ci: align pre-commit hooks and GitHub templates

[mc-nv]

What does the PR do?

Aligns this repository with the org-wide setup consolidated in triton-inference-server/.github:

• .pre-commit-config.yaml: shared baseline hooks, conventional-commit message validation (commit-msg stage), and the centralized add-license hook from the org .github repository (rev: v1.4.3 — excludes .github/ templates, never rewrites LICENSE files).
• Pre-commit CI runs only on files modified by the PR.
• Caller stub for the org-wide reusable conventional-pr workflow (@v1.4.3): validates the PR title against Conventional Commits (hard gate — it becomes the squash-merge commit), derives one human-readable label per distinct type found in the title and all conforming commit subjects (e.g. ci: → CI/CD, feat: → feature, fix: → fix), enforces org-wide label colors/descriptions, detects cherry-picks, and fails if no type is derivable and no type label is assigned.
• No per-repo templates: PR templates and issue routing are inherited from the org-wide defaults in triton-inference-server/.github (issues route to the server repository).

Depends on triton-inference-server/.github#5 (pinned tags current: v1.4.3 — already exist, CI is green).

Pros / Cons

Pros

• Single home (org .github repo) for hooks, templates, issue routing, and the PR-title workflow — one change propagates everywhere.
• Repos carry only a config file and two small workflow stubs; no template copies to drift.
• Commit/PR title format enforced both locally (commit-msg hook) and in CI (reusable workflow), with automatic type labels.
• License hooks never modify LICENSE files.

Cons / risks

• Version-pinned dependency on the org .github repository (tags are write-once; changes ship as a new tag + rev bump).
• Template inheritance requires the org .github repository to remain public.

Related Issues / PRs

• Resolves: TRI-1100

Related PRs:

• ci: migrate the centralized add-license hook to the org .github repository developer_tools#61
• ci: align pre-commit hooks and GitHub templates core#517
• ci: align pre-commit hooks and GitHub templates common#161
• ci: align pre-commit hooks and GitHub templates backend#127
• ci: align pre-commit hooks and GitHub templates python_backend#449
• ci: align pre-commit hooks and GitHub templates tensorrt_backend#124
• ci: align pre-commit hooks and GitHub templates onnxruntime_backend#351
• ci: align pre-commit hooks and GitHub templates pytorch_backend#200
• ci: align pre-commit hooks and GitHub templates openvino_backend#119
• ci: align pre-commit hooks and GitHub templates identity_backend#36
• ci: align pre-commit hooks and GitHub templates checksum_repository_agent#14
• ci: align pre-commit hooks and GitHub templates redis_cache#24
• ci: align pre-commit hooks and GitHub templates repeat_backend#19
• ci: align pre-commit hooks and GitHub templates square_backend#22
• ci: align pre-commit hooks and GitHub templates third_party#80
• ci: align pre-commit hooks and GitHub templates triton_cli#127
• ci: align pre-commit hooks and GitHub templates tutorials#158
• ci: align pre-commit hooks and GitHub templates server#8890
• ci: align pre-commit hooks and GitHub templates client#909
• ci: align pre-commit hooks and GitHub templates tensorrtllm_backend#861
• ci: align pre-commit hooks and GitHub templates vllm_backend#133
• ci: align pre-commit hooks and GitHub templates perf_analyzer#467
• chore: never modify the COPYRIGHT template and guard .github templates model_analyzer#1032

Test plan

• pre-commit validate-config passes; pre-commit run --files <PR diff> passes locally with the centralized hooks pinned to the .github branch SHA.
• After .github#5 merges and v1.4.3 exists: the conventional-pr check validates this PR's own title and applies the ci label.
• No LICENSE file content is changed by this PR.

Caveats

• None beyond the merge-order note above.

Checklist

• PR title follows <commit_type>: <Title> (conventional commit)
• I ran pre-commit locally on all files changed by this PR and it passes
• Copyright header is correct on all changed files
• External contributors: I have read the Contribution guidelines and signed the Contributor License Agreement

[Vinya567]

@greptileai

[greptile-apps]

Greptile Summary

This PR aligns the repository with the org-wide CI/CD baseline in triton-inference-server/.github: it adds a thin caller for the conventional-pr reusable workflow (PR-title linting + auto-labeling) and rewrites the pre-commit workflow to run only on PR-modified files using a null-delimited xargs -0 pipeline, addressing prior space-in-filename and empty-diff concerns.

