chore: Sync with WeblateOrg/meta

Author: nijel

.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+# Copyright © Michal Čihař <[email protected]>
+#
+# SPDX-License-Identifier: CC0-1.0
+
+# This file is maintained in https://github.com/WeblateOrg/meta/
+name: Dependency Review
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683   # v4.2.2
+      with:
+        persist-credentials: false
+    - name: Dependency Review
+      uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9   # v4.7.1

.github/workflows/pre-commit.yml

@@ -23,10 +23,21 @@ jobs:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         persist-credentials: false
+    - name: Get cache tag
+      id: get-date
+      run: |
+        echo "cache_tag=$(/bin/date --utc '+%Y%m')" >> "$GITHUB_OUTPUT"
+        echo "previous_cache_tag=$(/bin/date --date='1 month ago' --utc '+%Y%m')" >> "$GITHUB_OUTPUT"
+      shell: bash
     - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      id: pre-commit-cache
       with:
         path: ~/.cache/pre-commit
-        key: ${{ runner.os }}-pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
+        key: ${{ runner.os }}-pre-commit-${{ steps.get-date.outputs.cache_tag }}-${{ hashFiles('.pre-commit-config.yaml') }}
+        restore-keys: |
+          ${{ runner.os }}-pre-commit-${{ steps.get-date.outputs.cache_tag }}
+          ${{ runner.os }}-pre-commit-${{ steps.get-date.outputs.previous_cache_tag }}
+          ${{ runner.os }}-pre-commit-
     - name: Setup Python
       uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
@@ -46,13 +57,17 @@ jobs:
         fi
     - name: pre-commit (PEP 735)
       if: steps.detect.outputs.method == 'pep735'
-      run: uv run --only-group pre-commit pre-commit run --all --show-diff-on-failure
+      run: |
+        uv run --only-group pre-commit pre-commit run --all --show-diff-on-failure
+        uv run --only-group pre-commit pre-commit gc
       env:
         RUFF_OUTPUT_FORMAT: github
         REUSE_OUTPUT_FORMAT: github
     - name: pre-commit (uvx)
       if: steps.detect.outputs.method == 'uvx'
-      run: uvx pre-commit run --all --show-diff-on-failure
+      run: |
+        uvx pre-commit run --all --show-diff-on-failure
+        uvx pre-commit gc
       env:
         RUFF_OUTPUT_FORMAT: github
         REUSE_OUTPUT_FORMAT: github
@@ -64,7 +79,9 @@ jobs:
       run: uv pip install --system "$(sed -n 's/.*"\(pre-commit==\([^"]*\)\)".*/\1/p' pyproject.toml)"
     - name: pre-commit (installed)
       if: steps.detect.outputs.method == 'requirements' || steps.detect.outputs.method == 'pyproject'
-      run: pre-commit run --all --show-diff-on-failure
+      run: |
+        pre-commit run --all --show-diff-on-failure
+        pre-commit gc
       env:
         RUFF_OUTPUT_FORMAT: github
         REUSE_OUTPUT_FORMAT: github

.github/workflows/pull_requests.yaml

@@ -15,9 +15,6 @@ permissions:
 
 jobs:
   weblate_automerge:
-    permissions:
-      pull-requests: write
-      contents: write
     runs-on: ubuntu-24.04
     name: Weblate automerge
     if: github.actor == 'weblate'

.pre-commit-config.yaml

@@ -34,7 +34,6 @@ repos:
   - id: mdformat
     additional_dependencies:
     - mdformat-gfm==0.4.1
-    - mdformat-ruff==0.1.3
     - mdformat-shfmt==0.2.0
     - mdformat_tables==1.0.0
 - repo: https://github.com/igorshubovych/markdownlint-cli
@@ -50,13 +49,31 @@ repos:
   rev: v1.7.7
   hooks:
   - id: actionlint
-- repo: https://github.com/adamchainz/blacken-docs
-  rev: 1.19.1
-  hooks:
-  - id: blacken-docs
 - repo: https://github.com/zizmorcore/zizmor-pre-commit
   rev: v1.11.0
   hooks:
   - id: zizmor
+- repo: https://github.com/scop/pre-commit-shfmt
+  rev: v3.12.0-1
+  hooks:
+  - id: shfmt
+    args: [--write]
+- repo: https://github.com/shellcheck-py/shellcheck-py
+  rev: v0.10.0.1
+  hooks:
+  - id: shellcheck
+    require_serial: true
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.27.2
+  hooks:
+  - id: gitleaks-docker
+- repo: https://github.com/astral-sh/ruff-pre-commit
+  rev: v0.12.3
+  hooks:
+  - id: ruff-check
+    args:
+    - --fix
+    - --exit-non-zero-on-fix
+  - id: ruff-format
 ci:
   autoupdate_schedule: quarterly