fix: Regression from (at least) v1.99.0 which incorrectly handle pre-commit run -a, that causes multiply hooks runs. terraform_trivy from its introduction could always be Passed for pre-commit run -a

[MaxymVlasov]

Put an x into the box if that apply:

• This PR introduces breaking change.
• This PR fixes a bug.
• This PR adds new functionality.
• This PR enhances existing functionality.

Description of your changes

Probably introduced in #875 or even earlier.
There were issue that regex in .pre-commit-hooks.yaml specified for Python re library, but we also used it with grep -e. grep -e working slightly different than we expect, so I switched to grep -E which have less differences with Python re. (step 3 below)

Then I found that there is no required --exit-code=1 in run_hook_on_whole_repo from hook introduction 2 years ago #606. Fixed it too.

From above, I assume that pre-commit run -a for

Fix #908

How can we test changes

1. Clone https://github.com/pre-commit-terraform/GH-908-reproduce.

2. Run pre-commit run -a - you'll see 2 occurrences of same error.

3. (Optional) Change .pre-commit-config.yaml to

   repos:
     - repo: https://github.com/antonbabenko/pre-commit-terraform
       rev: 48525b2912a56f8b707671ba67d5932549384cce
       hooks:
         - id: terraform_trivy
           args:
             # https://trivy.dev/latest/docs/configuration/others/#exit-code 
             # It wasn't set, when it should be set by default in hook. Another issue.
             - --args=--exit-code=1

   and run pre-commit run -a

4. Change .pre-commit-config.yaml to

   repos:
     - repo: https://github.com/antonbabenko/pre-commit-terraform
       rev: bafa6635606e8f6f5bd81fe99a391a2b12245768
       hooks:
         - id: terraform_trivy

   and run pre-commit run -a

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved file pattern matching for repository-wide hooks to enhance accuracy when filtering included and excluded files.
  • Enhanced detection of the formatter configuration in Terraform documentation hooks for more reliable pattern matching.
  • Ensured consistent error signaling in Terraform security scanning by updating exit code handling, allowing issues to be properly flagged.
    """

Summary by CodeRabbit

• Bug Fixes

  • Improved pattern matching in pre-commit hooks by using extended regular expressions for more accurate file filtering.
  • Enhanced detection of configuration settings in Terraform documentation hooks for better compatibility.
  • Ensured consistent error signaling in Trivy configuration scanning by adding explicit exit code handling.

• Chores

  • Updated Trivy configuration scanning to ensure consistent error handling by aligning exit codes across different hook functions.

Walkthrough

The changes update three hook scripts. They standardize the use of grep -E for extended regular expressions in pattern matching logic within hooks/_common.sh and hooks/terraform_docs.sh. In hooks/terraform_trivy.sh, the Trivy configuration scan now explicitly uses --exit-code=1 for consistent error signaling.

Changes

File(s)	Change Summary
hooks/_common.sh, hooks/terraform_docs.sh	Replaced grep -e with grep -E for extended regular expression matching in pattern filters.
hooks/terraform_trivy.sh	Added --exit-code=1 to trivy conf command in run_hook_on_whole_repo for consistent exit codes.

Sequence Diagram(s)

sequenceDiagram
    participant PreCommit as pre-commit
    participant TerraformTrivy as terraform_trivy.sh
    participant Trivy as trivy

    PreCommit->>TerraformTrivy: Run hook (whole repo)
    TerraformTrivy->>Trivy: trivy conf --exit-code=1 ...
    Trivy-->>TerraformTrivy: Returns exit code (1 if issues found)
    TerraformTrivy-->>PreCommit: Hook result (success/failure)

Loading

Assessment against linked issues

Objective	Addressed	Explanation
Prevent Trivy from running twice and ensure proper handling of exit codes (#908)	✅

Suggested labels

hook/terraform_docs, hook/terragrunt_validate_inputs

Suggested reviewers

• antonbabenko
• yermulnik
  """

---

📜 Recent review details

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between bafa663 and 11e74ae.

📒 Files selected for processing (1)

• hooks/_common.sh (1 hunks)

✅ Files skipped from review due to trivial changes (1)

• hooks/_common.sh

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: 📦 v1.99.5.dev5+g79fc272
• GitHub Check: Analyze (python)

✨ Finishing Touches

• 📝 Generate Docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Explain this complex logic.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai explain this code block.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and explain its main purpose.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate docstrings to generate docstrings for this PR.
• @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[Copilot]

Pull Request Overview

This PR fixes two regressions in hook behavior: ensuring Trivy hook fails correctly on whole-repo runs and aligning grep invocations with Python-style regex.

• Added --exit-code=1 to the trivy conf call in run_hook_on_whole_repo so vulnerabilities trigger a non-zero exit.
• Switched grep -e to grep -E (and grep -v -E) in terraform_docs.sh and _common.sh for consistency with Python regex expectations.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
hooks/terraform_trivy.sh	Enforce --exit-code=1 on whole-repo Trivy scans
hooks/terraform_docs.sh	Use grep -E instead of grep -e for regex matching
hooks/_common.sh	Use grep -E/grep -v -E for inclusion/exclusion filters

Comments suppressed due to low confidence (2)

hooks/terraform_trivy.sh:68

• [nitpick] Consider updating the hook’s documentation or inline comments to mention that --exit-code=1 is now enforced by default for whole-repo runs.

  trivy conf "$(pwd)" --exit-code=1 "${args[@]}"

hooks/terraform_trivy.sh:68

• Add or update a test case to cover the new --exit-code=1 behavior in run_hook_on_whole_repo, verifying the correct exit code when vulnerabilities are found.

  trivy conf "$(pwd)" --exit-code=1 "${args[@]}"

[coderabbitai]

Actionable comments posted: 2

📜 Review details

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 6c84595 and bafa663.

📒 Files selected for processing (3)

• hooks/_common.sh (1 hunks)
• hooks/terraform_docs.sh (1 hunks)
• hooks/terraform_trivy.sh (1 hunks)

🧰 Additional context used

🧠 Learnings (2)

📓 Common learnings

Learnt from: yermulnik
PR: antonbabenko/pre-commit-terraform#801
File: hooks/terraform_docs.sh:0-0
Timestamp: 2025-02-03T23:34:35.619Z
Learning: In the terraform_docs.sh script, the `$tf_docs_formatter` and `$args` variables in the `tfdocs_cmd` array construction should remain unquoted to allow proper word-splitting into separate command arguments.

hooks/terraform_docs.sh (1)

Learnt from: yermulnik
PR: antonbabenko/pre-commit-terraform#801
File: hooks/terraform_docs.sh:0-0
Timestamp: 2025-02-03T23:34:35.619Z
Learning: In the terraform_docs.sh script, the `$tf_docs_formatter` and `$args` variables in the `tfdocs_cmd` array construction should remain unquoted to allow proper word-splitting into separate command arguments.

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

• GitHub Check: 📦 v1.99.5.dev4+g267c8da
• GitHub Check: pre-commit
• GitHub Check: Analyze (python)

🔇 Additional comments (1)

hooks/terraform_trivy.sh (1)

64-69: Nice catch – --exit-code=1 brings whole-repo scan in line with per-dir runs

Adding the flag ensures consistency and proper CI failure signalling.
No further action required.

[antonbabenko]

This PR is included in version 1.99.5 🎉