Pre-existing `pre-commit run --all-files` failures (tracking)

[scottschreckengaust]

Summary

pre-commit run --all-files currently fails on a clean checkout of main (verified at commit 7a17df7). CI does not run the full pre-commit suite — it runs mise run build — so these failures are latent and only surface when a contributor runs the hooks locally. This is a tracking issue for the distinct, independent failures; each root cause has its own issue with details and a proposed fix.

Why this matters

Contributors who install the git hooks (pre-commit install) or run mise run pre-commit hit failures unrelated to their change, which trains people to bypass hooks with --no-verify. Fixing these restores a clean local signal.

How to reproduce

git checkout main
mise exec -- pre-commit run --all-files

Per-hook results on clean main

Hook	Result	Root cause
check-ast, check-builtin-literals, debug-statements, ruff-format	Failed	12 code_templates/*.py are intentionally non-runnable and don't parse
check-executables-have-shebangs	Failed	6 .md files carry the executable bit
check-shebang-scripts-are-executable	Failed	2 .py scripts have a shebang but no executable bit
check-json	Failed	aws4-shapes.json has a duplicate key (iot)
check-vcs-permalinks	Failed	non-permalink github.com/.../blob/main/... URLs in 2 docs
ruff-check	Failed	real lint errors (F841/E402/F821) in non-template .py files
bandit	Failed (exit 2)	references a missing .bandit-baseline.json
no-commit-to-branch	Failed	not a bug — only "fails" because the reproduction runs on main; the hook exists to block that. Excluded.

Sub-issues are linked in the comments below.

_{Filed with assistance from Claude Code while implementing #211.}

[scottschreckengaust]

Sub-issues filed (one per root cause):

• pre-commit: 12 code_templates/*.py files fail Python-parse hooks (check-ast, ruff-format) #214 — 12 code_templates/*.py fail Python-parse hooks (check-ast, check-builtin-literals, debug-statements, ruff-format)
• pre-commit: incorrect executable bits (6 .md marked +x; 2 .py scripts missing +x) #215 — incorrect executable bits (6 .md marked +x; 2 .py scripts missing +x) → check-executables-have-shebangs, check-shebang-scripts-are-executable
• pre-commit: check-json fails — duplicate key iot in aws4-shapes.json #216 — duplicate JSON key iot in aws4-shapes.json → check-json
• pre-commit: check-vcs-permalinks fails on non-permalink GitHub URLs in docs #217 — non-permalink GitHub URLs in DSQL docs → check-vcs-permalinks
• pre-commit: ruff-check fails with real lint errors (F841/E402/F821) in non-template scripts #218 — real ruff lint errors (F841/E402/F821) in non-template scripts → ruff-check
• pre-commit: bandit hook fails (exit 2) — missing .bandit-baseline.json #219 — missing .bandit-baseline.json → bandit hook exits 2

no-commit-to-branch is intentionally excluded: it only "fails" because the repro runs while checked out on main, which is exactly what that hook is designed to prevent — it is not a defect.