BUILD-12282: Upgrade pre-commit CI to gh-action_pre-commit@v2

[matemoln]

BUILD-12282: Upgrade pre-commit CI to gh-action_pre-commit@v2

Summary

• Rewrite .github/workflows/pre-commit.yml to the v2 README skeleton
• Add workflow-level permissions (id-token: write, contents: read) and concurrency (cancel-in-progress: true); remove job-level permissions
• Triggers: pull_request, merge_group, and push to the GitHub default branch
• Run on sonar-xs
• SHA-pin actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with fetch-depth: 0
• Float internal actions at @master (gh-action_pre-commit, mise-action-wrapper)
• Drop PR-only extra-args, ignore-failure helpers, and caller-side Repox/registry auth (bundled in v2)

Depends on Vault Artifactory reader grants from the re-terraform-aws-vault order update.

Test plan

• Pre-commit job is green on this PR
• After merge, a push to the default branch runs --all-files

[hashicorp-vault-sonar-prod]

BUILD-12282

[julien-carsique-sonarsource]

There's a mix of used versions for ci-github-actions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved 3 closed / 3 findings

Upgrades the pre-commit CI workflow to gh-action_pre-commit@v2, implementing the v2 README skeleton with job-level permissions (id-token: write, contents: read), SHA-pinned checkout, and simplified configuration. Pre-commit job is green on this PR.

✅ 3 closed

Closed: Quality: checkout bumped v5->v7 here only, undocumented in description

📄 .github/workflows/pre-commit.yml:18
The description says "SHA-pin actions/checkout", but the action was already SHA-pinned (08c6903c... # v5.0.0); the diff actually performs an unmentioned major upgrade to 9c091bb2... # v7.0.0 (verified: that SHA is the v7.0.0 tag, runs.using: node24). All eight other workflows in the repo stay on the v5.0.0 SHA, so pre-commit.yml is now the lone outlier and the repo carries two checkout majors. Either revert this workflow to the v5.0.0 SHA and let Renovate bump all workflows together, or bump every workflow in a dedicated change and state it in the description.

Closed: Bug: Repox routing for pre-commit hook envs removed with no replacement

📄 .github/workflows/pre-commit.yml:17-22
The immediately preceding change (df31cc1, "BUILD-12327 Route Python installs through Repox", with commits "Export PIP_INDEX_URL so pre-commit hook venvs use Repox", "Also set VIRTUALENV_INDEX_URL for pre-commit hook bootstraps", "Seed pre-commit hook venvs with embedded pip") added config-pip, config-npm and the PIP_INDEX_URL/VIRTUALENV_* export specifically because pre-commit builds one isolated env per hook: yamllint, check-jsonschema and pre-commit-hooks install from PyPI, and markdownlint-cli plus renovatebot/pre-commit-hooks install from the npm registry. gh-action_pre-commit@v2 bundling Repox auth for its own install is not the same as exporting PIP_INDEX_URL/VIRTUALENV_INDEX_URL and an npm registry for those per-hook environments, so unless v2 explicitly does that, this reverts BUILD-12327 and the hooks go back to fetching from public registries (and the job also loses the npm auth path entirely). Confirm v2 exports the pip/virtualenv/npm index configuration for hook environments; if it does not, keep config-pip/config-npm and the env export in this workflow.

Closed: Security: harden-runner silently dropped; only workflow without it

📄 .github/workflows/pre-commit.yml:17-22
Every other workflow in this repo (build.yml, unified-dogfooding.yml, pr-cleanup.yml, slack_notify.yml, PullRequestCreated/Closed.yml, RequestReview.yml, SubmitReview.yml) starts its job with step-security/harden-runner@8d3c67de... # v2.19.0 with egress-policy: audit; this rewrite removes it from pre-commit.yml, making it the sole job that runs unaudited egress — and it now runs on push to master with id-token: write while executing floating @master third-party action code. The PR description enumerates what was intentionally dropped (config-pip/config-npm, extra-args, ignore-failure, Repox env vars) and does not mention harden-runner, so this looks like collateral loss from adopting the v2 README skeleton. Re-add the harden-runner step as the first step to keep the repo's runner-hardening baseline uniform.

Verification

Functional validation No results

Rules No rules evaluated

Auto-approval Not enabled

Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}