ci: align pre-commit hooks and GitHub templates

[mc-nv]

What does the PR do?

Aligns this repository with the org-wide setup consolidated in triton-inference-server/.github:

• .pre-commit-config.yaml: shared baseline hooks, conventional-commit message validation (commit-msg stage), and the centralized add-license hook from the org .github repository (rev: v1.4.3 — excludes .github/ templates, never rewrites LICENSE files).
• Pre-commit CI runs only on files modified by the PR.
• Caller stub for the org-wide reusable conventional-pr workflow (@v1.4.3): validates the PR title against Conventional Commits (hard gate — it becomes the squash-merge commit), derives one human-readable label per distinct type found in the title and all conforming commit subjects (e.g. ci: → CI/CD, feat: → feature, fix: → fix), enforces org-wide label colors/descriptions, detects cherry-picks, and fails if no type is derivable and no type label is assigned.
• No per-repo templates: PR templates and issue routing are inherited from the org-wide defaults in triton-inference-server/.github (issues route to the server repository).

Repo-specific: keeps the deploy/templates check-yaml exclude.

Depends on triton-inference-server/.github#5 (pinned tags current: v1.4.3 — already exist, CI is green).

Pros / Cons

Pros

• Single home (org .github repo) for hooks, templates, issue routing, and the PR-title workflow — one change propagates everywhere.
• Repos carry only a config file and two small workflow stubs; no template copies to drift.
• Commit/PR title format enforced both locally (commit-msg hook) and in CI (reusable workflow), with automatic type labels.
• License hooks never modify LICENSE files.

Cons / risks

• Version-pinned dependency on the org .github repository (tags are write-once; changes ship as a new tag + rev bump).
• Template inheritance requires the org .github repository to remain public.

Related Issues / PRs

• Resolves: TRI-1100

Related PRs:

• ci: migrate the centralized add-license hook to the org .github repository developer_tools#61
• ci: align pre-commit hooks and GitHub templates core#517
• ci: align pre-commit hooks and GitHub templates common#161
• ci: align pre-commit hooks and GitHub templates backend#127
• ci: align pre-commit hooks and GitHub templates python_backend#449
• ci: align pre-commit hooks and GitHub templates tensorrt_backend#124
• ci: align pre-commit hooks and GitHub templates onnxruntime_backend#351
• ci: align pre-commit hooks and GitHub templates pytorch_backend#200
• ci: align pre-commit hooks and GitHub templates openvino_backend#119
• ci: align pre-commit hooks and GitHub templates identity_backend#36
• ci: align pre-commit hooks and GitHub templates checksum_repository_agent#14
• ci: align pre-commit hooks and GitHub templates local_cache#16
• ci: align pre-commit hooks and GitHub templates redis_cache#24
• ci: align pre-commit hooks and GitHub templates repeat_backend#19
• ci: align pre-commit hooks and GitHub templates square_backend#22
• ci: align pre-commit hooks and GitHub templates third_party#80
• ci: align pre-commit hooks and GitHub templates triton_cli#127
• ci: align pre-commit hooks and GitHub templates tutorials#158
• ci: align pre-commit hooks and GitHub templates server#8890
• ci: align pre-commit hooks and GitHub templates client#909
• ci: align pre-commit hooks and GitHub templates tensorrtllm_backend#861
• ci: align pre-commit hooks and GitHub templates perf_analyzer#467
• chore: never modify the COPYRIGHT template and guard .github templates model_analyzer#1032

Test plan

• pre-commit validate-config passes; pre-commit run --files <PR diff> passes locally with the centralized hooks pinned to the .github branch SHA.
• After .github#5 merges and v1.4.3 exists: the conventional-pr check validates this PR's own title and applies the ci label.
• No LICENSE file content is changed by this PR.

Caveats

• None beyond the merge-order note above.

