chore(hooks): close hawkeye pin/coverage gaps flagged on #474

[jussielo-amd]

Summary

• Adds a test (xtask/src/hawkeye_pin.rs) guarding that CONTRIBUTING.md's hawkeye@7.0.0 install instruction and ci.yml's HAWKEYE_VERSION never silently drift apart.
• Widens the local license-headers pre-commit hook's types_or to include markdown, so a markdown-only commit no longer skips the local safety net that CI's hawkeye check already enforces against **/*.md.

Why

Follow-up to two non-blocking items an automated review surfaced on #474 and verified as real but out of scope for that docs-only PR:

• The hawkeye@7.0.0 pin had nothing tying it to CI's pin, unlike the analogous cargo-about pin which already has this guard in xtask/src/tpn.rs.
• The local hook's file-type filter didn't cover markdown even though CI's licenserc.toml does, so a markdown-only change passed locally without actually being checked.

Non-obvious decisions

• The new test lives in its own module (xtask/src/hawkeye_pin.rs), not xtask/src/tpn.rs: unlike cargo-about, hawkeye has no cargo xtask subcommand to host a production const, so the whole file is test-only (#[cfg(test)]), following the existing workflow_contract.rs precedent instead.
• Stacked on docs(contributing): note hawkeye install for license-header hook #474 (base branch, not main) since the test's assertion depends on text docs(contributing): note hawkeye install for license-header hook #474 introduces.

Test plan

• cargo test -p xtask hawkeye_pin passes; manually verified it fails when the pinned constant is changed, then reverted.
• cargo clippy --workspace --all-targets --exclude e2e-cucumber -- -D warnings and cargo fmt --all --check clean.
• prek run license-headers --files README.md confirms the hook now fires on markdown (positive control); prek run license-headers --files Cargo.toml confirms it still skips non-matching types (negative control).
• prek run --all-files license-headers passes — no existing markdown file regresses.
• Staged a trivial markdown-only edit and ran prek run --hook-stage pre-commit license-headers to confirm the hook actually triggers end-to-end for a markdown-only commit, then reverted the edit.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused hook and regression-test changes correctly close the described coverage gaps.

Review effort: Balanced
Findings: None

What changed in this PR

Adds safeguards to keep local and CI hawkeye license-header checks aligned.

Changes:

• Adds a test enforcing consistent hawkeye version pins.
• Runs the local license-header hook for Markdown changes.

File	Description
xtask/​src/​main.rs	Registers the pin-test module.
xtask/​src/​hawkeye_pin.rs	Verifies documented and CI hawkeye versions match.
.pre-commit-config.yaml	Includes Markdown in license-header hook triggers.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rominf]

🔴 Automated review · pr-review-watcher · 4b87dcf

This automation never files a GitHub approval, so no approving review will
appear here whatever the outcome — the merge decision stays with a human
reviewer.

Summary

The PR does two things. It adds a test-only xtask module that fails if the hawkeye version in CONTRIBUTING.md and in ci.yml's HAWKEYE_VERSION stop matching. It also adds markdown to the local license-headers prek hook's types_or, so a commit that changes only markdown no longer skips a check CI already runs on **/*.md. Outcome: No blocking findings. The PR description was not available to this review, so the commit message served as the description. Reviewed: the whole change (prw-base...HEAD, 1 commit, 3 files: .pre-commit-config.yaml, xtask/src/hawkeye_pin.rs, xtask/src/main.rs), plus the code around it (licenserc.toml, ci.yml's license-headers job, CONTRIBUTING.md, tpn.rs, workflow_contract.rs). Verified: cargo test -p xtask hawkeye passes (1/1). cargo clippy -p xtask --all-targets -- -D warnings and cargo fmt --check are clean on a fresh target dir. The test fails when either pinned version is bumped on its own. The hook claim also holds: in prek's identify table markdown is the tag for .md, types_or still filters hooks that set pass_filenames: false, and all 30 tracked .md files outside the excluded skills/rocm-doctor/** already carry the header. CI behaviour is unchanged, because the hook is in local-tools and the license-headers job calls hawkeye directly. The diff passes the leak scan, and none of the PR content tries to inject instructions. Blocking: 0 · Non-blocking: 6.

