odin-266: ruff upgrade and public repo changes

Author: matt-mercer

.github/actions/build-common/action.yml

@@ -0,0 +1,67 @@
+name: "common-build-steps"
+description: "regular build steps"
+
+
+runs:
+  using: "composite"
+  steps:
+
+    - name: setup python
+      uses: actions/setup-python@v5
+      with:
+        python-version: 3.12
+
+    - name: print branch info
+      shell: bash
+      run: |
+        git branch
+        echo "GITHUB_HEAD_REF=${GITHUB_HEAD_REF}"
+        echo "GITHUB_BASE_REF=${GITHUB_BASE_REF}"
+        git log --oneline -n 10
+
+    - name: clean
+      shell: bash
+      run: |
+        git clean -fdx
+
+    - name: check secrets
+      uses: ./.github/actions/check-secrets
+
+    - name: merge into base_branch
+      if: ${{ github.event_name == 'pull_request' }}
+      shell: bash
+      run: |
+        echo base branch "${{ github.base_ref }}"
+        echo pr branch "${{ github.head_ref }}"
+        git checkout "${{ github.base_ref }}"
+        git checkout -b "merging-${{ github.event.number }}"
+        git merge --ff-only "${{ github.event.pull_request.head.sha }}"
+
+    - name: git reset
+      shell: bash
+      run: git reset --hard
+
+
+    - name: replace remove some unneeded tools
+      if: ${{ hashFiles('**/.tool-versions') }}
+      shell: bash
+      run: |
+        sed -i -E 's#^python .*##g' .tool-versions
+        sed -i -E 's#^pre-commit .*##g' .tool-versions
+
+    - name: Install tools from asdf config
+      if: ${{ hashFiles('**/.tool-versions') }}
+      uses: ai/asdf-cache-action@v1
+
+    - name: cache virtualenv
+      uses: actions/cache@v4
+      with:
+        path: |
+          .venv
+          **/.lock-hash
+          **/requirements.txt
+        key: ${{ runner.os }}-py-${{ inputs.python-version }}-poetry-${{ hashFiles('./poetry.lock') }}
+
+    - name: install
+      shell: bash
+      run: make install-ci

.github/actions/check-secrets/action.yml

@@ -0,0 +1,22 @@
+name: "CI stages"
+description: "run any standard CI stages found in the root Makefile"
+
+inputs:
+  scan-type:
+    description: secrets scan type  recursive/untracked etc.
+    default: 'recursive'
+    required: false
+
+runs:
+  using: "composite"
+  steps:
+    - name: run git-secrets
+      shell: bash
+      run: |
+        export PATH="${PATH}:${{ github.action_path }}"
+        git secrets --register-aws
+        if [[ -e ./.gitdisallowed ]]; then
+          git secrets --add-provider -- grep -Ev '^(#.*|\s*$)' .gitdisallowed || true
+          git secrets --add --allowed '^.gitdisallowed:[0-9]+:.*' || true
+        fi
+        git secrets --scan --${{ inputs.scan-type }}