ci: add pre-commit hooks and workflow

.github/dependabot.yml

@@ -1,4 +1,5 @@
 version: 2
+
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -9,10 +10,7 @@ updates:
         update-types:
           - "minor"
           - "patch"
-
   - package-ecosystem: "gomod"
-    directories:
-      - "/*"
-      - "/*/*"
+    directory: "/"
     schedule:
       interval: "daily"

.github/workflows/pre-commit.yaml

@@ -0,0 +1,42 @@
+name: pre-commit
+
+on:
+  push:
+    branches:
+      - "main" # required to create a usable cache for other PRs
+  pull_request:
+    branches:
+      - "main"
+
+permissions: {}
+
+jobs:
+  lint:
+    name: pre-commit checks
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0 # required for --from-ref and --to-ref
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - run: |
+          python -m pip install pre-commit
+          python -m pip freeze --local
+      - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        id: cache
+        with:
+          path: ~/.cache/pre-commit
+          key: ${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
+      # A cache miss means that the pre-commit config changed and we should check everything
+      # Otherwise, we can just check modified files which will be much faster
+      - if: steps.cache.outputs.cache-hit != 'true'
+        run: pre-commit run --show-diff-on-failure --color=always --all-files
+      - if: steps.cache.outputs.cache-hit == 'true'
+        run: pre-commit run --show-diff-on-failure --color=always --from-ref HEAD^^^ --to-ref HEAD

.markdownlint-cli2.yaml

@@ -0,0 +1,7 @@
+config:
+  MD013:
+    line_length: 120
+  MD046:
+    style: fenced
+  MD060:
+    style: compact

.pre-commit-config.yaml

@@ -0,0 +1,34 @@
+# Pre-commit configuration for tw repository
+# Install: pip install pre-commit
+# Setup: pre-commit install
+# Run manually: pre-commit run --all-files
+repos:
+  - repo: https://github.com/chainguard-dev/yam
+    rev: d05ffb50d1a8f8e7047a77e57280147ff19809d4 # frozen: v0.2.54
+    hooks:
+      - id: yam
+        files: '\.ya?ml$'
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
+    hooks:
+      - id: check-yaml
+        files: '\.ya?ml$'
+      - id: check-merge-conflict
+      - id: check-added-large-files
+      - id: check-case-conflict
+      - id: detect-private-key
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+  # Ensure markdown files pass stereo's markdownlint checks when synced
+  - repo: https://github.com/DavidAnson/markdownlint-cli2
+    rev: 3766ad839ad3a74558031510b3bc9872bb1d9980 # frozen: v0.22.0
+    hooks:
+      - id: markdownlint-cli2
+        files: '\.md$'
+  - repo: local
+    hooks:
+      - id: shellcheck
+        name: shellcheck
+        entry: make shellcheck
+        language: system
+        pass_filenames: false

README.md

@@ -1,13 +1,17 @@
 # tw (tee-dub)
+
 tw (pronounced tee-dub) is a centralized repository for testing and building
 tools or helpers.
 
 ## Release to stereo
+
 To release a version of tw to stereo, run tools/release-to-stereo.
 
-    $ git tag vX.Y.Z
-    $ git push origin vX.Y.Z
-    $ ./tools/release-to-stereo vX.Y.Z ~/git/cg/chainguard-dev/stereo/
+```bash
+git tag vX.Y.Z
+git push origin vX.Y.Z
+./tools/release-to-stereo vX.Y.Z ~/git/cg/chainguard-dev/stereo/
+```
 
 This takes care of updating the `tw.yaml` file from `melange.yaml`,
 and syncs the pipeline files for other dirs.
@@ -19,6 +23,7 @@ That will do a commit and you just need to push and do a PR.
 This repository contains three types of tests to ensure quality and correctness:
 
 ### 1. Main Package Tests (`test-melange`)
+
 Tests the main `tw` package defined in `melange.yaml`.
 
 ```bash
@@ -28,6 +33,7 @@ make test-melange
 This validates that the tw tools package builds and functions correctly.
 
 ### 2. Project Tests (`test-projects`)
+
 Tests individual project subdirectories (e.g., `ldd-check`, `package-type-check`, `gosh`, etc.).
 
