pre-commit.yml

name: pre-commit

# Runs the project's pre-commit hooks on every push to main, and on PRs that
# target main so the check gates a merge before it lands.
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  pre-commit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Nix
        uses: cachix/install-nix-action@v30
        with:
          extra_nix_config: |
            experimental-features = nix-command flakes

      # `nix develop` runs the git-hooks.nix shellHook, which generates
      # .pre-commit-config.yaml and provides the pinned pre-commit plus hooks,
      # so this is identical to the local checks. flake-profiles is skipped: it
      # evaluates every host, and work/tower/thinkpad/notebook fetch the private
      # hemisphere fonts/ocular repos over SSH that CI has no key for. That hook
      # stays covered by the local pre-commit run (ambient SSH agent).
      - name: Run pre-commit
        env:
          SKIP: flake-profiles
        run: nix develop --command pre-commit run --all-files --show-diff-on-failure --color always