Speed up pre-commit hooks, add timeouts and error handling

- Move pytest from pre-commit to pre-push only (biggest time saver)
- Scope pyright to changed files instead of all of src/
- Add --ff (failed-first) to pytest-cov for faster feedback
- Add timeout=90 to _run_systemctl to prevent hung CLI
- Wrap secret_exists in try/except for when podman is unavailable

Author: delano

.pre-commit-config.yaml

@@ -82,11 +82,12 @@ repos:
           - "--template=[#{}]"
 
   # Pyright - static type checking (matches IDE)
+  # Only checks changed files rather than all of src/ for speed
   - repo: https://github.com/RobertCraigie/pyright-python
     rev: v1.1.390
     hooks:
       - id: pyright
-        args: [src/]
+        files: ^src/
         additional_dependencies:
           - cyclopts>=3.9
           - pytest>=8.0
@@ -99,23 +100,13 @@ repos:
         args: [--fix]
       - id: ruff-format
 
-  # pytest - run tests before commit (fast, no coverage)
-  # Only runs when Python files in src/ or tests/ are modified
+  # pytest - run before push with coverage and last-failed optimization
+  # Skipped on commit for speed; full suite gates push instead
   - repo: local
     hooks:
-      - id: pytest
-        name: pytest
-        entry: .venv/bin/pytest tests/ -x -q
-        language: system
-        pass_filenames: false
-        files: ^(src/|tests/).*\.py$
-        stages: [pre-commit]
-
-      # pytest with coverage - run before push
-      # Only runs when Python files in src/ or tests/ are modified
       - id: pytest-cov
         name: pytest-cov
-        entry: .venv/bin/pytest tests/ -x -q --cov=ots_containers --cov-report=term-missing --cov-fail-under=70
+        entry: .venv/bin/pytest tests/ -x -q --ff --cov=ots_containers --cov-report=term-missing --cov-fail-under=70
         language: system
         pass_filenames: false
         files: ^(src/|tests/).*\.py$

src/ots_containers/environment_file.py

@@ -405,12 +405,16 @@ def ensure_podman_secret(secret_name: str, value: str) -> str:
 
 
 def secret_exists(secret_name: str) -> bool:
-    """Check if a podman secret exists."""
-    result = subprocess.run(
-        ["podman", "secret", "exists", secret_name],
-        capture_output=True,
-    )
-    return result.returncode == 0
+    """Check if a podman secret exists. Returns False if podman is unavailable."""
+    try:
+        result = subprocess.run(
+            ["podman", "secret", "exists", secret_name],
+            capture_output=True,
+            timeout=10,
+        )
+        return result.returncode == 0
+    except (subprocess.SubprocessError, OSError):
+        return False
 
 
 def generate_quadlet_secret_lines(secrets: list[SecretSpec]) -> str:

src/ots_containers/systemd.py

@@ -40,7 +40,7 @@ def _run_systemctl(action: str, unit: str) -> None:
     """Run a systemctl command with diagnostic output on failure."""
     cmd = ["sudo", "systemctl", action, unit]
     print(f"  $ {' '.join(cmd)}")
-    result = subprocess.run(cmd, capture_output=True, text=True)
+    result = subprocess.run(cmd, capture_output=True, text=True, timeout=90)
     if result.returncode != 0:
         journal = _fetch_journal(unit)
         raise SystemctlError(unit, action, journal)

tests/test_systemd.py

@@ -194,6 +194,7 @@ def test_start_calls_systemctl_start(self, mocker):
             ["sudo", "systemctl", "start", "onetime-web@7043"],
             capture_output=True,
             text=True,
+            timeout=90,
         )
 
     def test_start_raises_systemctl_error_on_failure(self, mocker):
@@ -227,6 +228,7 @@ def test_stop_calls_systemctl_stop(self, mocker):
             ["sudo", "systemctl", "stop", "onetime-web@7043"],
             capture_output=True,
             text=True,
+            timeout=90,
         )
 
     def test_stop_raises_systemctl_error_on_failure(self, mocker):
@@ -260,6 +262,7 @@ def test_restart_calls_systemctl_restart(self, mocker):
             ["sudo", "systemctl", "restart", "onetime-web@7043"],
             capture_output=True,
             text=True,
+            timeout=90,
         )
 
     def test_restart_raises_systemctl_error_on_failure(self, mocker):