 ```bash
@@ -41,6 +47,7 @@ make test-project/package-type-check
 Each project directory contains its own test suite specific to that tool.
 
 ### 3. Pipeline Validation Tests (`test-pipelines`)
+
 Tests the pipeline validators located in `pipelines/test/tw/` using test packages in `tests/`.
 
 ```bash
@@ -52,17 +59,20 @@ This runs a complete test suite that:
 4. Runs pipeline validation tests against those packages
 
 **Test files structure:**
+
 - `tests/docs-test.yaml` - Tests the `pipelines/test/tw/docs.yaml` pipeline
 - `tests/staticpackage-test.yaml` - Tests the `pipelines/test/tw/staticpackage.yaml` pipeline
 - `tests/emptypackage-test.yaml` - Tests the `pipelines/test/tw/emptypackage.yaml` pipeline
 
 Each test file contains:
+
 - **Positive tests**: Valid packages that should pass the pipeline check
 - **Negative tests**: Invalid packages that should be rejected by the pipeline
 
 More about the pipeline tests can be found in the [tests/README.md](tests/README.md) file.
 
 ### 4. Run All Tests
+
 Run the complete test suite (all three test types):
 
 ```bash
@@ -72,6 +82,7 @@ make test-all
 This executes all tests in sequence: `test-melange` → `test-projects` → `test-pipelines`
 
 ### 5. Individual Test Targets
+
 For more granular control:
 
 ```bash
@@ -83,16 +94,16 @@ make run-pipeline-tests       # Only run pipeline tests (assumes already built)
 
 To test a tw pipeline in a local stereo repository, you need the following steps:
 
-* Build the tw tools package in this repository, `make build`.
-* If required, sync the pipeline yaml to stereo by hand.
-* If required, build the melange package with the new pipeline, in the stereo repository.
-* If required, test the melange package with the new pipeline, in the stereo repository.
+- Build the tw tools package in this repository, `make build`.
+- If required, sync the pipeline yaml to stereo by hand.
+- If required, build the melange package with the new pipeline, in the stereo repository.
+- If required, test the melange package with the new pipeline, in the stereo repository.
 
 Most likely, you need to tell the melange build in the stereo repository to use the tw index.
 
 A complete example:
 
-```
+```console
 user@debian:~git/tw $ make build
 user@debian:~git/tw $ cp pipelines/test/tw/something.yaml ~/git/stereo/os/pipelines/test/tw/
 user@debian:~git/tw $ cd ~/git/stereo/enterprise-packages/

header-check/README.md

@@ -2,4 +2,5 @@
 
 This is a script that checks the usability of .h and .hpp header files, as installed.
 
-It will generate a basic ```configure.ac``` script, run ```autoconf``` and ```./configure```, and check the header file installed is usable in an ```autoconf``` context.
+It will generate a basic ```configure.ac``` script, run ```autoconf``` and ```./configure```,
+and check the header file installed is usable in an ```autoconf``` context.

no-docs-check/Makefile

@@ -15,4 +15,4 @@ clean:
 
 melange-install: build
 	mkdir -p $(MELANGE_INSTALL_PATH)
-	install -Dm755 no-docs-check $(MELANGE_INSTALL_PATH)/no-docs-check
+	install -Dm755 no-docs-check $(MELANGE_INSTALL_PATH)/no-docs-check

package-type-check/Makefile

@@ -15,4 +15,4 @@ clean:
 
 melange-install: build
 	mkdir -p $(MELANGE_INSTALL_PATH)
-	install -Dm755 package-type-check $(MELANGE_INSTALL_PATH)/package-type-check
+	install -Dm755 package-type-check $(MELANGE_INSTALL_PATH)/package-type-check