Checklist

• PR title follows <commit_type>: <Title> (conventional commit)
• I ran pre-commit locally on all files changed by this PR and it passes
• Copyright header is correct on all changed files
• External contributors: I have read the Contribution guidelines and signed the Contributor License Agreement

[Vinya567]

@greptileai

[greptile-apps]

Greptile Summary

This PR aligns the repository's CI tooling with the org-wide setup in triton-inference-server/.github. It adds a thin caller for the reusable conventional-pr workflow, overhauls the pre-commit workflow to run only on PR-modified files (using a null-delimited git diff | xargs pipeline), and extends .pre-commit-config.yaml with commit-message linting and the centralized add-license hook — all pinned to v1.4.3.

• conventional-pr.yml (new): dual-event trigger (pull_request / pull_request_target) with a mutually-exclusive condition that routes same-repo PRs through the safe pull_request event and fork PRs through pull_request_target so the labeling job gets a writable token without running untrusted code.
• pre-commit.yml (updated): replaces pre-commit/action with a manual pipeline that fetches only 2 commits, caches hook environments, and feeds changed-file paths (null-delimited, deletions filtered) to pre-commit run --files.
• .pre-commit-config.yaml (updated): adds default_install_hook_types, fixes a whitespace quirk in flake8 args, and appends the conventional-pre-commit (commit-msg stage) and add-license hooks at v1.4.3.

Confidence Score: 5/5

Safe to merge; all changes are CI tooling with no impact on production code or existing workflows.

All three files touch only CI configuration. The dual-trigger pattern in conventional-pr.yml is correctly gated to prevent double-runs and privilege escalation from fork PRs. The pre-commit pipeline change (null-delimited git diff | xargs) is sound for the ubuntu runner. The only finding is a minor inconsistency in action version pinning style.

No files require special attention beyond confirming that v1.4.3 exists in triton-inference-server/.github before merging.

Important Files Changed

Filename	Overview
.github/workflows/conventional-pr.yml	New thin caller for the org-wide reusable conventional-pr workflow; dual-trigger pattern with mutually-exclusive condition is correctly implemented to avoid double-runs and prevent privilege escalation from fork PRs.
.github/workflows/pre-commit.yml	Replaces pre-commit/action with a custom step; cache action uses a floating major-version tag (@v4) inconsistent with the other pinned actions, and the cache has no restore-keys fallback causing full misses on config changes.
.pre-commit-config.yaml	Adds commit-msg hook and add-license hook at v1.4.3; default_install_hook_types correctly declares both stages; flake8 arg quoting fix is correct.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    PR[Pull Request event] --> E{Event type?}
    E -->|pull_request same-repo| C1{head.repo == repository?}
    E -->|pull_request_target fork| C2{head.repo != repository?}

    C1 -->|Yes| J1[conventional-pr job limited token]
    C1 -->|No| SKIP1[Job skipped]
    C2 -->|Yes| J2[conventional-pr job writable token]
    C2 -->|No| SKIP2[Job skipped]

    J1 --> RW[Calls reusable workflow at v1.4.3]
    J2 --> RW

    RW --> VA[Validate PR title vs Conventional Commits]
    VA --> LA[Derive and apply type label]
    LA --> OK[Pass]

    subgraph pre-commit CI
        PC1[checkout fetch-depth 2] --> PC2[setup-python]
        PC2 --> PC3[restore hook env cache]
        PC3 --> PC4[git diff HEAD^1 HEAD null-delimited]
        PC4 --> PC5{Files modified?}
        PC5 -->|Yes| PC6[pre-commit run on changed files only]
        PC5 -->|No| PC7[skip via no-run-if-empty]
    end

Loading

_{Reviews (2): Last reviewed commit: "ci: harden CI workflows and configs per ..." | Re-trigger Greptile}

[mc-nv]

Closing: the team is moving away from centralized org-level configuration in favor of per-repository self-contained setups (see triton-inference-server/server#8897 for the first decentralized implementation). Branch retained for reference. TRI-1100