CI on this head: these checks had not reported when this review ran — E2E tests (MI300X), E2E tests (MI350P), E2E tests (Strix Halo, Ubuntu), Sphinx docs build (-W), Skill checks (skillscope). No check had failed. This review does not claim CI passed.

🚫 Blocking (must fix before merge)

None.

Non-blocking

• xtask/src/hawkeye_pin.rs:58 — ci_text.contains("HAWKEYE_VERSION: v7.0.0") has no anchor at the end, so the test still passes if ci.yml's value becomes v7.0.0-rc1 or v7.0.01. The CONTRIBUTING side is anchored by the --locked that follows the version. Fix: match up to the end of the line, or extract the value first.
• xtask/src/hawkeye_pin.rs:52-61 — the test searches the whole of ci.yml for the substring. It neither restricts the search to the license-headers job's env nor ignores comments. The sibling xtask/src/workflow_contract.rs:12-16 explicitly avoids whole-file substring matching for this reason ("can false-pass … found only in a comment") and already has job_block/job_scalar extractors. Consider moving the check into that module and using those helpers.
• xtask/src/hawkeye_pin.rs:24 — the test-local HAWKEYE_VERSION constant is a third copy of the version. Unlike tpn.rs's ABOUT_VERSION, nothing at runtime uses it, so every bump now takes three edits. Reading the version out of ci.yml and comparing it to CONTRIBUTING.md would remove the copy, and also fix the unanchored match above.
• CONTRIBUTING.md:54 — while you're here: the CONTRIBUTING pin cargo install cargo-about@0.9.1 has the same drift risk this PR closes for hawkeye. tpn.rs:264 (pinned_version_matches_workflows) checks only ci.yml and dependabot-manifests.yml. So "mirrors the existing cargo-about pin guard" in the commit message slightly overstates the match, because that guard never covers CONTRIBUTING.md.
• .pre-commit-config.yaml:94 — nothing guards types_or against licenserc.toml's [files].includes, and the new module's doc says it does not check this. Actually exercising the hook would need prek and hawkeye in a scratch git repo, which is not practical in cargo test. A static parity check (each include glob maps to a tag listed in types_or) is cheap, though, and would keep this gap from coming back.
• .pre-commit-config.yaml:94 — a related coverage gap the PR leaves open (it predates the PR): a commit that changes only licenserc.toml (for example, dropping an exclude) still skips the local hook, because no toml tag is listed. CI's license-headers job remains the only check for that case.

[jussielo-amd]

Addressing the non-blocking findings:

Fixed in 6764859 (the three hawkeye_pin.rs points, which share one root cause): the CI-side check now extracts HAWKEYE_VERSION from the license-headers job's env: mapping instead of a whole-file substring search, so a mention elsewhere in the file (a comment, another job) can't false-pass. The extracted value is compared by equality rather than contains, so a suffixed version (v7.0.0-rc1) no longer satisfies a check meant for v7.0.0. This also removes the test-local HAWKEYE_VERSION constant entirely — the version now has exactly one source (ci.yml), and CONTRIBUTING.md's expected string is derived from it, so a bump only ever needs the two files this test already guards. Verified against all three failure modes with manual negative controls (bumped-only, suffixed-only, bumped-with-a-stale-comment-elsewhere) before reverting them; cargo test -p xtask, cargo clippy --workspace --all-targets --exclude e2e-cucumber -- -D warnings, and cargo fmt --all --check are clean.

Not changed, acknowledged as out of scope for this PR:

• The cargo-about@0.9.1 pin in CONTRIBUTING.md has the same drift risk — tpn.rs's pinned_version_matches_workflows only checks ci.yml and dependabot-manifests.yml, not CONTRIBUTING.md. Fair point on the commit message too: "mirrors the existing cargo-about pin guard" was about the shape of the guard (a version pinned in one place, checked against workflow files), not full file-coverage parity — the cargo-about guard doesn't cover CONTRIBUTING.md either. Worth a follow-up PR.
• A static parity check between .pre-commit-config.yaml's types_or and licenserc.toml's [files].includes — already called out as a known gap in hawkeye_pin.rs's module doc; a reasonable follow-up, but adding a new guard is beyond this PR's scope (closing the two specific gaps flagged on docs(contributing): note hawkeye install for license-header hook #474).
• licenserc.toml itself missing from types_or — confirmed pre-existing, not introduced here.