Cleanup: Simplify sidebar styles and rename to On this page
#714
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright 2026 Chainguard, Inc. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: pre-commit | |
| on: | |
| pull_request: | |
| branches: ['main'] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: {} | |
| jobs: | |
| pre-commit: | |
| name: pre-commit | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read # Clone the repository | |
| steps: | |
| # audit (not block): pre-commit downloads hook environments from GitHub, | |
| # PyPI, nodejs.org and the npm registry, which is a wide and changing | |
| # egress footprint that a static allowlist would break on. | |
| - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| - name: Check out code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # Shallow by design: a full-depth clone of this large repo is | |
| # deliberately avoided. pre-commit's --from-ref/--to-ref diff only | |
| # needs the base and head commits, so fetch-depth: 2 plus the explicit | |
| # shallow fetch of the base sha below is enough. This assumes PR | |
| # branches stay current with main so the base sha is the diff's | |
| # merge-base; a stale branch widens the diff to files main changed | |
| # since the branch point. This repo is public, so the base-sha fetch | |
| # needs no credentials and persist-credentials stays false. | |
| persist-credentials: false | |
| fetch-depth: 2 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.13' | |
| cache: pip | |
| cache-dependency-path: .pre-commit-config.yaml | |
| - name: Cache pre-commit hook environments | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/.cache/pre-commit | |
| key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }} | |
| restore-keys: | | |
| pre-commit- | |
| # The SCSS stylelint hook runs the project's own stylelint | |
| # (node_modules/.bin/stylelint) so its shared config, stylelint-config- | |
| # standard-scss, resolves from the repo's node_modules. Install just that: | |
| # --ignore-scripts skips the theme's postinstall (for example the Hugo | |
| # download), which the lint hook does not need. | |
| - name: Set up Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| # zizmor: ignore[cache-poisoning] - no cache input is set, so setup-node creates no cache to poison | |
| with: | |
| node-version-file: .nvmrc | |
| - name: Install Node dependencies for the stylelint hook | |
| run: npm ci --ignore-scripts | |
| # DO NOT REMOVE: this makes the PR base sha reachable in the shallow | |
| # clone. Without it the --from-ref/--to-ref range below fails with | |
| # "fatal: Invalid revision range". If you want to drop this step, you must | |
| # switch checkout to fetch-depth: 0 (a full clone of this large repo). | |
| - name: Fetch base ref for pre-commit diff | |
| run: git fetch --depth=1 origin ${{ github.event.pull_request.base.sha }} | |
| # Deliberately not --all-files: the repo carries a backlog of pre-existing | |
| # lint errors, so gating the whole tree would make every PR responsible | |
| # for cleaning up files it never touched. --from-ref/--to-ref scopes the | |
| # run to files changed between the PR base and head (ratchet model). | |
| # SKIP=content-spellcheck: the aspell prose check is advisory and local-only | |
| # (aspell is not installed here, and spelling should not gate merges). | |
| - name: Run pre-commit | |
| env: | |
| SKIP: content-spellcheck | |
| run: | | |
| pip install pre-commit | |
| pre-commit run --show-diff-on-failure --color=always \ | |
| --from-ref ${{ github.event.pull_request.base.sha }} \ | |
| --to-ref ${{ github.event.pull_request.head.sha }} |