fix(ci): make pre-commit fail closed instead of silently passing on an empty file list (#42044)

Co-authored-by: Amin Ghadersohi <amin.ghadersohi@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/pre-commit.yml

@@ -7,6 +7,11 @@ on:
       - "[0-9].[0-9]*"
   pull_request:
     types: [synchronize, opened, reopened, ready_for_review]
+  # Nightly full-tree sweep. Per-PR runs only lint changed files, so a change
+  # that invalidates an untouched file (e.g. a type change that breaks an
+  # importing test) can pass every PR yet leave master red. This catches that.
+  schedule:
+    - cron: "0 6 * * *"
 
 permissions:
   contents: read
@@ -32,6 +37,9 @@ jobs:
         with:
           persist-credentials: false
           submodules: recursive
+          # Full history so we can diff a PR/push against its base commit to
+          # determine changed files (see "Determine changed files" below).
+          fetch-depth: 0
 
       - name: Setup Python
         uses: ./.github/actions/setup-backend/
@@ -69,19 +77,82 @@ jobs:
           restore-keys: |
             pre-commit-v2-${{ runner.os }}-py${{ matrix.python-version }}-
 
-      - name: Get changed files
+      - name: Determine changed files
         id: changed_files
-        uses: ./.github/actions/file-changes-action
-        with:
-          output: " "
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
+        run: |
+          set -euo pipefail
+
+          # Scheduled runs check the whole tree (see the pre-commit step).
+          if [ "${EVENT_NAME}" = "schedule" ]; then
+            echo "mode=all" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Resolve the commit to diff against.
+          base=""
+          if [ "${EVENT_NAME}" = "pull_request" ]; then
+            base="${BASE_SHA}"
+          elif [ -n "${BEFORE_SHA:-}" ] && \
+               [ "${BEFORE_SHA}" != "0000000000000000000000000000000000000000" ]; then
+            base="${BEFORE_SHA}"
+          fi
+
+          # Fail closed: if the diff base can't be resolved, check every file
+          # instead of silently checking nothing. Previously an empty file list
+          # made `pre-commit run --files` a no-op that still reported success,
+          # which let unlinted code reach master.
+          if [ -z "${base}" ] || ! git cat-file -e "${base}^{commit}" 2>/dev/null; then
+            echo "::notice::Could not resolve a diff base; falling back to --all-files."
+            echo "mode=all" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Files present in HEAD that changed since the base (drop deletions).
+          files="$(git diff --name-only --diff-filter=ACMRT "${base}...HEAD")"
+
+          if [ -z "${files}" ]; then
+            echo "mode=none" >> "$GITHUB_OUTPUT"
+          else
+            echo "mode=files" >> "$GITHUB_OUTPUT"
+            {
+              echo "files<<__CHANGED_FILES_EOF__"
+              echo "${files}"
+              echo "__CHANGED_FILES_EOF__"
+            } >> "$GITHUB_OUTPUT"
+          fi
 
       - name: pre-commit
         env:
+          MODE: ${{ steps.changed_files.outputs.mode }}
           CHANGED_FILES: ${{ steps.changed_files.outputs.files }}
         run: |
           set +e  # Don't exit immediately on failure
           export SKIP=type-checking-frontend
-          pre-commit run --files $CHANGED_FILES
+
+          case "${MODE}" in
+            all)
+              echo "ℹ️ Running pre-commit on all files."
+              pre-commit run --all-files
+              ;;
+            files)
+              echo "ℹ️ Running pre-commit on changed files:"
+              echo "${CHANGED_FILES}"
+              # shellcheck disable=SC2086
+              pre-commit run --files ${CHANGED_FILES}
+              ;;
+            none)
+              echo "ℹ️ No source files changed; nothing for pre-commit to check."
+              exit 0
+              ;;
+            *)
+              echo "⚠️ Unrecognized changed-files mode '${MODE}'; checking all files."
+              pre-commit run --all-files
+              ;;
+          esac
           PRE_COMMIT_EXIT_CODE=$?
           git diff --quiet --exit-code
           GIT_DIFF_EXIT_CODE=$?