Fix races in pre-commit checks and improve error handling

[lsierant]

Summary

Introduction of parallelism in pre-commit hook introduced races or even caused ignoring errors for some checks executed in background jobs.

Changes

• in pre_commit function each check is send to background with tracking its pid to. Previously we dispatched tasks into background and execute wait builtin without arguments. While it's OK for just waiting until completion it's ignoring any errors. Now, we're using wait "${pid}", which fails if the background job return non zero code.
  • Note, that we cannot just use simple wait with $(jobs -p) because it's race'y (see the next point)
• in start_shellcheck we're using xargs that errors if any of the checks in background resulted in error. Previously there was a race condition because until we reached jobs -p some of the checks might be already failed and finished and it won't show on the job list.

Proof of Work

• Clean lint_repo in evg

[2025/08/24 00:11:23.223] pre-commit: All checks passed!

• Deliberate error in shellcheck:

[2025/08/24 01:26:57.709] Some checks have failed:
[2025/08/24 01:26:57.709]     shellcheck (PID 4211)

Checklist

• Have you linked a jira ticket and/or is the ticket in the title?
• Have you checked whether your jira ticket required DOCSP changes?
• Have you added changelog file?
  • use skip-changelog label if not needed
  • refer to Changelog files and Release Notes section in CONTRIBUTING.md for more details

[github-actions]

⚠️ (this preview might not be accurate if the PR is not rebased on current master branch)

MCK 1.3.0 Release Notes

Bug Fixes

• This change fixes the current complex and difficult-to-maintain architecture for stateful set containers, which relies on an "agent matrix" to map operator and agent versions which led to a sheer amount of images.
• We solve this by shifting to a 3-container setup. This new design eliminates the need for the operator-version/agent-version matrix by adding one additional container containing all required binaries. This architecture maps to what we already do with the mongodb-database container.
• Fixed an issue where the readiness probe reported the node as ready even when its authentication mechanism was not in sync with the other nodes, potentially causing premature restarts.

Other Changes

• Optional permissions for PersistentVolumeClaim moved to a separate role. When managing the operator with Helm it is possible to disable permissions for PersistentVolumeClaim resources by setting operator.enablePVCResize value to false (true by default). When enabled, previously these permissions were part of the primary operator role. With this change, permissions have a separate role.
• subresourceEnabled Helm value was removed. This setting used to be true by default and made it possible to exclude subresource permissions from the operator role by specifying false as the value. We are removing this configuration option, making the operator roles always have subresource permissions. This setting was introduced as a temporary solution for this OpenShift issue. The issue has since been resolved and the setting is no longer needed.
• We have deliberately not published the container images for OpsManager versions 7.0.16, 8.0.8, 8.0.9 and 8.0.10 due to a bug in the OpsManager which prevents MCK customers to upgrade their OpsManager deployments to those versions.

[nammn]

why not inline capture_bg_job here?

[lsierant]

great catch! It was a leftover from my previous approach where I had capture_bg_job used for every check in pre-commit function. Removed.

[nammn]

lgtm, consider my comment