Merge pull request #18 from hartwork/pre-commit

Make GitHub Actions enforce pre-commit clean code + address some ruff warnings

Author: hartwork

.github/workflows/pre-commit-detect-outdated.yml

@@ -0,0 +1,63 @@
+# Copyright (c) 2025 Sebastian Pipping <[email protected]>
+# Licensed under GNU Affero GPL v3 or later
+
+name: Detect outdated pre-commit hooks
+
+on:
+  schedule:
+    - cron: '0 2 * * 5'  # Every Friday at 2am
+  workflow_dispatch:
+
+# NOTE: This will drop all permissions from GITHUB_TOKEN except metadata read,
+#       and then (re)add the ones listed below:
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  pre_commit_detect_outdated:
+    name: Detect outdated pre-commit hooks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4.1.6
+
+      - name: Set up Python 3.13
+        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d  # v5.1.0
+        with:
+          python-version: 3.13
+
+      - name: Install pre-commit
+        run: |-
+          pip install \
+            --disable-pip-version-check \
+            --no-warn-script-location \
+            --user \
+            pre-commit
+          echo "PATH=${HOME}/.local/bin:${PATH}" >> "${GITHUB_ENV}"
+
+      - name: Check for outdated hooks
+        run: |-
+          pre-commit autoupdate
+          git diff -- .pre-commit-config.yaml
+
+      - name: Create pull request from changes (if any)
+        id: create-pull-request
+        uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e  # v6.0.5
+        with:
+          author: 'pre-commit <[email protected]>'
+          base: main
+          body: |-
+            For your consideration.
+
+            :warning: Please **CLOSE AND RE-OPEN** this pull request so that [further workflow runs get triggered](https://github.com/peter-evans/create-pull-request/blob/main/docs/concepts-guidelines.md#triggering-further-workflow-runs) for this pull request.
+          branch: precommit-autoupdate
+          commit-message: "pre-commit: Autoupdate"
+          delete-branch: true
+          draft: true
+          labels: enhancement
+          title: "pre-commit: Autoupdate"
+
+      - name: Log pull request URL
+        if: "${{ steps.create-pull-request.outputs.pull-request-url }}"
+        run: |
+          echo "Pull request URL is: ${{ steps.create-pull-request.outputs.pull-request-url }}"

.github/workflows/pre-commit.yml

@@ -0,0 +1,26 @@
+# Copyright (c) 2025 Sebastian Pipping <[email protected]>
+# Licensed under GNU Affero GPL v3 or later
+
+name: Run pre-commit
+
+on:
+  pull_request:
+  push:
+  schedule:
+    - cron: '0 2 * * 5'  # Every Friday at 2am
+  workflow_dispatch:
+
+# Drop permissions to minimum for security
+permissions:
+  contents: read
+
+jobs:
+  pre-commit:
+    name: Run pre-commit
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4.1.6
+    - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d  # v5.1.0
+      with:
+        python-version: 3.13
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  # v3.0.1

.pre-commit-config.yaml

@@ -0,0 +1,20 @@
+# Copyright (c) 2025 Sebastian Pipping <[email protected]>
+# Licensed under GNU Affero GPL v3 or later
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: check-merge-conflict
+      - id: check-toml
+      - id: check-yaml
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.8.4
+    hooks:
+      - id: ruff
+        args:
+          - --fix
+      - id: ruff-format

Caddyfile.generate

@@ -5,20 +5,22 @@
 import subprocess
 import sys
 from argparse import ArgumentParser
+from collections import namedtuple
 from configparser import ConfigParser, NoOptionError
 from contextlib import suppress
-from collections import namedtuple
 from tempfile import NamedTemporaryFile
 from textwrap import dedent
 
 
 class CaddyfileGenerator:
-
-    Site = namedtuple('Site', [
-        'alias_domains',
-        'backend_authority',
-        'domain',
-    ])
+    Site = namedtuple(
+        "Site",
+        [
+            "alias_domains",
+            "backend_authority",
+            "domain",
+        ],
+    )
 
     def __init__(self):
         self._redir_target_of = {}
@@ -30,31 +32,41 @@ class CaddyfileGenerator:
             self._redir_target_of[domain] = site.domain
 
     def write_to(self, fp):
-        print(dedent("""\
+        print(
+            dedent("""\
             # NOTE: This file has been generated, do not edit
             (common) {
                 encode zstd gzip
                 log {
                     output stdout
                 }
-            }"""), file=fp)
+            }"""),
+            file=fp,
+        )
 
