details

dev-base-pr / build (pull_request) Failing after 57s

Details

ci / gate (pull_request) Successful in 1m7s

Details

9111383074

Nine repos run pre-commit in CI and all nine run it inside this image, so
every job paid a cold hook install. On agentic-os that install was about 5
minutes of a 5m30s lint job, and on a cold cache it reached github.com
unproxied and reset (see coilyco-bridge/deploy#402).

PRE_COMMIT_HOME now points at a build-time cache holding the externally
hosted pins the fleet shares. Hooks served from forgejo.coilysiren.me stay
out, since that host is on the runners' NO_PROXY path.

A pin this manifest misses still installs at CI time, so drift costs speed
and never correctness. Adds roughly 420 MB to the full image.

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-12 18:46:38 +00:00

coilyco-ops added 1 commit

2026-08-12 19:00:48 +00:00

fix(dev-base): admit the hook manifest to the build context

ci / aos-cli-tests (pull_request) Successful in 34s

Details

ci / ward-doctor (pull_request) Successful in 17s

Details

ci / gate (pull_request) Successful in 1m7s

Details

dev-base-pr / build (pull_request) Successful in 11m16s

Details

d64bf02249

.dockerignore is a deny-all allowlist, so the new manifest never reached
BuildKit and the full target failed on a missing bind-mount source.

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>