Problem
The quality gate runs pre-commit hooks only, and no hook covers Python. A repo scaffolded from this template that later grows Python code gets no test or lint gating for it — the suite runs only when someone remembers to run it by hand. This happened in DenWin/openIdea#2: 30 pytest cases existed with green local runs, but CI never executed them.
Proposal (ported from openIdea, commit DenWin/openIdea@872b6be)
All additions are file-scoped, so in a repo without Python files every one of them is a no-op:
-
Managed lint hooks — astral-sh/ruff-pre-commit (ruff-check, ruff-format). Both match *.py only.
-
Local test hook — pytest fast lane under the same orchestrator as every other check:
- id: pytest-fast
name: pytest (fast lane)
entry: uv run pytest -q
language: system
pass_filenames: false
files: (\.py$|^pyproject\.toml$|^uv\.lock$)
stages: [pre-commit]
The files: filter means scoped PR runs skip it when no Python changed, and a repo with no Python never triggers it at all.
-
Workflow — one pinned step in quality-gate.yml so CI can back the hook: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2. Harmless when the hook never fires.
-
Convention note — repos that grow an application should commit uv.lock, so CI resolves the exact environment used locally.
Bash analog
shellcheck + shfmt are already file-scoped no-ops, so Bash linting needs nothing. If shell scripts ever gain tests, apply the same pattern: bats-core as a local hook with a files: \.(sh|bats)$ filter — dormant until the first script/test exists, no gate changes needed on that day.
Related fix worth porting
The gate's token has contents: read only, but gitleaks-action v3 lists PR commits via the API on pull_request events and 403s without pull-requests: read — every PR fails before any check runs. Fixed in openIdea commit DenWin/openIdea@2657d57 (adds the read scope, token stays read-only).
Problem
The quality gate runs pre-commit hooks only, and no hook covers Python. A repo scaffolded from this template that later grows Python code gets no test or lint gating for it — the suite runs only when someone remembers to run it by hand. This happened in DenWin/openIdea#2: 30 pytest cases existed with green local runs, but CI never executed them.
Proposal (ported from openIdea, commit DenWin/openIdea@872b6be)
All additions are file-scoped, so in a repo without Python files every one of them is a no-op:
Managed lint hooks —
astral-sh/ruff-pre-commit(ruff-check,ruff-format). Both match*.pyonly.Local test hook — pytest fast lane under the same orchestrator as every other check:
The
files:filter means scoped PR runs skip it when no Python changed, and a repo with no Python never triggers it at all.Workflow — one pinned step in
quality-gate.ymlso CI can back the hook:astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2. Harmless when the hook never fires.Convention note — repos that grow an application should commit
uv.lock, so CI resolves the exact environment used locally.Bash analog
shellcheck+shfmtare already file-scoped no-ops, so Bash linting needs nothing. If shell scripts ever gain tests, apply the same pattern:bats-coreas a local hook with afiles: \.(sh|bats)$filter — dormant until the first script/test exists, no gate changes needed on that day.Related fix worth porting
The gate's token has
contents: readonly, but gitleaks-action v3 lists PR commits via the API onpull_requestevents and 403s withoutpull-requests: read— every PR fails before any check runs. Fixed in openIdea commit DenWin/openIdea@2657d57 (adds the read scope, token stays read-only).