ci: Node 24 actions + tighten trunk vs pre-commit lint ownership

[helly25]

Summary

Three connected housekeeping changes from a trunk check -a sweep on the fresh meta-linter setup.

1. Node 24 GHA action bumps

GitHub will force JavaScript actions to Node 24 by default on 2026-06-02 and remove Node 20 from runners on 2026-09-16. Each CI job was emitting a deprecation warning. Bumped:

• actions/checkout@v4 → v6
• actions/cache/restore@v4 → v5
• actions/cache/save@v4 → v5

bazelbuild/setup-bazelisk@v3 left as-is — no Node 24 release upstream yet.

2. Split trunk vs pre-commit lint ownership

After #180 enabled trunk as a meta-linter, four tools ran in both pre-commit and trunk. That caused a real conflict (shfmt: pre-commit formats to 2-space indent, trunk reverted to tabs because its custom definition omitted -i=2) and noisy duplicate diagnostics elsewhere. Trunk is brand new in this repo; pre-commit had been working — bias toward leaving pre-commit alone unless trunk adds clear value.

Tool	Owner	Why
shfmt	pre-commit	Project pins -bn -ci -i=2 -w; trunk's custom def had only -w (→ tabs by default)
actionlint	pre-commit	Pre-commit pins -shellcheck "" to suppress nested shellcheck noise
shellcheck	pre-commit	.shellcheckrc moved from .trunk/configs/ to repo root so pre-commit auto-discovers it; enable=all dropped (would have silently raised strictness); disable=SC2154 kept and documented
buildifier	trunk	Trunk's custom def splits --lint=fix (formatter) from --lint=warn (diagnostic) with a JSON parser; newer version (8.5.1 vs 8.2.0)
check-yaml / yamllint	both	check-yaml is a cheap parse-only sanity check; yamllint adds style

Trunk-only (no pre-commit equivalent): checkov, clang-tidy, git-diff-check, markdownlint, prettier, trivy, trufflehog, yamllint.
Pre-commit-only (no trunk equivalent or custom checks): check-added-large-files, check-merge-conflict, check-yaml, end-of-file-fixer, trailing-whitespace, and the seven local custom hooks (mope-*, *-patch-applies, compare-versions, no-do-not-merge, no-todos-without-context). Pre-commit cannot be dropped — those local hooks have no portable equivalent.

3. Clear trunk check -a findings (50 → 0 CI-blocking)

A full-repo trunk scan surfaced 50 findings. Resolved as follows.

Policy edits:

• .trunk/trunk.yaml: override clang-tidy's run_when from [cli, monitor, ci] to [cli, monitor]. clang-tidy is useless without compile_commands.json; local devs generate it via bazel run @hedron_compile_commands//:refresh_all but CI does not. Even with a compile DB present, trunk's hermetic clang-tidy@16.0.3 binary cannot resolve C++ stdlib headers (the install ships only bin/clang-tidy + clang-builtin headers, no libc++/libstdc++). Gating to local-only avoids ~20 spurious "<header> file not found" diagnostics per CI run.
• .trunk/configs/.yamllint.yaml: disable quoted-strings. The only-when-needed setting collides with prettier (which prefers double quotes for many YAML strings); the rule is purely stylistic. yamllint's other useful checks remain.
• .github/workflows/{cache_cleanup,release,test}.yml: declare workflow-level permissions: read-all to satisfy checkov CKV2_GHA_1. cache_cleanup uses secrets.CACHE_ACCESS (a custom PAT), so the default GITHUB_TOKEN does not need write scopes; release.yml's existing job-level contents: write override is preserved.

Auto-fix sweep (one-time, applied now that trunk owns the relevant formatters):

• .bcr/metadata.template.json, .bcr/presubmit.yml: prettier reformatted JSON/YAML.
• CODE_OF_CONDUCT.md, CONTRIBUTING.md, README.md, RULES.md: markdownlint fixes (MD040 missing language tags, MD026 trailing punctuation, MD041 top-level heading placement, MD045 image alt text). Two affected headings hand-edited to shorter forms with descriptive text moved to body prose.

4. Restrict pre-commit clang-format to C/C++/CUDA

After the auto-fix sweep, CI surfaced a new fight: mirrors-clang-format@v19.1.6's default types_or includes json (clang-format 14+ added JSON support), and pre-commit's clang-format reformatted .bcr/metadata.template.json back to multi-line — undoing trunk-prettier's compaction. Override types_or: [c, c++, cuda] so JSON stays prettier's job.

Test plan

• bazel test //mbo/testing:matchers_test (covered by parallel feat(testing): add IsElementOf / IsKeyOf / IsValueOf matchers #181)
• CI green
• trunk check -a reports zero CI-visible findings on this branch (the 25 remaining are clang-tidy diagnostics now gated to local-only)
• Node 20 deprecation warning reduced to only bazelbuild/setup-bazelisk@v3

Out of scope

• clang-tidy CI integration. The extractor (hedron_compile_commands) itself runs clean — no patches needed. The blocker is that trunk's hermetic clang-tidy binary ships no C++ stdlib; resolving that means either (a) wrapping with the Bazel-built clang-tidy, (b) injecting --extra-arg=-isysroot=... per platform, or (c) dropping clang-tidy from trunk entirely. Tracked separately.

🤖 Generated with Claude Code