pre-commit.yml

name: pre-commit

on:
  pull_request:
  push:
    branches: [master]

permissions:
  contents: read

jobs:
  pre-commit:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
    - name: set PY
      run: echo "PY=$(python -c 'import hashlib, sys;print(hashlib.sha256(sys.version.encode()+sys.executable.encode()).hexdigest())')" >> $GITHUB_ENV
    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
      with:
        path: ~/.cache/pre-commit
        key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }}
    - name: Run pre-commit
      run: |
        pip install pre-commit==3.7.0
        pre-commit run --show-diff-on-failure --color=always --all-files
  pip-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install uv
        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3.2.4
        with:
          version: "latest"
      - name: Install dependencies
        run: uv sync --all-groups && uv add --dev pip-audit
      - name: Run pip-audit
        run: uv run pip-audit   # Will fail if vulnerabilities are found