Base CI: the full pre-commit base CI, with lint required after merge (base-ci-T008) (#54)

Co-authored-by: Bruno Guilhermo de Barros Valério <[email protected]>
Co-authored-by: Claude Sonnet 5.5 <[email protected]>

.github/workflows/lint.yml

@@ -0,0 +1,29 @@
+# The base CI: the required check "lint". It runs the repo's pre-commit hooks on every file, then
+# gitleaks over the whole history. Written by ouroboric/scripts/add-ci.sh; change the hooks in
+# .pre-commit-config.yaml, not here.
+name: lint
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+permissions:
+  contents: read
+jobs:
+  lint:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.13"
+      - name: install pre-commit
+        run: pip install pre-commit==4.6.2
+      - name: hooks
+        run: pre-commit run --all-files --show-diff-on-failure
+      - name: gitleaks over the history
+        run: pre-commit run --hook-stage manual gitleaks-history --all-files

.markdownlint.yaml

@@ -0,0 +1,15 @@
+default: true
+# gofmt requires tabs, and the plan tools copy plan code verbatim.
+MD010:
+  code_blocks: false
+MD013: false
+MD024:
+  siblings_only: true
+MD025:
+  front_matter_title: ""
+# The docs standard prescribes <picture> for themed images, and the org profile opens with <img>.
+MD033:
+  allowed_elements: [picture, source, img]
+# Journal entries, PR templates, Claude skill files and the org profile banner open without an H1 on purpose;
+# every other doc's title is checked by the docs standard's front matter rule.
+MD041: false

.pre-commit-config.yaml

@@ -3,3 +3,28 @@ repos:
     rev: v8.30.1
     hooks:
       - id: gitleaks
+      - id: gitleaks
+        alias: gitleaks-history
+        name: Detect hardcoded secrets in the whole history
+        entry: gitleaks git --redact --verbose
+        stages: [manual]
+  - repo: https://github.com/fsfe/reuse-tool
+    rev: v5.0.2
+    hooks:
+      - id: reuse
+  - repo: https://github.com/DavidAnson/markdownlint-cli2
+    rev: v0.23.3
+    hooks:
+      - id: markdownlint-cli2
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.11.0.1
+    hooks:
+      - id: shellcheck
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.12
+    hooks:
+      - id: actionlint
+  - repo: https://github.com/adrienverge/yamllint
+    rev: v1.38.0
+    hooks:
+      - id: yamllint

.shellcheckrc

@@ -0,0 +1,4 @@
+# The shellcheck-py hook passes no -x, so SC1091 fires when a sourced file is not among the hook's
+# inputs (a commit that changes only the script that sources it), even with source-path directives.
+# This makes shellcheck follow and check sourced files: stricter, not looser.
+external-sources=true

.yamllint

@@ -0,0 +1,4 @@
+extends: .yamllint.yaml
+
+# The pieces are fragments indented to sit under repos: (the piece contract), not YAML documents.
+ignore: scripts/templates/ci/pieces/

.yamllint.yaml

@@ -0,0 +1,7 @@
+extends: default
+rules:
+  line-length:
+    max: 120
+  document-start: disable
+  truthy:
+    check-keys: false