pre-commit.yml

name: pre-commit

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  pre-commit:
    name: Run pre-commit hooks
    runs-on: ubuntu-latest
    # 35 minutes accommodates the 3-attempt retry wrapper on the
    # `Run pre-commit` step below (3 attempts * 10 min per-attempt
    # timeout + 2 * 90 s retry waits = 33 min worst case) plus a
    # small margin for setup/install steps. Without the bump, the
    # job-level cap killed any retry attempt before it could start,
    # making the retry policy ineffective (CR finding on #697).
    timeout-minutes: 35
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: |
            3.12
            3.13

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          # Read from go.mod rather than a hardcoded string, matching
          # aws_sanity / azure_sanity / database-migration. One fewer place the
          # Go version has to be bumped by hand (issue #1833).
          go-version-file: go.mod

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "24"
          # Cache the npm download cache keyed on the frontend lockfile.
          # Saves ~30-40s per run vs an uncached `npm ci`. Same pattern
          # already used in frontend-build-sentinel.yml.
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json

      - name: Read Terraform version
        # The one pin lives in .terraform-version (issue #349); the script
        # validates it, because an empty terraform_version means `latest`.
        id: terraform-version
        run: bash scripts/terraform-version.sh

      - name: Set up Terraform
        # Required by the terraform_fmt + terraform_validate pre-commit hooks.
        # terraform_validate calls `terraform init` per module, which the
        # action wraps with HTTP-cached provider downloads.
        #
        # The version in .terraform-version must satisfy `required_version =
        # ">= 1.10.0"` declared by every `terraform/environments/*/main.tf`;
        # a sub-1.10 version makes init abort before validate even runs.
        # ci.yml and the deploy, rollback and migration workflows read the
        # same file, so validate here and apply there run one binary.
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
        with:
          terraform_version: ${{ steps.terraform-version.outputs.version }}
          terraform_wrapper: false

      - name: Install tflint
        # Pinned to a release tag (not master) so a malicious or accidental
        # change to install_linux.sh on master can't silently land on this
        # CI runner. `curl -fsSL` makes transport errors fail loudly
        # instead of writing an HTML error page to stdin and feeding it
        # to bash.
        env:
          TFLINT_VERSION: v0.55.0
        run: |
          set -euo pipefail
          curl -fsSL -o /tmp/tflint-install.sh \
            "https://raw.githubusercontent.com/terraform-linters/tflint/${TFLINT_VERSION}/install_linux.sh"
          bash /tmp/tflint-install.sh

      # Cache the tflint ruleset plugins (aws/azurerm/google) that
      # `tflint --init` downloads from the GitHub Releases API. Without
      # this cache EVERY run re-downloads all three plugins and is exposed
      # to transient GitHub release-API 503s — a sustained 503 outrode the
      # GITHUB_TOKEN auth + 3-attempt pre-commit retry below and reddened
      # this job repo-wide (blocking every PR). Keyed on .tflint.hcl so a
      # plugin-version bump re-downloads; restore-keys seeds a warm start.
      - name: Cache tflint plugins
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.tflint.d/plugins
          key: tflint-plugins-${{ runner.os }}-${{ hashFiles('.tflint.hcl') }}
          restore-keys: |
            tflint-plugins-${{ runner.os }}-

      # Pre-populate the plugin cache with a dedicated, authenticated,
      # retried `tflint --init` BEFORE pre-commit runs. On a cache hit this
      # is a fast no-op (tflint skips download when the pinned plugin
      # versions are already present — no API call, so immune to the 503).
      # On a cache miss (version bump / cold cache) the retry loop rides
      # out transient release-API 503s at the init level instead of
      # re-running every hook via the coarse outer retry. GITHUB_TOKEN
      # raises the release-API limit above the 60/hr anonymous ceiling.
      - name: Initialize tflint plugins
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -uo pipefail
          for attempt in 1 2 3 4 5 6; do
            if tflint --init --config="${GITHUB_WORKSPACE}/.tflint.hcl"; then
              echo "tflint --init succeeded (attempt ${attempt})"
              exit 0
            fi
            wait=$((attempt * 20))
            echo "tflint --init failed (attempt ${attempt}/6); retrying in ${wait}s..." >&2
            sleep "${wait}"
          done
          echo "tflint --init failed after 6 attempts — GitHub release API likely unavailable" >&2
          exit 1

