ci(tooling): pin pre-commit hook repos, YAML-check workflows, add Dependabot

[cristim]

Summary

This fixes the mcp-repo findings in #23, from the 2026-07-28 tooling review.

• Hook repos pinned to commit SHAs. The three third-party pre-commit hook repos now use a full commit SHA with the version as a trailing comment, matching the Actions convention and cloud-commitments-cli's config:

  Repo	Version	SHA
  pre-commit-terraform	v1.105.0	d0e12cae
  pre-commit-hooks	v6.0.0	3e8a8703, the same as the cli repo
  markdownlint-cli	v0.47.0	76b3d32d

  Each SHA is the target of that tag, from git ls-remote. The terraform hooks never match files in this repo; chore: prune monorepo residue left by the split (docs, pre-commit, CI) #2 will remove them, and pinning them now keeps this PR's acceptance self-contained.

• check-yaml now covers .github/workflows/. Before, a syntax-broken workflow produced no red check. The issue's "add actionlint" half was already done: .pre-commit-config.yaml has a digest-pinned local actionlint hook.

• gocyclo threshold lowered from 15 to 10 in .golangci.yml. That matches the gocyclo -over 10 gates in ci.yml, pre-commit.yml and the Makefile, so a function at complexity 11-15 can no longer pass make lint and then fail CI.

• .github/dependabot.yml added, weekly, one grouped PR per ecosystem, with at most 2 open PRs each, covering:

  • github-actions (all 42 uses: lines are SHA pins with version comments, which Dependabot keeps in sync);
  • gomod;
  • npm for .github/scripts/server-json-validator (ajv, used by mcp-server-json.yml).

Not covered by Dependabot. These stay manual:

• the pre-commit hook SHAs above (no pre-commit ecosystem enabled);
• the cloud-commitments-go pseudo-version pins (that repo has no tags, so Dependabot cannot propose bumps; see chore(deps): bump cloud-commitments-go pins to main 9dae64b #61 for the manual process);
• tool and image pins installed by script:
  • go install pins: gocyclo, govulncheck, golangci-lint, staticcheck and gosec;
  • pip pins: pre-commit and zizmor;
  • the npx mcpb CLI;
  • the actionlint and hadolint image digests.
• go.work (use . only), which gomod leaves alone.

No CODEOWNERS was added. The issue makes it conditional on wanting review gating on workflow changes, and no sibling repo has one. Ask if you want it.

Closes #23

Verification (local, macOS)

• Pinned hooks: pre-commit run --all-files installs the hook repos from the SHAs. Every hook passes, or skips for lack of matching files.
• check-yaml: passes on all 4 workflows and on dependabot.yml. In a scratch repo, a malformed workflow was skipped by the old config and fails with the new one (mapping values are not allowed here).
• golangci-lint v2.10.1 (GOTOOLCHAIN=go1.26.9): with min-complexity: 10 it reports 0 issues, and config verify passes. The _test.go exclusion covers gocyclo.
• Dependabot config: check-jsonschema --builtin-schema vendor.dependabot .github/dependabot.yml passes.

Review

The plan had two independent passes (Sonnet, high effort, non-author). Pass 1 made three changes, all applied: fix the workflow count, add the npm ecosystem, and state the gomod and pin limits.

The diff then had two passes from the same reviewer, both with no actionable findings at the exact staged tree 00a7c36. Pass 2's only note widened the "not covered" list above.

CodeRabbit was not pinged because the org's CR quota is exhausted.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 3 billable files and costs up to $0.75.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 11 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 75 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-mcp/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 22a4b8c4-8662-4cf1-97c6-4d384b30a047

📥 Commits

Reviewing files that changed from the base of the PR and between ee3f199 and fc8117b.

📒 Files selected for processing: 3

• .github/dependabot.yml
• .golangci.yml
• .pre-commit-config.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Merge-driver verdict: CLEAN at fc8117bcd1eb28624cf2b4731b4c51e0ba3f869d

An independent adversarial reviewer (Sonnet, high effort, cold brief, not the author) reviewed the full diff. It found no blocking findings.

Local verification (real, macOS):

• SHA pins. git ls-remote confirms each pin is its tag's commit. All three tags are lightweight.

  Repo	Tag	Commit
  pre-commit-terraform	v1.105.0	d0e12cae…
  pre-commit-hooks	v6.0.0	3e8a8703…
  markdownlint-cli	v0.47.0	76b3d32d…

• check-yaml. pre-commit run check-yaml --all-files passes with .github/workflows/ included.

• gocyclo 10.

  • golangci-lint run reports "No issues found" (local v2.11.4; the Makefile pins v2.10.1).
  • gocyclo -over 10 -ignore '_test\.go' . prints nothing.
  • CI's Lint Code job is green.

• dependabot.yml. It is a valid v2 config, and all three directories exist. The npm directory has a package.json and a lockfile.

#23 acceptance criteria:

• SHA pins: done.
• check-yaml on workflows: done.
• gocyclo set to 10: done.
• Dependabot for github-actions and gomod: done, with npm as an extra.
• actionlint: already present as a digest-pinned local hook (.pre-commit-config.yaml:111-117).
• CODEOWNERS: optional in chore(ci): medium/low findings from the 2026-07-28 full review [mcp part] #23. The PR body defers it to the owner.

Non-blocking note. gomod with patterns: ["*"] may propose bumps of the untagged cloud-commitments-go pseudo-version pins, mixed into the grouped PR. CI gates any such PR. An ignore entry for github.com/LeanerCloud/cloud-commitments-go/* would keep those bumps manual, as #61 describes.

Gate items:

• CI: all green at this SHA.
• Merge state: CLEAN.
• Labels: match chore(ci): medium/low findings from the 2026-07-28 full review [mcp part] #23.
• CR waived: quota, adversarial review + local verification + green CI.