pre-commit.yml

---
# yamllint disable rule:comments
# yamllint disable rule:truthy
name: Pre-commit Code Quality Checks

on:
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
    branches:
      - main
      - renovatebot
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  run-pre-commit:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    container:
      image: ghcr.io/${{ github.repository }}-pre-commit:main

    if: github.event.pull_request.user.login != 'dependabot[bot]'
    steps:
      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Cache Pre-commit
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: ~/.cache/pre-commit/
          key: pre-commit|${{ github.repository }}|${{ hashFiles('.pre-commit-config.yaml') }}

      - name: Cache OpenTofu providers
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: /github/home/.terraform.d/plugin
          key: tf-providers-${{ github.run_id }}
          restore-keys: |
            tf-providers

      - name: Set Terraform plugin cache
        run: echo "TF_PLUGIN_CACHE_DIR=/github/home/.terraform.d/plugin" >> $GITHUB_ENV

      - name: Mark repository as safe
        shell: bash
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Run pre-commit in all files
        shell: bash
        run: pre-commit run --show-diff-on-failure --color=always --all-files | tee pre-commit.log