Split PR CI into pre-commit, test, and build workflows

Each Woodpecker workflow file maps to one ci/woodpecker/pr/<file> status
context, so break the single build.yaml into three PR workflows to expose
three separate PR checks:

- .woodpecker/pre-commit.yaml runs the pre-commit hooks via make pre-commit.
- .woodpecker/test.yaml runs make test (go test ./...).
- .woodpecker/build.yaml keeps only the container dry-run build-check.

Add .pre-commit-config.yaml (gofmt/go vet/go unit tests + whitespace/yaml
hooks) and a make pre-commit target. docker.yaml (tag release) is unchanged.

.pre-commit-config.yaml

@@ -0,0 +1,17 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-merge-conflict
+      - id: mixed-line-ending
+        args: [--fix=lf]
+
+  - repo: https://github.com/dnephin/pre-commit-golang
+    rev: v0.5.1
+    hooks:
+      - id: go-fmt
+      - id: go-vet
+      - id: go-unit-tests

.woodpecker/build.yaml

@@ -2,21 +2,6 @@ when:
   - event: [pull_request, push]
 
 steps:
-  - name: test
-    image: golang:1.25
-    commands:
-      - go test -race ./...
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 2
-
   # Validate the image builds without pushing. The CA-baked buildx plugin trusts
   # the internal registry's CA; the plain woodpeckerci plugin fails x509 here.
   - name: build-check

.woodpecker/pre-commit.yaml

@@ -0,0 +1,18 @@
+when:
+  - event: [pull_request, push]
+
+steps:
+  - name: pre-commit
+    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
+    commands:
+      - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/test.yaml

@@ -0,0 +1,18 @@
+when:
+  - event: [pull_request, push]
+
+steps:
+  - name: test
+    image: golang:1.25
+    commands:
+      - make test
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

Makefile

@@ -6,7 +6,7 @@ GOFLAGS := -ldflags="-s -w -X main.version=$(VERSION)"
 OS      ?= $(shell go env GOOS)
 ARCH    ?= $(shell go env GOARCH)
 
-.PHONY: all build test test-integration lint fmt clean docker patch minor major _tag
+.PHONY: all build test test-integration lint fmt pre-commit clean docker patch minor major _tag
 
 all: build
 
@@ -27,6 +27,12 @@ lint:
 fmt:
 	gofmt -w .
 
+# Run the pre-commit hooks across the whole tree. uvx fetches pre-commit on
+# demand; falls back to a bare pre-commit on PATH if uvx is absent.
+pre-commit:
+	@if command -v uvx >/dev/null 2>&1; then uvx pre-commit run --all-files; \
+	else pre-commit run --all-files; fi
+
 clean:
 	rm -rf $(DIST)