Somehow switch between hooks in pre-commit.ci and CLI, or skip some in each env #2806

search you tried in the issue tracker

skip ci; skip cli; skip system; skip (and a lot of reading titles and clicking through to some)

describe your actual problem

TL;DR Feature request: an analog to ci.skip that is cli.skip that works precisely like the SKIP environment variable; it always applies when running pre-commit at the CLI without having to pass SKIP.

I've got a config:

repos:
- repo: https://github.com/sirwart/ripsecrets.git
  # use v0.1.6 when it's out
  rev: a0d3a739b20d54170762e531c34518d94bf8329c
  hooks:
  - id: ripsecrets-system
- repo: https://github.com/jumanjihouse/pre-commit-hooks
  rev: 3.0.0
  hooks:
    - id: shellcheck
    - id: shfmt

All of these rely on having an executable available in the system scope. None of these executables are available in pre-commit.ci runs, nor would I necessarily expect them to be. I don't see anything on https://pre-commit.ci about installing arbitrary binaries, not would I expect that to be available!

So, that effectively eliminates shellcheck and shfmt from running on CI. I'll deal.

ripsecrets has a language: rust hook, but I don't like to use it when I'm using the CLI locally because I don't always have a rust build environment available, per the language: rust docs, nor do I want to take the time to let it install when I've already got ripsecrets installed on my PATH, managed by Homebrew via a Brewfile.

I did notice the availability of the ci object that controls pre-commit.ci config, and its skip list to disable hooks. I could list ripsecrets-system and the others in there, but then I'd have nothing running.

What I'd really like is to have an analog to ci.skip that is cli.skip that works precisely like the SKIP environment variable; it always applies when running pre-commit at the CLI without having to pass SKIP.

This would enable me to have something like this:

repos:
- repo: https://github.com/sirwart/ripsecrets.git
  # use v0.1.6 when it's out
  rev: a0d3a739b20d54170762e531c34518d94bf8329c
  hooks:
  - id: ripsecrets-system
  - id: ripsecrets
- repo: https://github.com/jumanjihouse/pre-commit-hooks
  rev: 3.0.0
  hooks:
    - id: shellcheck
    - id: shfmt

ci: 
  skip:
    - ripsecrets-system
    - shellcheck
    - shfmt
cli:
  skip:
    - ripsecrets

This way, ripsecrets-system runs locally, and ripsecrets runs in https://pre-commit.ci.

Alternative solutions

1. I could have an alias pre-commit="SKIP=ripsecrets pre-commit" or something like that, but I'd have to remember to set that on multiple machines or stick it into my dotfiles. Any other variation requiring an envvar or otherwise aliasing is similarly undesirable because of the need to manage it somehow.
2. https://pre-commit.ci could allow the installation of binaries used for hooks, but this is a whole can of worms I can safely predict you don't want to open. Allowing execution of arbitrary hooks is already enough of a security and resource abuse nightmare, so I thank you for taking that on with https://pre-commit.ci.
3. Do not use https://pre-commit.ci for this repo and instead use GitHub Actions
4. https://pre-commit.ci could pre-populate commonly used, safe binaries in its base image, which is probably the most ideal, but adds some overhead to operating https://pre-commit.ci that I cannot expect from a free service for my open source work.

I'd appreciate your guidance if there's another way to handle this.

Acknowledgement

I acknowledge that in this particular situation, the point of ripsecrets is to keep secrets from getting committed, so if https://pre-commit.ci fails on that check, it means I've failed to install pre-commit or what I've got configured for the ripsecrets-system hooks didn't catch what ripsecrets hook caught. That is, there's still value in this hook running in CI.

pre-commit --version

pre-commit 3.1.1