docs: How to use pre-commit-terraform image to run pre-commit in CI

[stevie-]

Put an x into the box if that apply:

• This PR introduces breaking change.
• This PR fixes a bug.
• This PR adds new functionality.
• This PR enhances existing functionality.

Description of your changes

Fixes #655

How can we test changes

uses existing workflow but tries to run similar steps with the managed container instead of pre install all dependencies.

This helps to

• give an example how to use the image with github action
• makes sure we test the container

[MaxymVlasov]

Okay, before we move forward, I'd like to have the answer to the next question:

Would you like to add a fully functional replacement for the current GH workflow[1], or just show the possibility of docker image usage in GHA[2]?

Btw, [1] little bit related to #373

[stevie-]

[2] - show both ways seems to be a good idea to me.

[yermulnik]

[2] - show both ways seems to be a good idea to me.

I guess the .github/workflows/pre-commit.yaml is among active workflows in this repo and hence running the same thing twice might not be desired 🤔

[MaxymVlasov]

Yeah. If just show that it is possible, please:

1. Update the Readme example with the fixed version from .github/workflows/pre-commit.yaml
2. Revert changes in .github/workflows/pre-commit.yaml

[stevie-]

This would mean, that you don't actively check the current container image within GHA.

[MaxymVlasov]

According to your answer to my question above, you not plan to provide a " fully functional replacement for the current GH workflow[1]"

And we definitely won't to decrease the current test coverage. Current realization in this PR will fail on hadolint, shfmt, and shellcheck hooks as there are no such dependencies inside Docker image. (and these checks are vital for .sh and .dockerfile)

And also, it will not push fixes back to branch.

[stevie-]

FYI: The install of additional tools should also work in the container version.

[MaxymVlasov]

Suggested change

	Here is another more simple example which includes caching of pre-commit dependencies and uses the `pre-commit` command to run the checks.
	Here is another example that includes caching of pre-commit dependencies and uses the `pre-commit` command to run the checks (but fixes will not automatically push back to your branch, when it possible):

[yermulnik]

@MaxymVlasov : but fixes will be not automatically pushed back to your branch (not sure about the gist of when clause though)

[stevie-]

I don't see, where the original workflow pushes changes found by pre-commit? Or do you want to be just very specific?

[MaxymVlasov]

I hope this PR and screencast will help
#658
Screencast from 15.04.24 18:59:50.webm

Push fixes part in GHA:
https://github.com/antonbabenko/pre-commit-terraform/actions/runs/8692274320/job/23836525488?pr=658#step:10:133

[MaxymVlasov]

pre-commit-terraform/.github/workflows/pre-commit.yaml

Lines 42 to 56 in 42919f3

	- name: Execute pre-commit
	uses: pre-commit/action@9b88afc9cd57fd75b655d5c71bd38146d07135fe # v2.0.3
	env:
	SKIP: no-commit-to-branch,hadolint
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	extra_args: --color=always --show-diff-on-failure --files ${{ steps.file_changes.outputs.files }}
	# Run only skipped checks
	- name: Execute pre-commit check that have no auto-fixes
	if: always()
	uses: pre-commit/action@9b88afc9cd57fd75b655d5c71bd38146d07135fe # v2.0.3
	env:
	SKIP: check-added-large-files,check-merge-conflict,check-vcs-permalinks,forbid-new-submodules,no-commit-to-branch,end-of-file-fixer,trailing-whitespace,check-yaml,check-merge-conflict,check-executables-have-shebangs,check-case-conflict,mixed-line-ending,detect-aws-credentials,detect-private-key,shfmt,shellcheck
	with:
	extra_args: --color=always --show-diff-on-failure --files ${{ steps.file_changes.outputs.files }}

There 2 pre-commit runs.
The first one, is able to push fixes. second-one - not. The difference in availability of GITHUB_TOKEN.

That's done in this way because otherwise, hooks without fixes will produce exit code 1, and that stops from pushing fixed to the branch.

I can say GHA "ignore exit code 1", and fixes will be successfully pushed, but then if something will be detected by hooks that have no autofixes - there will be no notification about that, except inside logs in "successfully done" GHA

[stevie-]

I missed, that you don't use the latest version of the pre-commit/action which has no push support anymore.

So, if the 2nd run doesn't push changes, wouldn't this be a good candidate to be replaced by the container version?

[MaxymVlasov]

Still no hadolint dependency inside image. It will check nothing from pre-commit-hooks (all of them, which we use here have autofixes or at least do not break the first check when fail) nor pre-commit-terraform repo hooks (as this repo doesn't include any tf code for testing).

If you'd like to make useful tests, check #373.

[stevie-]

With my last commit I see this PR as done. What do you think?

[MaxymVlasov]

Ah, I get it, we never commit .vscode settings for extensions here...
Maybe that's should be done 🤔