actionlint-docker pre-commit hook should specify Docker image tag

[KSmanis]

The actionlint-docker pre-commit hook should specify a tag for the Docker image in the entry field:

- id: actionlint-docker
  name: Lint GitHub Actions workflow file Docker
  description: Runs actionlint Docker image to lint GitHub Actions workflow files
  language: docker_image
  types: ["yaml"]
  files: "^.github/workflows/"
  entry: rhysd/actionlint:1.6.9

Currently the latest tag is always pulled, which beats the purpose of specifying a version in the rev field:

repos:
  - repo: https://github.com/rhysd/actionlint
    rev: v1.6.9  # this is effectively a no-op currently
    hooks:
      - id: actionlint-docker

This version specifier should be bumped before every release, i.e., it should be part of the tag.

[KSmanis]

I would be happy to work on that, but the current release process is initiated after pushing a tag, whereas the bumping in .pre-commit-hooks.yaml should occur before tagging. In other words, I don't see how this task could be automated without rewriting the release workflow. Any pointers?

[rhysd]

If we decide to specify the version explicitly, when should we update it? If it is updated to the latest version on new release, I think it is the same behavior as not specifying tag since it fetches rhysd/actionlint:latest.

Since I'm not a user of pre-commit, I may miss some point here.

[KSmanis]

If we decide to specify the version explicitly, when should we update it?

It should be updated before tagging.

Let's take the following .pre-commit-config.yaml as an example:

repos:
  - repo: https://github.com/rhysd/actionlint
    rev: v1.6.8
    hooks:
      - id: actionlint-docker

Given the above config, pre-commit will clone the https://github.com/rhysd/actionlint repo at the v1.6.8 tag and look up the actionlint-docker hook in the repo's .pre-commit-hooks.yaml. If the hook doesn't specify an explicit version, then the rhysd/actionlint:latest will be pulled, which might be an alias for a later release, e.g., v1.6.9 currently. So, even though we specified v1.6.8 in .pre-commit-config.yaml, we might be getting a different version. This is trivially solved by specifying an explicit version in .pre-commit-hooks.yaml, but this value should be always in sync with the latest release, i.e., it should be ideally automated.

[rhysd]

I'm sorry for pending discussion. Now I'd like to resume this.

@KSmanis Thank you for your explanation. I understood why it is necessary. We need to change the entry value just before adding a new tag. Let me consider how to do that. Since CI release job runs after making a new tag, CI cannot do that.