chore: bump to aos-precommit-v0.18.0 and clear the linter backlog

coilyco-ops commented

2026-08-11 08:09:20 +00:00

Member

The managed hook block was pinned at v0.65.0 on the retired bare-v tag train, so this repo never saw six hooks the rest of the fleet runs. Repinning to aos-precommit-v0.18.0 turns them on and drops the legacy hygiene block that grandfathered agent/rendered/ out of whitespace enforcement.

Newly active hooks

actions-run-one-line, source-doc-refs, actionlint, forgejo-runner-validate, shellcheck, typos.

Failures worked down

Telegram alert steps (both jobs) - each carried a ~50-line Python program escaped into one python3 -c 'exec("...")' string, invisible to ruff, review, and git diff. Replaced with scripts/alert-telegram.py, copied byte-for-byte from infrastructure/scripts/actions/alert-telegram.py so the fleet keeps one shape. The step now passes only BOT_TOKEN and CHAT_ID; the rest falls back to the runner's own GITHUB_* variables, and a missing field degrades to ? rather than raising.
build and pre-commit steps - inlined the egress-proxy exports as YAML block scalars. scripts/ci-command.sh owns that setup and execs its argv.
actionlint - could not resolve the docker and deploy runner labels. .github/actionlint.yaml declares them, and re-running the rollout wires the -config-file flag through.
typos - two unparseable -> unparsable, and PNGs reworded to PNG renders so the checker stops splitting the acronym. No allowlist added.

One exclusion kept

[tool.agentic-os.code-comments] still excludes .pre-commit-config.yaml. Its three flagged comments are the BEGIN/END markers and the actionlint note, all emitted by apply-agentic-os-hooks.py at fixed positions, so no in-repo edit survives the next rollout. agentic-os excludes its own copy for the same reason. The real fix is teaching the hook to skip managed marker regions, which belongs upstream.

Verification

pre-commit run --all-files green. go build ./..., go vet ./..., and go test ./... all pass.

The managed hook block was pinned at `v0.65.0` on the retired bare-`v` tag train, so this repo never saw six hooks the rest of the fleet runs. Repinning to `aos-precommit-v0.18.0` turns them on and drops the legacy hygiene block that grandfathered `agent/rendered/` out of whitespace enforcement. ## Newly active hooks `actions-run-one-line`, `source-doc-refs`, `actionlint`, `forgejo-runner-validate`, `shellcheck`, `typos`. ## Failures worked down * **Telegram alert steps (both jobs)** - each carried a ~50-line Python program escaped into one `python3 -c 'exec("...")'` string, invisible to ruff, review, and `git diff`. Replaced with `scripts/alert-telegram.py`, copied byte-for-byte from `infrastructure/scripts/actions/alert-telegram.py` so the fleet keeps one shape. The step now passes only `BOT_TOKEN` and `CHAT_ID`; the rest falls back to the runner's own `GITHUB_*` variables, and a missing field degrades to `?` rather than raising. * **build and pre-commit steps** - inlined the egress-proxy exports as YAML block scalars. `scripts/ci-command.sh` owns that setup and execs its argv. * **actionlint** - could not resolve the `docker` and `deploy` runner labels. `.github/actionlint.yaml` declares them, and re-running the rollout wires the `-config-file` flag through. * **typos** - two `unparseable` -> `unparsable`, and `PNGs` reworded to `PNG renders` so the checker stops splitting the acronym. No allowlist added. ## One exclusion kept `[tool.agentic-os.code-comments]` still excludes `.pre-commit-config.yaml`. Its three flagged comments are the BEGIN/END markers and the actionlint note, all emitted by `apply-agentic-os-hooks.py` at fixed positions, so no in-repo edit survives the next rollout. agentic-os excludes its own copy for the same reason. The real fix is teaching the hook to skip managed marker regions, which belongs upstream. ## Verification `pre-commit run --all-files` green. `go build ./...`, `go vet ./...`, and `go test ./...` all pass.

coilyco-ops added 1 commit

2026-08-11 08:09:20 +00:00

chore: bump to aos-precommit-v0.18.0 and clear the linter backlog

ci / test (pull_request) Successful in 55s

Details

ci / publish-echo-image (pull_request) Has been skipped

Details

9395ea649e

The managed block was pinned at v0.65.0 on the retired bare-`v` train, so
the repo never saw actions-run-one-line, source-doc-refs, actionlint,
forgejo-runner-validate, shellcheck, or typos. Repinning to the current
aos-precommit train turns all six on and drops the legacy hygiene block
that grandfathered `agent/rendered/` out of whitespace enforcement.

