From bf755ed940386f15cb238da66585c29cde492040 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Fri, 17 Jul 2026 14:14:16 +0300 Subject: [PATCH] fix(ci): skip the duplicate gosec pre-commit hook that OOMs the runner in CI The gosec pre-commit hook (scripts/gosec-hook.sh) is designed to scan only a local commit's changed packages, but 'pre-commit run --all-files' (the CI job) feeds it every .go file across all six modules at once. gosec's whole-repo analysis exhausts the runner memory and the pre-commit job dies with 'The runner has received a shutdown signal' at that exact step on every run (verified on multiple main runs after the tflint fix landed - tflint itself now passes). gosec is NOT dropped from CI: the dedicated 'Security Scanning' job in ci.yml runs gosec v2.28.0 per-module (SARIF) as the authoritative gate. This only removes the CI duplicate that OOMs the runner - the same dedup rationale as the already-skipped terraform_validate (covered by the Validate Terraform job). Local devs keep the fast per-changed-package gosec hook. --- .github/workflows/pre-commit.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index a07f14f80..7cd4f522a 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -242,7 +242,18 @@ jobs: # residual flakes that token alone cannot eliminate. uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2 env: - SKIP: terraform_validate + # SKIP the `gosec` pre-commit hook in CI: it is designed to scan + # only the changed packages of a local commit, but `pre-commit run + # --all-files` (this CI job) feeds it EVERY .go file across all six + # modules at once, and gosec's whole-repo analysis exhausts the + # runner's memory — the job dies with "The runner has received a + # shutdown signal" at this step on every run. gosec is NOT dropped: + # the dedicated `Security Scanning` job in ci.yml runs gosec v2.28.0 + # per-module (SARIF) as the authoritative gate, so this only removes + # the duplicate that OOMs CI — the same dedup rationale as the + # already-skipped `terraform_validate` (covered by Validate Terraform). + # Local developers still get the fast per-changed-package gosec hook. + SKIP: terraform_validate,gosec GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: timeout_minutes: 10