build(ci): adopt prek for pre-commit hooks and CI autoformat#118
Merged
Conversation
Swap the `pre-commit` dev dependency for `prek`, a drop-in runner for the same `.pre-commit-config.yaml` (ruff + mypy). `.envrc` now installs the git pre-commit hook automatically on `direnv` load. Add a `pre-commit` CI workflow that runs the hooks on changed files for every pull request and pushes any autofixes back to trusted same-repo PRs using the SENTRY_INTERNAL_APP token. The mypy hook excludes `bin/` to match CI's `mypy .` scope, which only checks `.py` files. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
cmanallen
approved these changes
Jul 14, 2026
billyvg
added a commit
that referenced
this pull request
Jul 14, 2026
## Summary Applies `ruff format` across the codebase (including the shebang'd `bin/` scripts that prek's hook picks up). Formatting-only — no behavior changes. This is the prerequisite for #118, which adopts prek and enforces these hooks in CI. **Merge this first** so #118's CI passes cleanly. ## Test plan - `uv run ruff check .` and `uv run ruff format --check .` pass. - Full test suite passes (802 tests). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
billyvg
commented
Jul 14, 2026
|
|
||
| env: | ||
| # Secrets cannot be referenced directly in `if` expressions. | ||
| SECRET_ACCESS: ${{ toJSON(secrets.SENTRY_INTERNAL_APP_PRIVATE_KEY != null) }} |
Member
Author
There was a problem hiding this comment.
repo should have access to this org secret, we'll find out i guess
Drop the push-to-main trigger; the hooks only need to gate PRs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
Pin every third-party action reference to a full commit SHA (with a version comment) to protect against tag-hijacking supply-chain attacks. Covers the new pre-commit workflow as well as the pre-existing build, tests, and release workflows, which were on floating major tags. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit ae71c5a. Configure here.
- Detect an unset SENTRY_INTERNAL_APP_PRIVATE_KEY by comparing against '' — an absent secret is an empty string, not null, so the old guard was always true and the auth-token step ran (and failed) instead of being skipped. - Key the prek cache on .python-version rather than env.pythonLocation, which setup-uv (unlike setup-python) never sets, so the version was omitted and a stale cache could survive a Python upgrade. - Add xargs -r so an all-deletions PR (empty file list) doesn't invoke prek with no arguments. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adopts prek — a drop-in
pre-commitrunner — for local hooks and adds a CI workflow that runs the same hooks and auto-applies formatting fixes. Modeled on the seer and sentry repos.Important
The formatting changes prek surfaces on the existing codebase are not in this PR. They live in a separate formatting-only PR that should be merged first so this branch's CI passes cleanly.
Changes
pyproject.toml/uv.lock— swappre-commitdev dependency forprek..envrc— install the git pre-commit hook automatically ondirenvload (errors out withuv synchint if prek is missing)..pre-commit-config.yaml— same ruff + mypy hooks; addexclude: ^bin/to mypy so the hook matches CI'smypy .scope (which only checks.pyfiles, not the shebang'dbin/CLI scripts)..github/workflows/pre-commit.yml— runs on PRs and pushes tomain. Runs prek over changed files (viadorny/paths-filter), caches~/.cache/prek, and on failure pushes autofixes back to trusted same-repo non-draft PRs using theSENTRY_INTERNAL_APPtoken before failing the job.AGENTS.md— document the linting/formatting setup.Notes
SENTRY_INTERNAL_APP_ID(var) andSENTRY_INTERNAL_APP_PRIVATE_KEY(secret) to be available to the repo for autofix pushes. If absent, the autofix step is skipped gracefully and the job simply fails on lint.Test plan
uv run prek run --all-filespasses all hooks (post-formatting).uv run mypy .succeeds; full test suite passes (802 tests).🤖 Generated with Claude Code