Working the resulting failures down:

* Both Telegram alert steps carried a ~50-line Python program escaped into
  one `python3 -c 'exec("...")'` string, invisible to ruff, review, and git
  diff. Replaced with `scripts/alert-telegram.py`, copied byte-for-byte from
  infrastructure's tracked source so the fleet keeps one shape. The step now
  passes only BOT_TOKEN and CHAT_ID; everything else falls back to the
  runner's own GITHUB_* variables.
* The build and pre-commit steps inlined the egress-proxy exports as block
  scalars. `scripts/ci-command.sh` owns that setup and execs its argv.
* `.github/actionlint.yaml` declares the `docker` and `deploy` runner labels,
  which actionlint cannot otherwise resolve. Re-running the rollout wires the
  `-config-file` flag through.
* Three typos: two `unparseable` -> `unparsable`, and `PNGs` reworded to
  `PNG renders` so the checker stops splitting the acronym.

The code-comments exclusion on .pre-commit-config.yaml stays. Its three
flagged comments are the BEGIN/END markers and the actionlint note, all
emitted by apply-agentic-os-hooks.py at fixed positions, so no in-repo edit
survives the next rollout. agentic-os excludes its own copy for the reason.

`pre-commit run --all-files` is green and `go test ./...` passes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-11 08:09:20 +00:00

coilyco-ops referenced this pull request from coilyco-flight-deck/agentic-os

2026-08-11 08:09:54 +00:00

code-comments: skip the apply-agentic-os-hooks managed marker region #993

coilyco-ops referenced this pull request from a commit

2026-08-11 08:40:16 +00:00

fix: allow code.forgejo.org through the runner egress proxy

coilyco-ops referenced this pull request from coilyco-flight-deck/infrastructure

2026-08-11 08:40:47 +00:00

fix: allow code.forgejo.org through the runner egress proxy #779

coilyco-ops commented

2026-08-11 08:41:04 +00:00

Author

Member

CI is red here on an infrastructure gap, not on this diff.

The pre-commit step dies after 3s. forgejo-runner-validate, one of the hooks this bump newly enables, pulls from code.forgejo.org, and that host is absent from the runner egress proxy's Squid allowlist. Because the step routes through FORGEJO_EGRESS_PROXY, the proxy denies it outright.

Evidence, all inside the same agentic-os:release container this job uses:

full network, cold cache - all seven hook environments install and pre-commit run --all-files is green
--add-host code.forgejo.org:127.0.0.1 - fails at Initializing environment for https://code.forgejo.org/forgejo/runner, matching the CI signature and timing

Fix is coilyco-flight-deck/infrastructure#779, which adds the one dstdomain entry. This PR should go green on a re-run once that lands and Flux rolls the proxy. Merging this before then leaves main red.

The suite is otherwise green locally and in-container, and go build, go vet, and go test all pass.

CI is red here on an infrastructure gap, not on this diff. The pre-commit step dies after 3s. `forgejo-runner-validate`, one of the hooks this bump newly enables, pulls from `code.forgejo.org`, and that host is absent from the runner egress proxy's Squid allowlist. Because the step routes through `FORGEJO_EGRESS_PROXY`, the proxy denies it outright. Evidence, all inside the same `agentic-os:release` container this job uses: * full network, cold cache - all seven hook environments install and `pre-commit run --all-files` is green * `--add-host code.forgejo.org:127.0.0.1` - fails at `Initializing environment for https://code.forgejo.org/forgejo/runner`, matching the CI signature and timing Fix is coilyco-flight-deck/infrastructure#779, which adds the one `dstdomain` entry. This PR should go green on a re-run once that lands and Flux rolls the proxy. Merging this before then leaves main red. The suite is otherwise green locally and in-container, and `go build`, `go vet`, and `go test` all pass.

coilyco-ops referenced this pull request from coilyco-flight-deck/infrastructure

2026-08-11 09:24:32 +00:00

fix: drop the destination allowlist from the runner egress proxy #781

coilysiren merged commit 620a172810 into main

2026-08-11 21:49:17 +00:00

coilysiren referenced this pull request from a commit

2026-08-11 21:49:18 +00:00

Merge pull request 'chore: bump to aos-precommit-v0.18.0 and clear the linter backlog' (#103) from chore/aos-precommit-v0.18-lint-backlog into main

Rows
Columns

chore: bump to aos-precommit-v0.18.0 and clear the linter backlog #103

Newly active hooks

Failures worked down

One exclusion kept

Verification