add-code-quality-hook

Add a Code Quality Hook

Opik runs all linters through one pipeline: pre-commit locally, and the 🐙 Code Quality workflow (.github/workflows/code_quality.yml) in CI. CI does not run pre-commit wholesale — it derives, per PR, the set of hooks that actually have work using scripts/precommit-detect-hooks.py, then runs one CI job per matched linter. That design makes adding a linter a small, fixed set of edits — but each edit is load-bearing, and skipping one produces a silent gap (the hook runs nowhere, or renders blank in the summary, or provisions the wrong runtime) rather than a loud failure. This skill is the checklist.

The whole recipe is a generalization of two real PRs: actionlint (live in .pre-commit-config.yaml today — grep it as you read) and hadolint (OPIK-6673, PR #7352 — the first Docker-image hook, toolchain: none). Read the actionlint hook alongside this doc; it is the canonical, verifiable example.

The wiring files

Each linter touches these four files. Do all four.

1. .pre-commit-config.yaml — add the hook

Add the upstream hook (repo / rev / id). Pin rev to a tag or SHA — never a floating ref.

An explicit files: regex is mandatory, not optional. This is the single most common miss. The CI matrix detector (precommit-detect-hooks.py) routes work to hooks by path regex, not by pre-commit's types:. Most upstream hooks (actionlint, hadolint) ship a types:-only match with no files:. If you copy them verbatim, the detector cannot route any file to your hook and CI silently never runs it — pre-commit locally still works, so the gap hides until something slips through. The detector guards against this: it raises loudly if a hook has types:/types_or: without files: (see precommit-detect-hooks.py lines ~115). So a missing files: fails the detect step rather than regressing silently — but you still must write the regex.

Write a files: regex that captures exactly the paths the linter should gate. Example (actionlint — workflows only):