Skip to content

feat: add prek pre-commit hooks and dependabot#1720

Merged
steipete merged 2 commits intoopenclaw:mainfrom
dguido:feat/prek-precommit-hooks
Jan 25, 2026
Merged

feat: add prek pre-commit hooks and dependabot#1720
steipete merged 2 commits intoopenclaw:mainfrom
dguido:feat/prek-precommit-hooks

Conversation

@dguido
Copy link
Contributor

@dguido dguido commented Jan 25, 2026 •
edited
Loading

Summary

  • Add prek pre-commit hooks matching CI setup
  • Add Dependabot configuration for automated dependency updates

Pre-commit hooks (14 total)

Hook Purpose
trailing-whitespace Remove trailing whitespace
end-of-file-fixer Ensure files end with newline
check-yaml Validate YAML syntax
check-added-large-files Block files >500KB
check-merge-conflict Detect merge conflict markers
detect-secrets Scan for leaked secrets
shellcheck Lint shell scripts (errors only)
actionlint Lint GitHub Actions workflows
zizmor GitHub Actions security audit
oxlint TypeScript/JavaScript linting
oxfmt TypeScript/JavaScript formatting
swiftlint Swift linting
swiftformat Swift formatting

Dependabot (6 ecosystems)

Ecosystem Directory Purpose
npm / Node.js dependencies (pnpm workspace)
github-actions / CI workflow actions
swift /apps/macos macOS app dependencies
swift /apps/shared/ClawdbotKit Shared Swift library
swift /Swabble Swabble framework
gradle /apps/android Android app dependencies

All ecosystems configured with:

  • Weekly update schedule
  • 7-day cooldown for supply chain protection
  • Grouped updates (minor + patch batched together)

Config files added

  • .pre-commit-config.yaml - Hook definitions
  • .github/actionlint.yaml - Blacksmith runner labels + ignore patterns
  • .github/dependabot.yml - All ecosystems with grouped updates + cooldown
  • .shellcheckrc - Disable false positive rules
  • zizmor.yml - Relaxed security audit config

Test plan

  • prek run --all-files passes all 14 hooks
  • No false positives in baseline checks

🤖 Generated with Claude Code

@dguido dguido force-pushed the feat/prek-precommit-hooks branch 2 times, most recently from 613e4b3 to 7ea75ea Compare January 25, 2026 07:12
@dguido
Copy link
Contributor Author

dguido commented Jan 25, 2026

Added zizmor (GitHub Actions security audit) with relaxed configuration:

  • Disabled unpinned-uses (SHA pinning is a significant change)
  • Disabled excessive-permissions (needs careful per-workflow review)
  • Disabled artipacked (low confidence finding)

All 14 hooks now pass.

@dguido dguido force-pushed the feat/prek-precommit-hooks branch from 7ea75ea to a53f61f Compare January 25, 2026 07:14
@dguido dguido changed the title feat: add prek pre-commit hooks feat: add prek pre-commit hooks and dependabot Jan 25, 2026
@dguido @claude
feat: add prek pre-commit hooks and dependabot
4cfeaf1 
Pre-commit hooks (via prek):
- Basic hygiene: trailing-whitespace, end-of-file-fixer, check-yaml, check-added-large-files, check-merge-conflict
- Security: detect-secrets, zizmor (GitHub Actions audit)
- Linting: shellcheck, actionlint, oxlint, swiftlint
- Formatting: oxfmt, swiftformat

Dependabot:
- npm and GitHub Actions ecosystems
- Grouped updates (production/development/actions)
- 7-day cooldown for supply chain protection

Co-Authored-By: Claude Opus 4.5 <[email protected]>
@dguido dguido force-pushed the feat/prek-precommit-hooks branch from a53f61f to 4cfeaf1 Compare January 25, 2026 07:15
@dguido
Copy link
Contributor Author

dguido commented Jan 25, 2026 •
edited
Loading

FWIW pre-commit hooks have been a god-send for getting a tighter build-test-deploy lifecycle with LLMs. This should ease the pain on your CI and get more people to PR you code that passes tests.

prek is incredibly fast and the new standard for pre-commit hooks: https://github.com/j178/prek. This appears to match your revealed preferences with oxlint and oxfmt. I also added precommit checks for shellscripts and Github Actions that you may want to consider for CI.

