[Andrej730]

Adding a pre-commit hook, so users would be able to automatically ensure actions.lock stays up to date by using hook below.

repos:
  - repo: https://github.com/github/gh-actions-lock
    rev: v0.5.0
    hooks:
      - id: gh-actions-lock

It just runs gh-actions-lock when one of the affected files is either yml file in .github/workflows or if it's actions.lock itself (typically pre-commit hooks don't verify, they just edit and then pre-commit detects that files are changes and aborts the operation).

Also related to #266 - pre-commit hook versions are tracked by dependabot, so pre-commit users will stay up to date automatically. A bit hacky, but non-pre-commit users can also use .yml file as a version source for their gh extension install github/gh-actions-lock --pin, until there will be better general solution for auto-updates.

The hook is using golang value for langauge, so pre-commit will build it from source and then invoke it as gh-actions-lock executable. Tested this locally, build takes just 9 seconds without any cache, but with go preinstalled (if go isn't installed, pre-commit will pull the corresponding version to use for the build), so it should be fine.

Some references:

• zizmor hook - https://github.com/zizmorcore/zizmor-pre-commit/blob/main/.pre-commit-hooks.yaml
• uv-lock hook - https://github.com/astral-sh/uv-pre-commit/blob/main/.pre-commit-hooks.yaml

[Copilot]

🔵 Needs a closer look

The new pre-commit/Go toolchain integration requires validation with an actual pre-commit client to confirm deletion-trigger behavior and networked build/runtime behavior, which the repository snapshot cannot exercise.

No open issues 🎉

What changed in this PR

Adds a pre-commit hook definition so repositories can automatically run gh-actions-lock when workflow files or actions.lock change.

Changes:

• Defines the gh-actions-lock hook using pre-commit’s Go language environment.
• Restricts execution to workflow YAML files and .github/workflows/actions.lock.
• Disables filename forwarding so the command scans the complete workflow set.

File	Description
.pre-commit-hooks.yaml	Registers and configures the gh-actions-lock pre-commit hook, including its Go build environment, affected-file filter, and repository-wide execution behavior.

_{Review effort: Lite (dynamic)}

[Andrej730]

Ahh, didn't know pre-commit doesn't fire on deleted files, but it is the case (pre-commit/pre-commit#749) and it won't change. It makes this hook not fully reliable as you would still need --verify in CI and then do gh actions-lock manually to fix the issue.

There are two options:

1. suggest to use prek for full coverage.

prek has include_deleted flag (j178/prek#2733, docs) that can be set for hook, it just works as expected and triggers hook on removed files too.

For pre-commit users it will raise a warning on every run [WARNING] Unexpected key(s) present on https://github.com/Andrej730/gh-actions-lock => gh-actions-lock: include_deleted, but won't break. The warning is helpful, as non-prek users will get at least some warning about that some cases might not be covered and quick search will redirect them here.

So pre-commit will get it covered for the most cases, but repo CI will need to ensure to have prek -a step to ensure nothing slips in.

2. always_run + gh-actions-lock --pre-commit.

Since pre-commit doesn't trigger on deleted files, the only way to get signal to run the hook is always_run: true option.

To ensure it doesn't run on any pre-commit invokation on the repo / any file change, we will need to check modified files and filter out ^\.github/workflows/([^/]+\.ya?ml|actions\.lock)$. Making it cross-platform could be a problem, so ideally this should be an option inside the binary like gh-actions-lock --pre-commit.

But it's getting more involved:

• we can enable pass_files: true, so pre-commit would run gh-actions-lock --pre-commit a.yml b.yml etc to give us some signal on whether something related has change. So if any pos args provided, we just assume something related has changed and run the hook. This also automatically covers prek --all-files, as it will pass all related files on the repo.
• if nothing has passed, then we need to consider if something was deleted and run git diff --staged --name-only --diff-filter=D HEAD^ from inside gh-actions-lock --pre-commit and run the gh-actions-lock command if something from our filter is there.
• additionally there's also exclude filter in the hook that user can set, that might need to be respected here..

---

Maybe for initial introduction of the hook it will be fine to use include_deleted and suggest users to use prek and wait for the feedback?