         for domain, backend_authority in sorted(self._backend_of.items()):
-            print(dedent("""
+            print(
+                dedent("""
                 %s {
                     import common
                     reverse_proxy %s {
                         header_down +Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
                     }
-                }""") % (domain, backend_authority), file=fp)
-
-        for source_domain, target_domain in sorted(
-                self._redir_target_of.items()):
-            print(dedent("""
+                }""")  # noqa: E501
+                % (domain, backend_authority),
+                file=fp,
+            )
+
+        for source_domain, target_domain in sorted(self._redir_target_of.items()):
+            print(
+                dedent("""
                 %s {
                     import common
                     redir https://%s{uri}
-                }""") % (source_domain, target_domain), file=fp)
+                }""")
+                % (source_domain, target_domain),
+                file=fp,
+            )
 
 
 def run(options):
@@ -65,51 +77,59 @@ def run(options):
     caddyfile = CaddyfileGenerator()
     for domain in config.sections():
         try:
-            alias_domains = config.get(domain, 'aliases').split()
+            alias_domains = config.get(domain, "aliases").split()
         except NoOptionError:
             alias_domains = []
-        backend_authority = config.get(domain, 'backend')
+        backend_authority = config.get(domain, "backend")
 
-        site = CaddyfileGenerator.Site(alias_domains, backend_authority,
-                                       domain)
+        site = CaddyfileGenerator.Site(alias_domains, backend_authority, domain)
         caddyfile.add(site)
 
     with NamedTemporaryFile() as temp_file:
         # The idea is to diff against previous content or against
         # empty file when there is no previos content
-        with suppress(OSError):
-            with open(options.output_filename, 'r+b') as fin:
+        with suppress(OSError):  # noqa: SIM117
+            with open(options.output_filename, "r+b") as fin:
                 temp_file.file.write(fin.read())
                 temp_file.file.flush()
 
-        with open(options.output_filename, 'w') as fout:
+        with open(options.output_filename, "w") as fout:
             caddyfile.write_to(fout)
 
-        exit_code = subprocess.call(['diff', '-u', temp_file.name,
-                                     options.output_filename])
+        exit_code = subprocess.call(  # noqa: S603
+            ["diff", "-u", temp_file.name, options.output_filename],
+        )
 
         # Write stateful output in the format expected by SaltStack
         if exit_code and options.saltstack:
             print()
             print("changed=yes comment='Caddyfile changed'")
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     parser = ArgumentParser()
-    parser.add_argument('--config', dest='config_filename', metavar='FILENAME',
-                        default='sites.cfg',
-                        help='Path to config file to read'
-                            ' (default: %(default)s)')
-    parser.add_argument('--output', dest='output_filename', metavar='FILENAME',
-                        default='Caddyfile',
-                        help='Path to write Caddyfile to'
-                            ' (default: %(default)s)')
-    parser.add_argument('--saltstack', action='store_true',
-                        help='Add lines signaling changes to SaltStack'
-                            ' (default: omitted)')
+    parser.add_argument(
+        "--config",
+        dest="config_filename",
+        metavar="FILENAME",
+        default="sites.cfg",
+        help="Path to config file to read (default: %(default)s)",
+    )
+    parser.add_argument(
+        "--output",
+        dest="output_filename",
+        metavar="FILENAME",
+        default="Caddyfile",
+        help="Path to write Caddyfile to (default: %(default)s)",
+    )
+    parser.add_argument(
+        "--saltstack",
+        action="store_true",
+        help="Add lines signaling changes to SaltStack (default: omitted)",
+    )
     options = parser.parse_args()
 
     try:
         run(options)
-    except IOError as e:
+    except OSError as e:
         sys.exit(e)

ruff.toml

@@ -0,0 +1,19 @@
+indent-width = 4
+line-length = 99
+target-version = "py39"
+
+[lint]
+select = [
+    "ALL",
+]
+
+ignore = [
+    "ANN",     # flake8-annotations
+    "D1",      # Missing docstring in public ...
+    "D203",    # one-blank-line-before-class, to unclash with D211
+    "D212",    # multi-line-summary-first-line, to unclash with D213
+    "PTH123",  # `open()` should be replaced by `Path.open()`
+    "PYI024",  # Use `typing.NamedTuple` instead of `collections.namedtuple`
+    "S607",    # Starting a process with a partial executable path
+    "T201",    # `print` found
+]