Summary
Found by the security-audit analyzer during pre-pr-review of #570 (the cargo-hawk PR, which
also fixed a pre-existing malformed-YAML bug in validate-tag-changelog's entry: block). That
bug silently disabled every pre-push hook for anyone using a strict YAML parser (prek) — the
whole file failed to load before any hook could run. Nothing in CI would have caught it: the file
isn't validated anywhere (git grep 'pre-commit\|prek' -- .github/ finds nothing).
Proposed fix
Add a lightweight CI step (or a prek/pre-commit step in its own right) that just confirms
.pre-commit-config.yaml parses — e.g. python3 -c "import yaml; yaml.safe_load(open('.pre-commit-config.yaml'))"
or, more usefully, prek run --hook-stage pre-push --all-files in a fast/no-op mode if one
exists, so a broken config fails loudly in CI instead of only failing quietly for local prek
users while pre-commit's more lenient PyYAML parser stays oblivious.
Summary
Found by the security-audit analyzer during pre-pr-review of #570 (the cargo-hawk PR, which
also fixed a pre-existing malformed-YAML bug in
validate-tag-changelog'sentry:block). Thatbug silently disabled every pre-push hook for anyone using a strict YAML parser (
prek) — thewhole file failed to load before any hook could run. Nothing in CI would have caught it: the file
isn't validated anywhere (
git grep 'pre-commit\|prek' -- .github/finds nothing).Proposed fix
Add a lightweight CI step (or a
prek/pre-commitstep in its own right) that just confirms.pre-commit-config.yamlparses — e.g.python3 -c "import yaml; yaml.safe_load(open('.pre-commit-config.yaml'))"or, more usefully,
prek run --hook-stage pre-push --all-filesin a fast/no-op mode if oneexists, so a broken config fails loudly in CI instead of only failing quietly for local prek
users while
pre-commit's more lenient PyYAML parser stays oblivious.