      # Cache the installed tool binaries (gocyclo). Keyed on the pinned
      # version string so a tool-version bump still triggers a fresh
      # install. The binary lands in ~/go/bin which setup-go@v6 already
      # adds to PATH. Restored BEFORE the install step so the
      # `if: cache-hit != 'true'` guard below can short-circuit it on
      # cache-hit runs (the `go install` invocation costs ~3-5s even
      # when the module cache is warm; skipping it on cache-hit is worth
      # the extra `if`).
      #
      # gosec is deliberately NOT installed here (issue #347): the `gosec`
      # hook is SKIPped in this job (see the pre-commit step below), and
      # the hook (via scripts/run-gosec.sh) installs its own copy under
      # ~/.cache/gosec anyway, so a ~/go/bin/gosec was never run. ci.yml's
      # Security Scanning job is the gosec gate.
      - name: Cache Go-installed tools (gocyclo)
        id: cache-go-tools
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/go/bin
          key: go-tools-${{ runner.os }}-gocyclo-v0.6.0

      - name: Install gocyclo
        if: steps.cache-go-tools.outputs.cache-hit != 'true'
        # Pinned to match ci.yml — security tool installs must not use
        # @latest; that's exactly the supply-chain weakness this PR is
        # closing for Dockerfile FROMs.
        run: go install github.com/fzipp/gocyclo/cmd/gocyclo@v0.6.0

      - name: Install Trivy
        # Downloads the release tarball straight from GitHub Releases and
        # verifies it against a pinned SHA-256 before extracting; nothing
        # downloaded is executed as a script. The upstream contrib/install.sh
        # was dropped because it fetches from get.trivy.dev, which stopped
        # resolving (NXDOMAIN) on 2026-11-03 and broke every run.
        # TRIVY_VERSION and TRIVY_SHA256 must be bumped together: take the
        # hash for trivy_<ver>_Linux-64bit.tar.gz from the release's
        # trivy_<ver>_checksums.txt.
        env:
          TRIVY_VERSION: v0.69.3
          TRIVY_SHA256: 1816b632dfe529869c740c0913e36bd1629cb7688bd5634f4a858c1d57c88b75
        run: |
          set -euo pipefail
          curl -fsSL --retry 5 --retry-all-errors --retry-delay 5 -o "$RUNNER_TEMP/trivy.tgz" "https://github.com/aquasecurity/trivy/releases/download/${TRIVY_VERSION}/trivy_${TRIVY_VERSION#v}_Linux-64bit.tar.gz"
          echo "${TRIVY_SHA256}  $RUNNER_TEMP/trivy.tgz" | sha256sum -c -
          tar -xzf "$RUNNER_TEMP/trivy.tgz" -C /usr/local/bin trivy
          trivy --version

      - name: Install git-secrets
        # Pinned to a release tag rather than master HEAD. The tag is
        # mutable in principle, so also assert HEAD resolves to the exact
        # commit verified at the time this was written (`git ls-remote
        # --tags` against the upstream repo) before trusting it enough to
        # `sudo make install`. After install we register the AWS pattern
        # set and ASSERT at least one pattern was registered — without the
        # assert, a registration failure produces a patternless scanner
        # that exits 0 unconditionally, leaving the gate silently
        # downgraded.
        env:
          GIT_SECRETS_SHA: ad82d68ee924906a0401dfd48de5057731a9bc84
        run: |
          set -euo pipefail
          git clone --depth 1 --branch 1.3.0 https://github.com/awslabs/git-secrets.git /tmp/git-secrets
          resolved="$(git -C /tmp/git-secrets rev-parse HEAD)"
          if [ "${resolved}" != "${GIT_SECRETS_SHA}" ]; then
            echo "git-secrets 1.3.0 tag resolved to ${resolved}, expected ${GIT_SECRETS_SHA}" >&2
            exit 1
          fi
          sudo make -C /tmp/git-secrets install
          git secrets --register-aws --global
          git secrets --list --global | grep -q '.' || {
            echo "git-secrets registration produced no patterns — gate would be silently disabled"
            exit 1
          }

      # Note: the local `hadolint` hook in .pre-commit-config.yaml (search for
      # `id: hadolint`; no line number, because this comment has already gone
      # stale twice as that file shifted) runs ghcr.io/hadolint/hadolint pinned
      # by digest. The version lives in that entry and is the single source of
      # truth; do not restate it here, or this comment rots again. We do NOT
      # install a host binary here — it would be dead code (never invoked by
      # the hook) AND a supply-chain hole (latest tag, no checksum). Note:
      # an earlier version of this comment claimed the hook already pinned
      # the image to v2.14.0 via the hook repo's `rev:` -- it did not; that
      # `rev:` only pins hadolint's *hook definition*, whose upstream entry
      # (`ghcr.io/hadolint/hadolint hadolint`) has no image tag and floats to
      # `:latest`. See the digest pin in .pre-commit-config.yaml for the fix.
      # If a future change switches the hook to a host binary, install a
      # pinned + sha256-verified binary here.

      - name: Install pre-commit
        run: pip install 'pre-commit==4.0.1'

      - name: Verify actionlint native transport and pinned image parity
        run: bash scripts/test-actionlint-hook.sh --docker-parity

      # Cache pre-commit's per-hook environments (Go, Python, Node, etc.
      # virtualenvs it builds on first run). Keyed on the hook config
      # because pre-commit will rebuild any env whose pinned rev changes.
      # Saves ~30-60s per cache-hit run; safe because pre-commit verifies
      # env integrity on use.
      - name: Cache pre-commit environments
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/pre-commit
          key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
          restore-keys: |
            pre-commit-${{ runner.os }}-

      # Cache the Go build cache so `go vet`, `gosec`, and any other
      # Go-compiling hooks reuse compiled object files instead of
      # rebuilding from source. setup-go@v6 caches ~/go/pkg/mod
      # (modules) but NOT ~/.cache/go-build (compiled output) — this
      # step covers the latter. Keyed on go.sum so a dep upgrade still
      # invalidates the cache and gets clean builds.
      - name: Cache Go build cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/go-build
          key: go-build-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            go-build-${{ runner.os }}-

      - name: Install frontend deps
        run: |
          if [ -f frontend/package-lock.json ]; then
            cd frontend && npm ci
          fi

      - name: Run pre-commit
        # SKIP=terraform_validate: that hook calls `terraform init` per
        # module, which creates `.terraform.lock.hcl` files. Those are
        # gitignored, so on a fresh CI checkout they don't exist and the
        # init step "modifies files", which pre-commit reports as a
        # failure. Local pre-commit runs work because lock files persist
        # between invocations. terraform_fmt and terraform_tflint still
        # run and catch the syntax/style issues that terraform_validate
        # would catch; the deeper schema validation runs in
        # `terraform plan` during deploy workflows.
        #
        # GITHUB_TOKEN is passed so terraform_tflint's `tflint --init`
        # step authenticates against the GitHub API (5000/hr per-token)
        # when it downloads ruleset plugin releases. Without the token,
        # tflint goes anonymous and hits the 60/hr per-IP limit shared
        # across every workflow on the runner's NAT IP, which trips
        # intermittently when PRs land in the same hour (issue #564).
        #
        # nick-fields/retry wraps the run with up to 3 attempts and a
        # 90-second wait so transient flakes (GitHub Releases blips,
        # tflint plugin download timeouts, etc.) do not require a
        # manual rerun. The GITHUB_TOKEN fix above is the primary fix;
        # the retry wrapper is the cheap defense-in-depth for the
        # residual flakes that token alone cannot eliminate.
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
        env:
          # SKIP the `gosec` pre-commit hook in CI: it is designed to scan
          # only the changed packages of a local commit, but `pre-commit run
          # --all-files` (this CI job) feeds it EVERY .go file across all six
          # modules at once, and gosec's whole-repo analysis exhausts the
          # runner's memory — the job dies with "The runner has received a
          # shutdown signal" at this step on every run. gosec is NOT dropped:
          # the dedicated `Security Scanning` job in ci.yml runs gosec (the
          # version in .gosec-version) per-module (SARIF) as the
          # authoritative gate, so this only removes the duplicate that OOMs
          # CI — the same dedup rationale as the already-skipped
          # `terraform_validate` (covered by Validate Terraform).
          # Local developers still get the fast per-changed-package gosec hook.
          SKIP: terraform_validate,gosec
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 90
          command: pre-commit run --all-files