• conventional-pr.yml: New caller stub that correctly gates pull_request_target to fork PRs (for writable token) and pull_request to same-repo PRs via an if condition, with permissions scoped to pull-requests: write and issues: write only.
• pre-commit.yml: Replaces pre-commit/action with a git diff --diff-filter=d HEAD^1 HEAD pipeline; fetch-depth: 2 gives the parent context needed to compute the full PR diff in the GitHub Actions merge-commit checkout model.
• .pre-commit-config.yaml: Adds default_install_hook_types, a commit-msg-stage conventional-commit hook, the org-wide add-license hook (v1.4.3), and fixes flake8 arg quoting; both org-hook refs are mutually consistent at v1.4.3.

Confidence Score: 5/5

Safe to merge — all changes are CI/tooling configuration with no production code impact.

The changes are well-structured: the pull_request_target security concern is explicitly mitigated by the if guard and by the reusable workflow not checking out PR code; the null-delimited xargs pipeline correctly handles spaces and empty diffs; both org-hook refs are mutually consistent at v1.4.3. The only observation is a minor pinning inconsistency on actions/cache.

No files require special attention; .github/workflows/pre-commit.yml has a minor action-pinning inconsistency noted in comments.

Important Files Changed

Filename	Overview
.github/workflows/conventional-pr.yml	New caller stub for the org-wide reusable conventional-pr workflow; correctly restricts pull_request_target to fork PRs via an if guard and explicitly scopes permissions to the minimum needed for label management.
.github/workflows/pre-commit.yml	Replaces pre-commit/action with a manual run scoped to PR-modified files using null-delimited xargs -0; actions/cache@v4 is pinned to a major version while sibling actions use exact semver (@v5.0.0, @v6.0.0).
.pre-commit-config.yaml	Adds default_install_hook_types, conventional-commit message hook (commit-msg stage), and org-wide add-license hook pinned to v1.4.3; fixes flake8 arg quoting; both org-hook revs are mutually consistent.
LICENSE	Copyright year bumped from 2023 to 2023-2026; content otherwise unchanged.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    PR([Pull Request opened / updated]) --> EVENT{Event source}

    EVENT -->|same-repo PR| PC_EVENT[pull_request event]
    EVENT -->|fork PR| PT_EVENT[pull_request_target event]

    PC_EVENT --> IF_GUARD{if: head.repo == repository}
    PT_EVENT --> IF_GUARD2{if: head.repo != repository}

    IF_GUARD -->|true| CONV_JOB[conventional-pr job\npermissions: PR write + issues write]
    IF_GUARD2 -->|true| CONV_JOB

    CONV_JOB --> REUSABLE[triton-inference-server/.github\nconventional-pr.yml @ v1.4.3]
    REUSABLE --> LINT[Validate PR title\nConventional Commits]
    REUSABLE --> LABEL[Derive + apply type label\nci / feat / fix / ...]
    REUSABLE --> CHERRY[Detect cherry-picks]

    PR --> PRECOMMIT_JOB[pre-commit job\npermissions: contents read]
    PRECOMMIT_JOB --> CHECKOUT[actions/checkout @ v5.0.0\nfetch-depth: 2]
    CHECKOUT --> CACHE[actions/cache @ v4\n~/.cache/pre-commit]
    CACHE --> DIFF[git diff -z --diff-filter=d HEAD^1 HEAD]
    DIFF --> XARGS[xargs -0 --no-run-if-empty\npre-commit run --files]
    XARGS --> HOOKS[isort · black · flake8\nclang-format · codespell\nconventional-pre-commit\nadd-license @ v1.4.3]

    LOCAL([Developer local commit]) --> COMMIT_MSG[commit-msg hook\nconventional-pre-commit v4.4.0]
    LOCAL --> PRECOMMIT_LOCAL[pre-commit hooks\nall existing hooks]

Loading

_{Reviews (2): Last reviewed commit: "ci: harden CI workflows and configs per ..." | Re-trigger Greptile}

[mc-nv]

Closing: the team is moving away from centralized org-level configuration in favor of per-repository self-contained setups (see triton-inference-server/server#8897 for the first decentralized implementation). Branch retained for reference. TRI-1100