CI does not run pre-commit, so the catalog hooks are enforced only on a developer's machine #310

New issue

Open

opened 2026-08-16 07:06:09 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-16 07:06:09 +00:00

Owner

Filed by Angie (ENG, claude seat), split out of #308 deliberately rather than bundled into it.

Gap

build-publish.yml's test job runs ward exec test, ward exec lint, ward exec smoke. It never runs pre-commit run --all-files.

ward exec lint is ruff check, ruff format check and mypy over src/ and tests/. That leaves everything the catalog suite covers unchecked by CI:

Markdown size caps
catalog-trifecta cross-link convention
documentation layout
agent context load-points
.ward/ward.yaml catalog block present
skill conventions
dead cross-links
repo-pointer skills auto-generated
no foreign repo-specific skills
agent-compose source size budget and dedup
trufflehog (secret scan)

Those run at commit time locally, so they hold as long as every commit goes through a machine with hooks installed. Nothing verifies that. A commit made with hooks uninstalled, or through the web UI, or by a tool that bypasses them, lands unchecked. trufflehog being in that list is the part that matters most — the secret-scan backstop is currently a local-only guarantee.

coilyco-gaming/sirens-echo ci.yml runs it as a step in its test job, so the shape is already established in the portfolio:

- name: pre-commit
  run: bash scripts/ci-command.sh pre-commit run --all-files --show-diff-on-failure

eco-app has ward exec precommit (bash scripts/ward-command.sh precommit), so the verb exists.

Why this was not folded into #308

Two reasons, both worth keeping separate:

#308's claim is parity — a PR runs exactly what main runs. Adding pre-commit would make PR CI stricter than main CI, which is a different change with a different argument.
pre-commit installs hook environments from the network (github.com/astral-sh/ruff-pre-commit among others). I cannot verify that works from eco-app's CI container without pushing and watching, and I am not going to land a gate I have not seen go green.

State

pre-commit run --all-files passes locally on eco-app main as of e06fd54, with no hook rewriting files. So this is adding a check that currently passes, not fixing a backlog.

Acceptance

The test job runs the full hook suite on both triggers.
The step is verified green in an actual CI run, not just locally.
If hook installation cannot reach the network from the runner, that blocker is recorded here rather than worked around by narrowing the hook set.

Refs #308

**Filed by Angie (ENG, `claude` seat)**, split out of #308 deliberately rather than bundled into it. ## Gap `build-publish.yml`'s `test` job runs `ward exec test`, `ward exec lint`, `ward exec smoke`. It never runs `pre-commit run --all-files`. `ward exec lint` is ruff check, ruff format check and mypy over `src/` and `tests/`. That leaves everything the catalog suite covers unchecked by CI: * `Markdown size caps` * `catalog-trifecta cross-link convention` * `documentation layout` * `agent context load-points` * `.ward/ward.yaml catalog block present` * `skill conventions` * `dead cross-links` * `repo-pointer skills auto-generated` * `no foreign repo-specific skills` * `agent-compose source size budget` and `dedup` * `trufflehog` (secret scan) Those run at commit time locally, so they hold as long as every commit goes through a machine with hooks installed. Nothing verifies that. A commit made with hooks uninstalled, or through the web UI, or by a tool that bypasses them, lands unchecked. **trufflehog being in that list is the part that matters most** — the secret-scan backstop is currently a local-only guarantee. `coilyco-gaming/sirens-echo` `ci.yml` runs it as a step in its test job, so the shape is already established in the portfolio: ```yaml - name: pre-commit run: bash scripts/ci-command.sh pre-commit run --all-files --show-diff-on-failure ``` eco-app has `ward exec precommit` (`bash scripts/ward-command.sh precommit`), so the verb exists. ## Why this was not folded into #308 Two reasons, both worth keeping separate: 1. #308's claim is **parity** — a PR runs exactly what main runs. Adding pre-commit would make PR CI *stricter* than main CI, which is a different change with a different argument. 2. pre-commit installs hook environments from the network (`github.com/astral-sh/ruff-pre-commit` among others). I cannot verify that works from eco-app's CI container without pushing and watching, and I am not going to land a gate I have not seen go green. ## State `pre-commit run --all-files` passes locally on eco-app main as of `e06fd54`, with no hook rewriting files. So this is adding a check that currently passes, not fixing a backlog. ## Acceptance * The `test` job runs the full hook suite on both triggers. * The step is verified green in an actual CI run, not just locally. * If hook installation cannot reach the network from the runner, that blocker is recorded here rather than worked around by narrowing the hook set. Refs #308

coilyco-ops added the

role/sysadmin

priority

labels

2026-08-25 08:12:18 +00:00

coilyco-ops added the

autonomy

headless

label

2026-08-25 09:30:20 +00:00

coilyco-ops added

priority