ci(lint): consolidate lint into pre-commit, front-load locally - #8
Closed
adust09 wants to merge 4 commits into
Closed
ci(lint): consolidate lint into pre-commit, front-load locally#8adust09 wants to merge 4 commits into
adust09 wants to merge 4 commits into
Conversation
Establish CI and static-test gates now, so the first implementation PR passes through a complete set of checks rather than retrofitting them later. - Rust quality gate (rust.yml): cargo fmt / clippy -D warnings / test / build over a minimal verity-types canary crate; toolchain pinned to 1.94.0, Swatinem/rust-cache for speed. - Supply-chain: cargo-deny (deny.toml) + Dependabot (github-actions + cargo). - Docs quality: markdownlint + offline lychee link check added to docs.yml. - Quality workflow: repo-wide typos spell-check + weekly online link check. - Secret scanning: betterleaks pinned image (secret-scan.yml). - .gitignore for Rust/Lean build artifacts. Lean proof CI is intentionally out of scope: the Verified Core (Verity Consensus) lives in a separate repository. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- secret-scan: inject `safe.directory=/repo` via GIT_CONFIG_* env so betterleaks' in-container git accepts the bind-mounted, differently-owned working tree (was failing with "detected dubious ownership"). - lychee.toml: drop unsupported `exclude_mail` (mail is excluded by default in lychee 0.23) — it broke config parsing and failed the docs link check. - secret-scan + quality: restrict the `push` trigger to main so feature-branch pushes don't double-run alongside the pull_request trigger. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drop Dependabot version updates entirely (github-actions + cargo ecosystems). Dependency and action update PRs will no longer be auto-opened.
Move the scattered lint definitions (typos job in quality.yml, markdownlint step in docs.yml) into a single .pre-commit-config.yaml that runs both as local git hooks (fast feedback before push) and as a consolidated `Quality / pre-commit` job (enforcement gate for --no-verify bypasses and contributors without hooks installed). - Add .pre-commit-config.yaml: hygiene hooks + typos + markdownlint (commit stage) reusing the existing _typos.toml / .markdownlint.jsonc, plus local cargo fmt (commit) and clippy (pre-push) honouring rust-toolchain.toml. - quality.yml: replace the typos job with a pre-commit job (SKIP=fmt,clippy — the lightweight job has no toolchain; rust.yml runs those). - docs.yml: drop the markdownlint step; rename lint -> links (offline link check only). - Add CONTRIBUTING.md (setup + what-runs-where) and link it from README. rust.yml is unchanged: cargo fmt --check / clippy / test / build / deny stay where the toolchain and build cache live.
adust09
force-pushed
the
ci/lint-to-pre-commit
branch
from
June 23, 2026 09:03
506644b to
7a67959
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #5 (base
ci/static-analysis-scaffold). Retarget tomainafter #5 merges, or merge after it.Why
CI lint is scattered across three workflow definitions, so lint failures only surface after push — forcing a push → fail → fix → re-push round-trip.
NyxFoundation/verityis public, so GitHub Actions is free; the burden to cut is (1) those CI round-trips and (2) maintaining lint rules in three places.What
Consolidate lint into a single
.pre-commit-config.yaml, run as local git hooks (fast feedback before push) and as oneQuality / pre-commitjob (enforcement gate that still catches--no-verifybypasses and contributors who never ranpre-commit install)..pre-commit-config.yaml(new) — hygiene hooks +typos+markdownlint-cli2(commit stage), reusing the existing_typos.toml/.markdownlint.jsonc; localcargo fmt(commit) andclippy(pre-push) honourrust-toolchain.toml. No lint settings are duplicated.quality.yml— replace thetyposjob with apre-commitjob (SKIP=fmt,clippy: the lightweight job has no toolchain;rust.ymlruns those where the cache lives).docs.yml— drop the markdownlint step; renamelint→links(offline link check only).dependabot.yml— track thepre-commitecosystem so hookrevs auto-update.CONTRIBUTING.md(new) + README pointer — setup and a what-runs-where table.rust.ymlis unchanged:cargo fmt --check/clippy/test/build/denystay where the toolchain and build cache live.Config / execution split
The same config runs in both places by design: local = fast feedback, CI = enforcement. Only the execution runs twice (local is free; the CI lint run is a few seconds on a public runner) — the lint rules live in one file, so they never drift.
Verification
pre-commit run --all-files→ all hooks pass on the current tree (hygiene, typos, markdownlint, cargo fmt).pre-commit run --all-files --hook-stage pre-push→cargo clippypasses.SKIP=fmt,clippy pre-commit run --all-files→ mirrors the CI job;cargo fmtcorrectly skipped, rest pass.dependabot.ymlparse; no dangling job references (deployneedsbuild).