ci: run pre-commit on pull requests

.devcontainer/devcontainer.json

@@ -22,4 +22,3 @@
 
   "onCreateCommand": "bash .devcontainer/post-install.sh"
 }
-

.github/workflows/pre-commit.yml

@@ -0,0 +1,33 @@
+name: pre-commit
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    # The Go hooks (go-fmt, go-vet) are skipped here: Go formatting and vetting
+    # are already enforced by the golangci-lint workflow (lint.yml), and the
+    # dnephin/pre-commit-golang go-vet hook is incompatible with this repo's
+    # module layout (fails with "no Go files in <root>"). This job scopes
+    # pre-commit to the Python (ruff) and generic hooks that run reliably.
+    env:
+      SKIP: go-fmt,go-vet
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
+      - run: uvx pre-commit run --all-files --show-diff-on-failure

.pre-commit-config.yaml

@@ -1,10 +1,18 @@
+ci:
+  # Go formatting/vetting is enforced by the golangci-lint workflow (lint.yml).
+  # The dnephin/pre-commit-golang go-vet hook is also incompatible with this
+  # repo's single-root-go.mod layout (fails with "no Go files in <root>"), so
+  # skip both Go hooks on pre-commit.ci to keep it green.
+  skip: [go-fmt, go-vet]
+
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
       - id: check-yaml
+        args: [--allow-multiple-documents]
       - id: check-merge-conflict
 
   - repo: https://github.com/astral-sh/ruff-pre-commit

hack/boilerplate.go.txt

@@ -12,4 +12,4 @@ distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
-*/
+*/

plugin/examples/with-cw.py

@@ -14,7 +14,6 @@
 @app.cell
 def check_mount():
     import os
-    import subprocess
 
     # Check default mount location
     mount_dir = "/home/marimo/notebooks/mounts"

plugin/kubectl_marimo/deploy.py

@@ -122,11 +122,11 @@ def ensure_cw_credentials(namespace: str | None) -> bool:
         return False
 
     # Step 4: Show what we're about to do
-    click.echo(f"\nS3 Credentials:")
+    click.echo("\nS3 Credentials:")
     click.echo(f"  Namespace:    {ns_display}")
     click.echo(f"  Secret:       {secret_name} (will create)")
     click.echo(f"  Source:       ~/.s3cfg [{section}]")
-    click.echo(f"  Access Key:   ***")
+    click.echo("  Access Key:   ***")
 
     # Step 5: Confirm with user if in interactive terminal
     if sys.stdin.isatty():

plugin/tests/test_deploy.py

@@ -482,7 +482,7 @@ def test_uses_namespace_for_section_lookup(self, mocker, tmp_path):
         mocker.patch("os.path.expanduser", return_value=str(s3cfg))
         mocker.patch("os.path.exists", return_value=True)
         mocker.patch("sys.stdin.isatty", return_value=False)
-        mock_echo = mocker.patch("kubectl_marimo.deploy.click.echo")
+        mocker.patch("kubectl_marimo.deploy.click.echo")
 
         mock_result = mocker.Mock()
         mock_result.returncode = 0

plugin/tests/test_status.py

@@ -1,9 +1,7 @@
 """Tests for status command."""
 
 import json
-from pathlib import Path
 
-from click.testing import CliRunner
 
 from kubectl_marimo.status import show_status, format_elapsed