From 05dea509d16001a3dce5a54c9f8b87bceb278144 Mon Sep 17 00:00:00 2001
From: Blair Hamilton <blair@pinpredict.com>
Date: Wed, 29 Jul 2026 21:34:50 -0400
Subject: [PATCH] feat(pre-commit-advisory): opt-in private-modules for Go
 module fetches
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Repos that fetch private pinpredict Go modules (ppkit) instead of vendoring
had to drop the pre-commit advisory job entirely — the go-mod-tidy-repo and
golangci-lint hooks fail with 'could not read Username for github.com' on the
private fetch (herald and covenant both omit the job for this reason; the
understudy feeds plugin just hit it too).

Add an opt-in private-modules input mirroring docker-release.yml's: mint a
short-lived read-only pinpredict-argocd App token, install a git insteadOf
rewrite for github.com/pinpredict/, and set GOPRIVATE before the hooks run.
Callers pass private-modules: true + secrets: inherit. Default false — inert
for every existing caller.
---
 .github/workflows/pre-commit-advisory.yml | 42 +++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/.github/workflows/pre-commit-advisory.yml b/.github/workflows/pre-commit-advisory.yml
index de1b913..c58507c 100644
--- a/.github/workflows/pre-commit-advisory.yml
+++ b/.github/workflows/pre-commit-advisory.yml
@@ -48,6 +48,19 @@ on:
         description: "Node version. Ignored when setup-node-pnpm=false."
         type: string
         default: "24"
+      private-modules:
+        description: >-
+          When true, mint a short-lived read-only pinpredict-argocd App token
+          (BOOTSTRAP_APP_ID / BOOTSTRAP_APP_PRIVATE_KEY — callers must pass
+          `secrets: inherit`) and configure a git insteadOf rewrite + GOPRIVATE
+          before running pre-commit, so hooks that resolve Go modules
+          (go-mod-tidy-repo, the golangci-lint typecheck) can fetch private
+          github.com/pinpredict/* modules (e.g. ppkit). Same App and pattern as
+          docker-release.yml's private-modules input. Default false — a no-op
+          for every existing caller.
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -71,6 +84,35 @@ jobs:
         with:
           fetch-depth: 0
 
+      # Opt-in (private-modules: true): mint a short-lived, read-only token for
+      # the org-wide pinpredict-argocd App so module-resolving hooks
+      # (go-mod-tidy-repo, golangci-lint) can fetch private pinpredict Go
+      # modules without vendoring. contents:read across the org (the App is
+      # installed on all repos). Skipped for every caller that leaves
+      # private-modules at its default.
+      - name: Mint private-module read token
+        id: private-module-token
+        if: ${{ inputs.private-modules }}
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.BOOTSTRAP_APP_ID }}
+          private-key: ${{ secrets.BOOTSTRAP_APP_PRIVATE_KEY }}
+          owner: pinpredict
+          permission-contents: read
+
+      # The token never lands in the checkout or the hook-env cache: it lives
+      # in the runner-local global git config, and GOPRIVATE bypasses the
+      # public proxy + checksum DB for org modules.
+      - name: Configure git for private Go modules
+        if: ${{ inputs.private-modules }}
+        env:
+          GH_PRIVATE_TOKEN: ${{ steps.private-module-token.outputs.token }}
+        run: |
+          git config --global \
+            url."https://x-access-token:${GH_PRIVATE_TOKEN}@github.com/pinpredict/".insteadOf \
+            "https://github.com/pinpredict/"
+          echo "GOPRIVATE=github.com/pinpredict/*" >> "$GITHUB_ENV"
+
       # Python is still needed for `language: python` hooks (ruff, …) —
       # go-pre-commit builds their venvs with the interpreter on PATH.
       - uses: actions/setup-python@v6