ci: run unified source gate via pre-commit

.gitea/workflows/cicd-source-checks.yaml

@@ -128,10 +128,10 @@ jobs:
           echo "=== Kernel Tail ==="
           dmesg | tail -n 120 || true
 
-  backend-source-checks:
-    name: Backend Source Checks (format/lint/type)
+  source-precommit-checks:
+    name: Source Pre-commit Checks (backend+frontend)
     runs-on: ubuntu-act
-    timeout-minutes: 25
+    timeout-minutes: 40
     needs: setup
     steps:
       - name: Identify runner
@@ -175,128 +175,70 @@ jobs:
             echo "Using fetched HEAD_SHA checkout: ${HEAD_SHA}"
           else
             git checkout HEAD -- .
-            echo "Falling back to default branch HEAD for backend source checkout"
+            echo "Falling back to default branch HEAD for source checks checkout"
           fi
 
+          test -f .pre-commit-config.yaml || {
+            echo "❌ Missing .pre-commit-config.yaml after checkout"
+            exit 1
+          }
+
           test -f backend/pyproject.toml || {
             echo "❌ Missing backend/pyproject.toml after checkout"
-            find . -maxdepth 3 -type f | sort | head -n 80
             exit 1
           }
 
-          # Ensure containerized checks can read workspace even under rootless/remapped Docker.
-          chmod -R a+rX backend
-
-      - name: Run backend format/lint/type checks
-        run: |
-          set -e
-          echo "Verifying backend workspace before container run"
-          ls -la backend | head -n 40
-          test -f README.md || {
-            echo "❌ Missing repository README.md required by backend build metadata"
-            exit 1
-          }
-
-          echo "Packaging backend source for container execution"
-          tar -czf /tmp/backend-src.tgz README.md backend
-
-          echo "Running backend checks in python:3.14-slim via streamed source archive"
-          docker run --rm -i python:3.14-slim sh -euxc '
-            mkdir -p /workspace
-            tar -xzf - -C /workspace
-            cd /workspace/backend
-            test -f pyproject.toml
-            apt-get update -qq
-            apt-get install -y -qq --no-install-recommends libatomic1
-            python -m pip install --disable-pip-version-check --no-cache-dir uv
-            uv sync --dev
-            uv run ruff format --check .
-            uv run ruff check .
-            uv run pyright .
-          ' < /tmp/backend-src.tgz
-
-      - *failure_diagnostics_step
-
-  frontend-source-checks:
-    name: Frontend Source Checks (format/lint/type)
-    runs-on: ubuntu-act
-    timeout-minutes: 25
-    needs: setup
-    steps:
-      - name: Identify runner
-        run: |
-          echo "=== Runner Identity ==="
-          echo "runner_name=${RUNNER_NAME:-}"
-          echo "runner_name_hint=${GITEA_RUNNER_NAME:-${ACT_RUNNER_NAME:-${RUNNER_NAME:-unknown}}}"
-          echo "runner_hostname_env=${HOSTNAME:-unknown}"
-          echo "runner_uname_n=$(uname -n 2>/dev/null || echo unknown)"
-          echo "runner_etc_hostname=$(cat /etc/hostname 2>/dev/null || echo unknown)"
-          echo "runner_os=${RUNNER_OS:-unknown}"
-          echo "runner_arch=${RUNNER_ARCH:-unknown}"
-          echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-
-      - name: Configure registry host resolution
-        run: |
-          if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
-            echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
-          fi
-
-      - name: Checkout source snapshot
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          HEAD_SHA: ${{ needs.setup.outputs.head_sha }}
-        run: |
-          set -e
-          umask 022
-          trap 'rm -f ~/.ssh/id_rsa' EXIT
-
-          mkdir -p ~/.ssh
-          echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          ssh-keyscan -p "${GITEA_SSH_PORT}" "${GITEA_SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
-
-          GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
-            git clone --depth 1 --no-checkout "${GITEA_REPO_SSH_URL}" .
-
-          if GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
-            git fetch --depth 1 origin "${HEAD_SHA}" >/dev/null 2>&1; then
-            git checkout FETCH_HEAD -- .
-            echo "Using fetched HEAD_SHA checkout: ${HEAD_SHA}"
-          else
-            git checkout HEAD -- .
-            echo "Falling back to default branch HEAD for frontend source checkout"
-          fi
-
           test -f frontend/package.json || {
             echo "❌ Missing frontend/package.json after checkout"
             find . -maxdepth 3 -type f | sort | head -n 80
             exit 1
           }
 
-          # Ensure containerized checks can read workspace even under rootless/remapped Docker.
-          chmod -R a+rX frontend
-
-      - name: Run frontend format/lint/type checks
+      - name: Bootstrap source-check toolchain
         run: |
-          set -e
-          echo "Verifying frontend workspace before container run"
-          ls -la frontend | head -n 40
+          set -euo pipefail
 
-          echo "Packaging frontend source for container execution"
-          tar -czf /tmp/frontend-src.tgz -C frontend .
+          if ! command -v curl >/dev/null 2>&1; then
+            apt-get update -qq
+            apt-get install -y -qq curl ca-certificates
+          fi
 
-          echo "Running frontend checks in node:24-bullseye via streamed source archive"
-          docker run --rm -i node:24-bullseye sh -euxc '
-            mkdir -p /workspace/frontend
-            tar -xzf - -C /workspace/frontend
-            cd /workspace/frontend
-            test -f package.json
-            corepack enable
-            yarn install --immutable || yarn install
-            yarn prettier --check src/
-            yarn lint
-            yarn type-check
-          ' < /tmp/frontend-src.tgz
+          # Install uv if missing and expose it for subsequent steps.
+          if ! command -v uv >/dev/null 2>&1; then
+            curl -LsSf https://astral.sh/uv/install.sh | sh
+          fi
+          export PATH="$HOME/.local/bin:$PATH"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+          # Ensure node/corepack is available for frontend and pre-commit hooks.
+          if ! command -v node >/dev/null 2>&1; then
+            apt-get update -qq
+            apt-get install -y -qq nodejs npm
+          fi
+          if ! command -v corepack >/dev/null 2>&1; then
+            npm install -g corepack
+          fi
+
+          corepack enable
+
+      - name: Install backend and frontend dependencies
+        run: |
+          set -euo pipefail
+          export PATH="$HOME/.local/bin:$PATH"
+
+          cd backend
+          uv sync --dev
+          cd ../frontend
+          yarn install --immutable || yarn install
+
+      - name: Run pre-commit source checks
+        env:
+          CI: "true"
+        run: |
+          set -euo pipefail
+          export PATH="$HOME/.local/bin:$PATH"
+          cd backend
+          uv run pre-commit run --all-files --config ../.pre-commit-config.yaml
 
       - *failure_diagnostics_step
 
@@ -304,7 +246,7 @@ jobs:
     name: Dispatch Downstream Build
     runs-on: ubuntu-act
     timeout-minutes: 10
-    needs: [setup, backend-source-checks, frontend-source-checks]
+    needs: [setup, source-precommit-checks]
     steps:
       - name: Identify runner
         run: |