feat: Add pre-commit hook for validator

This will allow users to validate their Forgejo Actions files (both
actions and workflows) prior to committing them to their repositories,
using a `pre-commit` configuration similar to
```yaml
  - repo: https://code.forgejo.org/forgejo/runner
    rev: v11.1.0
    hooks:
      - id: forgejo-runner-validate
```

Includes a new test.yml job to validate `.pre-commit-hooks.yaml`.

.forgejo/workflows/test.yml

@@ -222,3 +222,53 @@ jobs:
             git diff --color=always
             exit 1
           }
+
+  validate-pre-commit:
+    name: validate pre-commit-hooks file
+    if: vars.ROLE == 'forgejo-coding'
+    runs-on: docker
+    container:
+      image: 'code.forgejo.org/oci/ci:1'
+
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+
+      - name: install pre-commit
+        env:
+          DEBIAN_FRONTEND: noninteractive
+          PIP_ROOT_USER_ACTION: ignore
+          PIP_BREAK_SYSTEM_PACKAGES: 1
+          PIP_PROGRESS_BAR: off
+        run: |
+          apt-get update -qq
+          apt-get -q install -qq -y python3-pip
+          python3 -m pip install 'pre-commit>=3.2.0'
+
+      - name: validate .pre-commit-hooks.yaml
+        run: pre-commit validate-manifest .pre-commit-hooks.yaml
+
+      # Will fail due to `act/runner/testdata/local-action-fails-schema-validation/action/action.yml`
+      - name: check pre-commit hook against local action files (should fail)
+        continue-on-error: true
+        run: |
+          pre-commit try-repo --all-files --verbose . forgejo-runner-validate
+
+      - name: check that a bad workflow file doesn’t validate (should fail)
+        continue-on-error: true
+        run: |
+          mkdir -p test-repo
+          cd test-repo
+          git config set advice.defaultBranchName false
+          git init --quiet
+          mkdir -p .forgejo/workflows
+          cp ../act/runner/testdata/local-action-fails-schema-validation/action/action.yml ./
+          touch .forgejo/workflows/bad-workflow.yml
+          cat > .pre-commit-config.yaml <<EOF
+          repos:
+            - repo: ..
+              rev: ${{ forge.sha }}
+              hooks:
+                - id: forgejo-runner-validate
+          EOF
+          git add .
+          pre-commit run --all-files --verbose forgejo-runner-validate

.pre-commit-hooks.yaml

@@ -0,0 +1,16 @@
+- id: forgejo-runner-validate
+  name: Validate Forgejo Actions files
+  description: This hook validates Forgejo Actions action and workflow files.
+  language: golang
+  entry: runner validate
+  args: ['--directory', '.']
+  pass_filenames: false
+  files: (?:(?:^|/)action|^\.(?:forgejo|github|gitea)/workflows/[^/\n]+)\.ya?ml$
+  types: [yaml]
+  # 3.2.0 is when the pre-* `stages` used here were added.
+  # Old names (without the pre- prefix) are deprecated since 4.0.0.
+  minimum_pre_commit_version: '3.2.0'
+  stages: [pre-commit, pre-merge-commit, pre-push, manual]
+  # validate doesn’t currently provide non-success exit codes,
+  # so falling back to always printing verbose output for now.
+  verbose: true