Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions .github/workflows/pre-commit.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
# Workflow for running pre-commit checks

Check failure on line 1 in .github/workflows/pre-commit.yml

View check run for this annotation

Trunk.io / Trunk Check

checkov(CKV2_GHA_1)

[new] Ensure top-level permissions are not set to write-all
name: Pre-commit

on:
pull_request:
push:
branches: [main]

jobs:
pre-commit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-python@v3
with:
python-version: "3.12"
- uses: pre-commit/[email protected]

Check warning on line 17 in .github/workflows/pre-commit.yml

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

.github/workflows/pre-commit.yml#L17

An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.
Comment on lines +11 to +17

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI about 1 month ago

To fix the problem, you should add a permissions block that restricts the GITHUB_TOKEN permissions to the minimum required. For most pre-commit/CHECK-type jobs that only need to read repository code, setting permissions: contents: read suffices, unless the workflow specifically needs to write to pull requests or issues (which it does not appear to from the provided actions). The recommended approach is to add this permissions block at the workflow level (just after the name: and before on:), so it applies to all jobs unless otherwise specified. You should insert:

permissions:
  contents: read

at line 3, pushing the on: and subsequent lines down. No import or variable definition is necessary; just a change to the YAML structure.

Suggested changeset 1
.github/workflows/pre-commit.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -1,5 +1,7 @@
 # Workflow for running pre-commit checks
 name: Pre-commit
+permissions:
+  contents: read
 
 on:
   pull_request:
EOF
@@ -1,5 +1,7 @@
# Workflow for running pre-commit checks
name: Pre-commit
permissions:
contents: read

on:
pull_request:
Copilot is powered by AI and may make mistakes. Always verify output.
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

88 changes: 88 additions & 0 deletions .pre-commit-config.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,88 @@
# Pre-commit configuration file compatible with Trunk.io

Check failure on line 1 in .pre-commit-config.yaml

View check run for this annotation

Trunk.io / Trunk Check

prettier

Incorrect formatting, autoformat by running 'trunk fmt'
# See https://pre-commit.com for more information
# See https://docs.trunk.io/check for Trunk.io integration

default_language_version:
python: python3.12

repos:
# Ruff - Python linter and formatter (replaces Black, isort, flake8, etc.)
- repo: https://github.com/astral-sh/ruff-pre-commit
rev: v0.4.1
hooks:
- id: ruff
args: [--fix, --exit-non-zero-on-fix]
- id: ruff-format

# Prettier - Code formatter for YAML, JSON, Markdown, etc.
- repo: https://github.com/pre-commit/mirrors-prettier
rev: v3.1.0
hooks:
- id: prettier
types_or: [yaml, markdown, json]

# Standard pre-commit hooks
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v5.0.0
hooks:
- id: check-added-large-files
args: [--maxkb=1000]
- id: check-case-conflict
- id: check-merge-conflict
- id: check-yaml
args: [--unsafe] # Allow custom YAML tags
exclude: ^tests/functional/.*/cassettes/.*\.yaml$
- id: check-json
- id: check-toml
- id: end-of-file-fixer
exclude: ^tests/functional/.*/cassettes/.*\.yaml$
- id: trailing-whitespace
exclude: ^tests/functional/.*/cassettes/.*\.yaml$
- id: mixed-line-ending
- id: detect-private-key

# yamllint - YAML linter
- repo: https://github.com/adrienverge/yamllint
rev: v1.35.1
hooks:
- id: yamllint
args: [-c, .trunk/configs/.yamllint.yaml]
exclude: ^tests/functional/.*/cassettes/.*\.yaml$

# markdownlint - Markdown linter
- repo: https://github.com/igorshubovych/markdownlint-cli
rev: v0.39.0
hooks:
- id: markdownlint
args: [-c, .trunk/configs/.markdownlint.yaml]

# Bandit - Python security linter
- repo: https://github.com/PyCQA/bandit
rev: 1.7.8
hooks:
- id: bandit
args: [-c, .trunk/configs/bandit.yaml, -r, .]
exclude: ^tests/

# TruffleHog - Secret scanning (Trunk.io handles this via trufflehog-pre-commit action)
# To enable, uncomment the following:
# - repo: https://github.com/trufflesecurity/trufflehog
# rev: v3.74.0
# hooks:
# - id: trufflehog
# args:
# - git
# - file://.
# - --since-commit
# - HEAD
# - --only-verified
# - --fail

# Commitlint - Commit message linting (Trunk.io handles this via commitlint action)
# To enable, uncomment and run: pre-commit install --hook-type commit-msg
# - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
# rev: v9.16.0
# hooks:
# - id: commitlint
# stages: [commit-msg]
# additional_dependencies: ["@commitlint/config-conventional"]
32 changes: 32 additions & 0 deletions CONTRIBUTING.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# Contributing to Diffbot Knowledge Graph Client

Check failure on line 1 in CONTRIBUTING.md

View check run for this annotation

Trunk.io / Trunk Check

prettier

Incorrect formatting, autoformat by running 'trunk fmt'

First off, thanks for taking the time to contribute!

Expand All @@ -17,10 +17,42 @@
- **Explain which behavior you expected to see instead and why.**
- **Include screenshots and/or animated GIFs** which help demonstrate the steps or point out the part of Indeed Job Scraper which the suggestion is related to.

### Development Setup

#### Pre-commit Hooks

This project uses [pre-commit](https://pre-commit.com/) hooks to automatically check code quality before commits. The configuration is compatible with [Trunk.io](https://trunk.io/).

Check notice on line 24 in CONTRIBUTING.md

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

CONTRIBUTING.md#L24

Expected: 80; Actual: 181

To set up pre-commit hooks:

```bash
pip install pre-commit
pre-commit install
```

The hooks will automatically run on every commit. You can also run them manually:

```bash
# Run on all files
pre-commit run --all-files

# Run on specific files
pre-commit run --files src/diffbot_kg/models.py
```

The pre-commit configuration includes:
- **Ruff**: Python linting and formatting

Check notice on line 44 in CONTRIBUTING.md

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

CONTRIBUTING.md#L44

Lists should be surrounded by blank lines
- **Prettier**: YAML, JSON, and Markdown formatting
- **yamllint**: YAML linting
- **markdownlint**: Markdown linting
- **Bandit**: Python security checks
- Standard checks: trailing whitespace, file endings, merge conflicts, etc.

### Pull Requests

Please follow these steps to have your contribution considered by the maintainer:

- Set up pre-commit hooks (see Development Setup above) to ensure code quality.
- After you submit your pull request, verify that all status checks are passing.
- While the maintainer reviews your PR, you can also ask for specific people to review your changes.
- Once your pull request is created, it will be reviewed by the maintainer of the project. You may be asked to make changes to your pull request. There's always a chance your pull request won't be accepted.
Expand Down
Loading