/ README.md
README.md
1 **DEPRECATED** this action is in maintenance-only mode and will not be 2 accepting new features. 3 4 Please switch to using [pre-commit.ci] which is faster and has more features. 5 6 [pre-commit.ci]: https://pre-commit.ci 7 8 ___ 9 10 [](https://results.pre-commit.ci/latest/github/pre-commit/action/main) 11 [](https://github.com/pre-commit/action/actions) 12 13 pre-commit/action 14 ================= 15 16 a GitHub action to run [pre-commit](https://pre-commit.com) 17 18 ### using this action 19 20 To use this action, make a file `.github/workflows/pre-commit.yml`. Here's a 21 template to get started: 22 23 ```yaml 24 name: pre-commit 25 26 on: 27 pull_request: 28 push: 29 branches: [main] 30 31 jobs: 32 pre-commit: 33 runs-on: ubuntu-latest 34 steps: 35 - uses: actions/checkout@v3 36 - uses: actions/setup-python@v3 37 - uses: pre-commit/action@v3.0.0 38 ``` 39 40 This does a few things: 41 42 - clones the code 43 - installs python 44 - sets up the `pre-commit` cache 45 46 ### using this action with custom invocations 47 48 By default, this action runs all the hooks against all the files. `extra_args` 49 lets users specify a single hook id and/or options to pass to `pre-commit run`. 50 51 Here's a sample step configuration that only runs the `flake8` hook against all 52 the files (use the template above except for the `pre-commit` action): 53 54 ```yaml 55 - uses: pre-commit/action@v3.0.0 56 with: 57 extra_args: flake8 --all-files 58 ``` 59 60 ### using this action in private repositories 61 62 prior to v3.0.0, this action had custom behaviour which pushed changes back to 63 the pull request when supplied with a `token`. 64 65 this behaviour was removed: 66 - it required a PAT (didn't work with short-lived `GITHUB_TOKEN`) 67 - properly hiding this `input` from the installation and execution of hooks 68 is intractable in github actions (it is readily available as `$INPUT_TOKEN`) 69 - this meant potentially unvetted code could access the token via the 70 environment 71 72 you can _likely_ achieve the same thing with an external action such as 73 [git-auto-commit-action] though you may want to take precautions to clear `git` 74 hooks or other ways that arbitrary code execution can occur when running 75 `git commit` / `git push` (for example [core.fsmonitor]). 76 77 while unrelated to this action, [pre-commit.ci] avoids these problems by 78 installing and executing isolated from the short-lived repository-scoped 79 [installation access token]. 80 81 [git-auto-commit-action]: https://github.com/stefanzweifel/git-auto-commit-action 82 [core.fsmonitor]: https://github.blog/2022-04-12-git-security-vulnerability-announced/ 83 [pre-commit.ci]: https://pre-commit.ci 84 [installation access token]: https://docs.github.com/en/rest/apps/apps#create-an-installation-access-token-for-an-app