fix(prek): drop the .git suffix from the doctoc repo URL - #1171
Merged
Conversation
zizmor 0.6.3 (dependabot apache#1167) audits .pre-commit-config.yaml for the first time, and its `ref-confusion` audit hard-fails on ours: fatal: no audit was performed 'ref-confusion' audit failed on file://./.pre-commit-config.yaml 0: error in 'ref-confusion' audit That is an audit crash, not a finding, so the whole zizmor job exits 1 with nothing reported. `ref-confusion` resolves each pre-commit repo against the GitHub API to decide whether its `rev:` is ambiguous between a tag and a branch. Ours declared `https://github.com/thlorenz/doctoc.git`, and the suffix is carried into the lookup: GET /repos/thlorenz/doctoc 200 GET /repos/thlorenz/doctoc.git 404 The 404 aborts the audit. doctoc was the only one of the four remote hooks carrying `.git`; the other three already omit it, so this is a consistency fix as much as a repair. Not reproducible locally: the audit is online-only and zizmor falls back to offline without a token, where the config passes cleanly. The mechanism was confirmed against the API directly instead. Landing on main rather than on the dependabot branch, which would be overwritten on its next push. main is not currently exposed — the pinned v0.6.2 does not audit pre-commit configs — but `version: latest` means a future image would reach it regardless of the action bump. Generated-by: Claude Code (Opus 5)
potiuk
added a commit
to potiuk/magpie
that referenced
this pull request
Sep 9, 2026
Seven changes have landed behind the previous stamp: the agent-guard plugin move (apache#1170), the doctoc URL fix (apache#1171), the marketplace re-sync plus the self-correcting prek hook (apache#1174), the vetted command surface (apache#1176), and the three PRs that extended its catalogue from 19 to 58 operations (apache#1177, apache#1178, apache#1179). `claude plugin update` compares version strings, so none of that reaches an adopter until the stamp moves. Mechanical: `project.version` edited, then `tools/dev/check-family-plugins.py --fix` propagated it to the five ecosystem manifests and the eleven per-family plugin manifests plus the marketplace entries, and `uv lock` refreshed the workspace's own package version. Generated-by: Claude Code (Opus 5)
potiuk
added a commit
that referenced
this pull request
Sep 9, 2026
Seven changes have landed behind the previous stamp: the agent-guard plugin move (#1170), the doctoc URL fix (#1171), the marketplace re-sync plus the self-correcting prek hook (#1174), the vetted command surface (#1176), and the three PRs that extended its catalogue from 19 to 58 operations (#1177, #1178, #1179). `claude plugin update` compares version strings, so none of that reaches an adopter until the stamp moves. Mechanical: `project.version` edited, then `tools/dev/check-family-plugins.py --fix` propagated it to the five ecosystem manifests and the eleven per-family plugin manifests plus the marketplace entries, and `uv lock` refreshed the workspace's own package version. Generated-by: Claude Code (Opus 5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
zizmor
0.6.3— arriving via dependabot #1167 — audits.pre-commit-config.yamlfor the first time, and itsref-confusionaudithard-fails on ours:
That is an audit crash, not a finding — so the whole zizmor job exits 1 with
nothing reported, and #1167 cannot go green.
Cause
ref-confusionresolves each pre-commit repo against the GitHub API to decidewhether its
rev:is ambiguous between a tag and a branch. Our doctoc entrydeclared a
.gitsuffix, and it is carried into the lookup:The 404 aborts the audit. doctoc was the only one of the four remote hooks
carrying
.git—pre-commit-hooks,markdownlint-cli2andtyposalreadyomit it — so this is a consistency fix as much as a repair.
Why this lands on
main, not on the dependabot branchPushing to
dependabot/github_actions/…would be overwritten on its next push.With this on
main, #1167 goes green on rebase.mainis not currently broken: the pinned v0.6.2 does not audit pre-commitconfigs, which is why zizmor passes in 9s on every other open PR. But the action
requests
version: latest, so a future image reachesmainregardless ofwhether the action bump merges — this is worth fixing on its own account, not
only to unblock #1167.
Verification
prek run doctoc --all-filespasses — the hook re-clones under the newURL and its environment rebuilds
prek run --all-filespasses (exit 0)Not reproducible locally:
ref-confusionis an online-only audit and zizmorfalls back to offline mode without a token, where the config passes cleanly. I
did not hand a credential to a subprocess to force the online path; the API
check establishes the mechanism without one.
🤖 Generated with Claude Code
https://claude.ai/code/session_01So3JRGXrbqSGrohtZuHWKg