From 53d98b0388d81ff890586ef7b8a87d0fed955c44 Mon Sep 17 00:00:00 2001 From: vishnuszipstack Date: Wed, 14 Oct 2026 15:29:12 +0530 Subject: [PATCH] [CHORE] Catch duplicate YAML keys in pre-commit `check-yaml` cannot catch a duplicate mapping key. It runs with `--unsafe`, which parses for syntax without constructing the document, and even without that flag it loads via `yaml.safe_load`, which resolves a duplicate to the last occurrence silently. Docker Compose's loader rejects them outright, so the two disagree -- and the strict one is the one in CI. That gap shipped a `tests/compose/docker-compose.test.yaml` carrying a second `backend:` key alongside the one at line 5. pre-commit passed it; the e2e tier then died at `compose up` in 0.4s, before a container started: line 93: mapping key "backend" already defined at line 5 Adds yamllint pinned at v1.38.0 with `key-duplicates` and nothing else. Verified, rather than assumed: - Reintroduced the exact incident shape; the hook FAILS naming the file, line and key, while `check-yaml` PASSES on that same file. A guard that does not fail on the bug it targets is worthless, so this is the test that mattered. - Covers `.yml` as well as `.yaml` -- confirmed by planting a duplicate in `.github/ISSUE_TEMPLATE/config.yml`, since a hook matching no files also reports "Passed". - Clean on the current tree: all 22 tracked YAML files, zero findings, so no exclusions and no per-file waivers. Every other yamllint rule is off deliberately. `extends: default` reports 333 findings across those same files (270 of them line-length), which would get the hook disabled rather than the files fixed. Listing the one rule explicitly also means a future version bump cannot widen its scope. Co-Authored-By: Claude Opus 5 --- .pre-commit-config.yaml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index c709dded37..e279326d6f 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -37,6 +37,28 @@ repos: - id: mixed-line-ending - id: no-commit-to-branch + # Duplicate mapping keys only. `check-yaml` above cannot catch them: it runs + # with `--unsafe`, which parses for syntax without constructing the + # document, and even without that flag it loads via `yaml.safe_load`, which + # resolves a duplicate to the last occurrence silently. Docker Compose's + # loader rejects them outright, so the two disagree and CI is the stricter. + # That gap shipped a `docker-compose.test.yaml` with a second `backend:` + # key: pre-commit passed it and the e2e tier then died at `compose up` + # before a container started. + # + # Every other yamllint rule is off, deliberately. The repo has no yamllint + # baseline and this hook is not an invitation to adopt one: `extends: + # default` reports 333 findings across the 22 tracked YAML files (270 of + # them line-length), which would get the hook disabled rather than the + # files fixed. With only `key-duplicates` the same 22 files are clean, so + # it needs no exclusions and no per-file waivers. + - repo: https://github.com/adrienverge/yamllint + rev: v1.38.0 + hooks: + - id: yamllint + name: check yaml for duplicate keys + args: ["-d", "{rules: {key-duplicates: enable}}"] + - repo: https://github.com/astral-sh/ruff-pre-commit rev: v0.3.4 hooks: