feat: add pre-commit-hooks+config to use with pre-commit.com

[juju4]

And self-apply in github workflows.

PR Summary

This allows easy integration with pre-commit that can be use to validate/lint code before commit (and also after/server side as per github workflow example).

• .pre-commit-config.yaml is the pre-commit configuration that use a remote or local repo
• .pre-commit-hooks.yaml is required for remote linter/validation repo
• github precommit workflow to test server side. note that this use the PSGallery latest released version to validate current code.

Tested on Macos and Linux.
Note that current workflow fail is related to warnings as seen on https://github.com/juju4/PSScriptAnalyzer/actions/runs/3867323454/jobs/6592019858#step:5:3554
can change severity to errors if prefer.

Further improvement discussion in pre-commit/pre-commit#2645

PR Checklist

• PR has a meaningful title
  • Use the present tense and imperative mood when describing your changes
• Summarized changes
• Change is not breaking
• Make sure all .cs, .ps1 and .psm1 files have the correct copyright header
• Make sure you've added a new test if existing tests do not effectively test the code changed and/or updated documentation
• This PR is ready to merge and is not Work in Progress.
  • If the PR is work in progress, please add the prefix WIP: to the beginning of the title and remove the prefix when the PR is ready.

[JamesWTruher]

shouldn't this just be removed?

[juju4]

If removed, should be somewhere in docs (where?) as user may need to adapt powershell path

[bergmeister]

I don't mind adding a CI enforcement check but against commit hooks using commit hooks because PSSA is a binary module and this would mean I'd need a separate shell for committing versus local testing.
Current CI setup seems to not be working anyway because when you run invoke-scriptanalyzer on repo like you do there ARE violations (which would need to be fixed first) , even when excluding the Tests folder, which would be expected as well as running the default set of rules and not just the PSGallery ones.

[juju4]

It's up to you if want CI with warning(continue-on-error) or not and if violation fixes should go into this PR too. if small or exclusions, certainly. if bigger, probably better separate.

Only warnings here but exit code is equivalent to error.
https://github.com/juju4/PSScriptAnalyzer/actions/runs/5984855087/job/16236411056#step:5:3575

[leandroscardua]

Hi There,

Do we have any news about it?
maybe we can review it again?

[andyleejordan]

Hi There,

Do we have any news about it? maybe we can review it again?

My question is: why do we have to host it in this repo? Can't people just write their own commit hooks? I don't want to sign onto maintaining a configuration for some random service 🤷

[juju4]

My question is: why do we have to host it in this repo? Can't people just write their own commit hooks? I don't want to sign onto maintaining a configuration for some random service 🤷

imho, that's more a distribution channel than a configuration and pre-commit is probably not a random service, at least for developers.
Else, it opens a door to anyone doing in it with supply chain security issue.
And from what I can tell of most pre-commit integrations, they usually host the hook to allow easy integration to their repository. (examples: https://github.com/codespell-project/codespell, https://github.com/commitizen-tools/commitizen, https://github.com/Yelp/detect-secrets, https://github.com/aristanetworks/j2lint.git, https://github.com/ansible-community/ansible-lint.git...)
The config is more an example and used in the pre-commit github workflow.

[bergmeister]

Hi There,
Do we have any news about it? maybe we can review it again?

My question is: why do we have to host it in this repo? Can't people just write their own commit hooks? I don't want to sign onto maintaining a configuration for some random service 🤷

I am with you on that. I think we are open to improvements of our developer experience but ultimately the amount of external contributions is relatively low to not warrant this unless more people vote on wanting this, so far there is just one reaction on this PR.