chore(pre-commit): pin hook revisions to SHAs and align the gocyclo threshold

[cristim]

Refs #1594. This covers the tooling items. Dependabot/Renovate and CODEOWNERS stay open as an owner decision.

Summary

• Pinned the third-party pre-commit hooks to commit SHAs. Before, they referenced mutable tags. Both tags are lightweight, so each SHA is the tagged commit itself:

  • pre-commit/pre-commit-hooks v6.0.0 → 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c
  • igorshubovych/markdownlint-cli v0.47.0 → 76b3d32d3f4b965e1d6425253c59407420ae2c43

  The version stays as a trailing comment, which is the format pre-commit autoupdate keeps. Every other hook is repo: local or a digest-pinned image.

• Aligned the golangci gocyclo threshold with the enforcing gates. .golangci.yml had min-complexity: 15, while Makefile:73, ci.yml:75 and the pre-commit gocyclo hook use -over 10. Both now flag complexity above 10, since golangci filters with the same "over" boundary. Lowering it to 10 adds no new findings.

• actionlint: already on main as a digest-pinned docker hook scoped to .github/workflows/. chore: prune monorepo residue from config and docs #2234 already removed the check-yaml workflow exclude. Nothing new was needed here, and actionlint passes on the current workflows.

Evidence (local, macOS)

• pre-commit run --all-files passes, including the re-pinned hooks and actionlint.
• golangci-lint v2.10.1 (the CI pin) reports 0 issues with min-complexity: 10.
• scripts/test-git-secrets-allowlist.sh passes 44/44, and make build passes.
• CI's pre-commit run --all-files is unchanged. The pins only rebuild the cached hook environments.
• An independent non-author reviewer (sonnet, high) did two passes:
  • re-resolved both SHAs with git ls-remote;
  • checked the gocyclo boundary in the golangci-lint v2.10.1 source;
  • found no actionable findings at 7d112552.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated code complexity checks to apply a stricter threshold.
  • Pinned pre-commit tools to specific revisions while keeping their configured versions unchanged.
  • These updates affect repository maintenance and validation workflows. They do not change the application’s features or behavior for end users. No other user-facing changes are included in this release.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: afe6970a-ac3a-47ed-915e-a1a4d9c003f4

📥 Commits

Reviewing files that changed from the base of the PR and between 686f804 and 4ce9614.

📒 Files selected for processing: 2

• .golangci.yml
• .pre-commit-config.yaml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📝 Walkthrough

The pull request lowers the gocyclo minimum complexity threshold from 15 to 10 and pins the pre-commit-hooks and markdownlint repositories to specific commit hashes. Their configured versions remain unchanged.

Changes: Repository tooling configuration

Layer / File(s)	Summary
Lint and hook settings .golangci.yml, .pre-commit-config.yaml	The gocyclo minimum complexity threshold changes from 15 to 10. The pre-commit-hooks and markdownlint repositories change from version tags to commit hashes. Their configured versions remain v6.0.0 and v0.47.0, respectively.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 4ce96

The hook pins identify the intended releases, and no current lint failure from the threshold change is established. No actionable merge-readiness risk remains.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely summarizes both main changes: pinning pre-commit hook revisions to SHAs and aligning the gocyclo threshold.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent review verdict: CLEAN, head 4ce96142f9369c9485e862b9ed1da0139a25a3da

An independent adversarial reviewer (did not author the change) checked:

• SHA pins: git ls-remote resolves pre-commit-hooks v6.0.0 to 3e8a8703… and markdownlint-cli v0.47.0 to 76b3d32d…. Both are lightweight tags, so each SHA is the tagged commit, and both match .pre-commit-config.yaml:33 and :130. At the pinned SHAs, .pre-commit-hooks.yaml still defines all 8 pre-commit-hooks ids this config uses, plus markdownlint.
• gocyclo: .golangci.yml:43 min-complexity: 10 matches -over 10 at Makefile:74, ci.yml:75 and .pre-commit-config.yaml:141. "Lint Code" passes at this head.
• Scope: the diff is exactly the 2 files (+3/-3). The prior author-side review named 7d112552. The head is a rebase, and the config files are unchanged between them.
• Merge: clean onto current main 13dd6072 (git merge-tree).

This is a non-runtime change, so the relevant checks are CI pre-commit, Lint Code and actionlint (Lint Workflows) at this SHA. All are green, and so is the full CI.

CodeRabbit: review completed, with no inline or actionable comments.

Labels are already set. The PR refs #1594, which stays open for the owner decisions on Dependabot and CODEOWNERS.

Non-blocking: the head commit subject mentions actionlint, but the commit has no actionlint change. Squashing under the PR title avoids that.

Merging (squash, --match-head-commit 4ce96142).