pre-commit, A Local Hook That Fails, Then Passes

pre-commit

The pre-commit CLI (pre-commit) on EL 10, pinned to a version, in a virtual environment of its own with a link in the PATH. Original role for EL 10, live-tested with podman on Rocky Linux 10.

There is no package; the documented install is pip. EL 10 carries no pre-commit, and pip install into the system Python ties the CLI's dependencies to whatever the OS ships. This role puts the CLI in /opt/pre-commit, a venv apart from the system Python: an OS update cannot break it, and it cannot break the OS. The live test asserts import pre_commit fails in /usr/bin/python3.

Pinned, and checked for consistency. pre_commit_version is what gets installed; the live test runs pip check inside the venv and expects no broken requirements.

pip verifies nothing beyond TLS. The index is PyPI over HTTPS; there is no signature to check. For a byte-for-byte pin, give pre_commit_pip_extra_args a requirements file with hashes and --require-hashes, or a private index.

Proven to run. The live test calls pre-commit run --all-files and expects "- exit code: 1" - the whole tree loaded and the hook runner did its work.

A local hook that fails, then passes. The live test makes a repository with a repo: local hook (a shell script that refuses files holding a word) and two staged files; pre-commit run --all-files is expected to exit 1 naming the offending file, and to exit 0 with "Passed" once that file is removed. No hook repository is cloned: the hook is local, so the test proves the runner without the network. git is installed by the role because pre-commit cannot run without it.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.