Also IMHO The checks-macos runner seems to be flaky. I think it may need a longer timeout. There's nothing we changed here that should have caused it to fail.

@steipete
Copy link
Contributor

steipete commented Jan 25, 2026

Oh this is slick, thanks Dan! Appreciate the work!

@steipete
Copy link
Contributor

steipete commented Jan 25, 2026

Screenshot 2026-01-25 at 10 28 20

new dependency = new sponsor

steipete added a commit that referenced this pull request Jan 25, 2026
@steipete
chore: add changelog entry for prek hooks (#1720) (thanks @dguido)
ad5df9e
@steipete steipete merged commit 48aea87 into openclaw:main Jan 25, 2026
21 of 22 checks passed
steipete added a commit that referenced this pull request Jan 25, 2026
@steipete
chore: stabilize prek hooks runner selection (#1720) (thanks @dguido)
50f233d
@steipete
Copy link
Contributor

steipete commented Jan 25, 2026

Landed via temp rebase onto main.\n\n- Gate: pnpm lint && pnpm build && pnpm test\n- Land commit: ad5df9e\n- Merge commit: 48aea87\n\nThanks @dguido!

@dguido dguido deleted the feat/prek-precommit-hooks branch January 25, 2026 17:49
rodrigouroz pushed a commit to rodrigouroz/openclaw that referenced this pull request Jan 26, 2026
@dguido @claude @rodrigouroz
feat: add prek pre-commit hooks and dependabot (openclaw#1720)
59806e2 
* feat: add prek pre-commit hooks and dependabot

Pre-commit hooks (via prek):
- Basic hygiene: trailing-whitespace, end-of-file-fixer, check-yaml, check-added-large-files, check-merge-conflict
- Security: detect-secrets, zizmor (GitHub Actions audit)
- Linting: shellcheck, actionlint, oxlint, swiftlint
- Formatting: oxfmt, swiftformat

Dependabot:
- npm and GitHub Actions ecosystems
- Grouped updates (production/development/actions)
- 7-day cooldown for supply chain protection

Co-Authored-By: Claude Opus 4.5 <[email protected]>

* docs: add prek install instruction to AGENTS.md

---------

Co-authored-by: Claude Opus 4.5 <[email protected]>
rodrigouroz pushed a commit to rodrigouroz/openclaw that referenced this pull request Jan 26, 2026
@steipete @rodrigouroz
chore: stabilize prek hooks runner selection (openclaw#1720) (thanks @…
1bacf17 
…dguido)
dgarson pushed a commit to dgarson/clawdbot that referenced this pull request Feb 2, 2026
@dguido @claude @dgarson
feat: add prek pre-commit hooks and dependabot (openclaw#1720)
abdb0d7 
* feat: add prek pre-commit hooks and dependabot

Pre-commit hooks (via prek):
- Basic hygiene: trailing-whitespace, end-of-file-fixer, check-yaml, check-added-large-files, check-merge-conflict
- Security: detect-secrets, zizmor (GitHub Actions audit)
- Linting: shellcheck, actionlint, oxlint, swiftlint
- Formatting: oxfmt, swiftformat

Dependabot:
- npm and GitHub Actions ecosystems
- Grouped updates (production/development/actions)
- 7-day cooldown for supply chain protection

Co-Authored-By: Claude Opus 4.5 <[email protected]>

* docs: add prek install instruction to AGENTS.md

---------

Co-authored-by: Claude Opus 4.5 <[email protected]>
dgarson pushed a commit to dgarson/clawdbot that referenced this pull request Feb 2, 2026
@steipete @dgarson
chore: stabilize prek hooks runner selection (openclaw#1720) (thanks @…
988bcc2 
…dguido)
@ThatGuySam ThatGuySam mentioned this pull request Feb 17, 2026
Closed
dominicnunez pushed a commit to dominicnunez/openclaw that referenced this pull request Feb 26, 2026
@steipete
chore: add changelog entry for prek hooks (openclaw#1720) (thanks @dg…
819b3ba 
…uido)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dguido @steipete