Repository navigation
Conversation
gitops-values-validation used to validate every instance of the repository on each commit (always_run + pass_filenames: false). The hook now passes the changed files with --changed-files and only the instances depending on them (Chart.yaml, Chart-<env>.yaml, values.yaml, values-<env>.yaml, values-<env>-<instance>.yaml) are validated. pre-commit never passes deleted files to hooks, and its maintainer has repeatedly declined to add an option for it (pre-commit/pre-commit#749, #3048, #3502, #3713). prek has one (include_deleted, since 0.5.4), but pre-commit warns about this unknown key on every run, so it is not used. Instead, the script adds the staged deleted files itself, and always_run is kept so that commits only deleting files are still checked. Repository-level constraints are always checked and --all-files still validates every instance.
- requests 2.31.0 -> 2.34.2 and urllib3 1.26.15 -> 2.8.0 (known CVEs fixed), urllib3 2 has no `secure` extra anymore - pyyaml 6.0.3, termcolor 3.3.0, semver 3.1.0 - drop ruamel-yaml, which is not used - keep jsonschema pinned to 4.19.0, as IGNORED_VALIDATION_ERRORS keys depend on its json_path format (cf 6da8ace) pyproject.toml is aligned on the same pinned versions (the lock had drifted to jsonschema 4.23.0) and the lock is regenerated, which notably bumps rpds-py to a version installable on recent Python versions. Validation of the whole cargo-gitops repository gives the same result with the old and new dependencies.
leo-dur
force-pushed
the
feat/gitops-values-validation-changed-files
branch
from
October 1, 2026 17:20
197ab13 to
3caa2f4
Compare
pytest never ran in CI. The JSON schemas of the platform-managed-chart are only downloadable through the Twingate VPN, which a public repository cannot use in CI (Kpler/github-actions is internal). The tests now use a minimal schema, holding only the parts of the real schema that carry the additionalChecks (service name, service keys, topic names and maxLocalTopicBytes), instead of downloading the real ones. The --real-schema pytest option downloads the real schemas instead, to check the rules against them locally. Tests run on Python 3.10, the oldest supported version, and 3.14, the version of the nix shell.
pre-commit installs the hooks repository itself (pip install .), so the dependencies declared in pyproject.toml are already installed in the hook environment: additional_dependencies was a second list to keep aligned (and was not, e.g. urllib3[secure]<2 vs urllib3==1.26.15). It is removed, pyproject.toml is the single source of the dependencies. The hook now calls a gitops-values-validation console script instead of python -m. The package metadata moves to the PEP 621 [project] table, as console scripts in [tool.poetry.scripts] are deprecated with Poetry 2.
leo-dur
force-pushed
the
feat/gitops-values-validation-changed-files
branch
from
October 1, 2026 17:26
8c5d9db to
434a236
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
gitops-values-validationvalidated every instance of the gitops repository on each commit (226 instances in cargo-gitops, even for a README-only commit).The goal is to make pre-commit faster on gitops repositories with many services, by only validating what a commit actually touches.
Changes
--changed-files) and only validates the instances depending on them (Chart.yaml,Chart-<env>.yaml,values.yaml,values-<env>.yaml,values-<env>-<instance>.yaml). Repository-level checks (unique service names) still always run, and--all-files(CI) still validates everything.include_deleted, but pre-commit warns about the unknown key. So the script lists the staged deletions itself (git diff --staged --no-renames --diff-filter=D), andalways_runis kept for deletion-only commits.pyproject.tomlis the single source, since pre-commit installs the repository itself;additional_dependenciesis removed. requests and urllib3 are bumped (known CVEs),ruamel-yaml(unused) is dropped, and jsonschema stays pinned to 4.19.0 because the ignored-error keys depend on itsjson_pathformat. The hook is now agitops-values-validationconsole script (PEP 621 metadata).python-testsCI job on Python 3.10 and 3.14 (pytest never ran in CI). The real schemas are only downloadable through the Twingate VPN, so the tests use a minimal schema holding only theadditionalChecksparts;pytest --real-schemaruns them against the real schemas locally.Tests
34 unit tests, including deletion, rename and
main()wiring.pre-commit try-repo(4.6.2) andprek try-repo(0.5.4) on cargo-gitops (the rename case with pre-commit only):values-dev.yamldeletedvalues-dev.yamlmoved out of its service--all-filesValidating all of cargo-gitops gives identical output with the old and new dependencies.
Performance
pre-commit run gitops-values-validationon cargo-gitops (60 services, 226 instances),mainvs this branch, installed hook environments and warm schema cache, median of 5 runs:values.yamlof a 2-instance service (typical)values.yamlof the largest service,staticdata-syncThe remaining ~1.1 s is mostly the pre-commit startup and the repository-level checks.
Notes