Add Nix for pre-commit dependencies

.envrc

@@ -0,0 +1 @@
+use flake

.github/workflows/ci.yml

@@ -10,11 +10,15 @@ concurrency:
   group: ci-${{github.ref}}-${{github.event.pull_request.number || github.run_number}}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   prechecks:
     uses: ./.github/workflows/pre-commit.yml
-  all-prechecks:
-    needs: [prechecks]
+  nix:
+    uses: ./.github/workflows/nix.yml
+  all:
+    needs: [prechecks, nix]
     runs-on: ubuntu-latest
     steps:
       - name: Success

.github/workflows/nix.yml

@@ -0,0 +1,33 @@
+---
+name: build and test nix package
+
+# yamllint disable-line rule:truthy
+on:
+  workflow_dispatch:
+  workflow_call:
+
+concurrency:
+  group: nix-${{github.ref}}-${{github.event.pull_request.number || github.run_number}}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  nix-build:
+    runs-on: ubuntu-latest
+    steps:
+      # Install Nix on the runner
+      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      # Pull from the cachix cache
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          name: cclib
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+      # Checkout of the current head in the working dir
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+      - name: Check nix flake
+        run: nix flake check -L

.github/workflows/pre-commit.yml

@@ -9,13 +9,17 @@ concurrency:
   group: style-${{github.ref}}-${{github.event.pull_request.number || github.run_number}}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
       - name: install dependencies for sorting regressionfiles.yaml
         run: |
           python -m pip install 'ruamel.yaml'
-      - uses: pre-commit/[email protected]
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

.gitignore

@@ -1,5 +1,7 @@
 *.pyc
+.direnv
 .idea
+.venv
 
 regressionfiles.diff
 regressionfiles.yaml.orig

.pre-commit-config.yaml

@@ -13,15 +13,47 @@ repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: "v5.0.0"
     hooks:
+      - id: check-json
       - id: check-yaml
+      - id: trailing-whitespace
+        exclude: |
+          (?x)(
+              ^ADF|
+              ^DALTON|
+              ^FChk|
+              ^GAMESS|
+              ^GAMESSDAT|
+              ^GAMESS-UK|
+              ^Gaussian|
+              ^io|
+              ^Jaguar|
+              ^Molcas|
+              ^Molpro|
+              ^MOPAC|
+              ^NBO|
+              ^NWChem|
+              ^ORCA|
+              ^Psi3|
+              ^Psi4|
+              ^QChem|
+              ^Turbomole|
+              ^XTB
+          )
   - repo: local
     hooks:
       - id: sort-regressionfiles-yaml
         name: Sort regressionfiles.yaml
         entry: ./sort_regressionfiles_yaml.sh
         language: script
         files: ^regressionfiles\.yaml$
-  - repo: https://github.com/Mateusz-Grzelinski/actionlint-py
-    rev: "v1.7.7.23"
+  - repo: https://github.com/rhysd/actionlint
+    rev: "v1.7.7"
     hooks:
       - id: actionlint
+        additional_dependencies:
+          - "github.com/wasilibs/go-shellcheck/cmd/[email protected]"
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: "v1.9.0"
+    hooks:
+      - id: zizmor
+        args: [--no-progress, --persona=pedantic]

flake.nix

@@ -0,0 +1,79 @@
+{
+  description = "Parsers and algorithms for computational chemistry logfiles (regression data)";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+    }:
+    let
+      /*
+        Change this value ({major}.{min}) to
+        update the Python virtual-environment
+        version. When you do this, make sure
+        to delete the `.venv` directory to
+        have the hook rebuild it for the new
+        version, since it won't overwrite an
+        existing one. After this, reload the
+        development shell to rebuild it.
+        You'll see a warning asking you to
+        do this when version mismatches are
+        present. For safety, removal should
+        be a manual step, even if trivial.
+      */
+      version = "3.13";
+    in
+    flake-utils.lib.eachDefaultSystem (
+      system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+      in
+      {
+        devShells.default =
+          let
+            concatMajorMinor =
+              v:
+              pkgs.lib.pipe v [
+                pkgs.lib.versions.splitVersion
+                (pkgs.lib.sublist 0 2)
+                pkgs.lib.concatStrings
+              ];
+            python = pkgs."python${concatMajorMinor version}";
+          in
+          pkgs.mkShellNoCC {
+            venvDir = ".venv";
+
+            postShellHook = ''
+                      venvVersionWarn() {
+                local venvVersion
+                venvVersion="$("$venvDir/bin/python" -c 'import platform; print(platform.python_version())')"
+
+                [[ "$venvVersion" == "${python.version}" ]] && return
+
+                cat <<EOF
+              Warning: Python version mismatch: [$venvVersion (venv)] != [${python.version}]
+                       Delete '$venvDir' and reload to rebuild for version ${python.version}
+              EOF
+              }
+
+              venvVersionWarn
+            '';
+
+            packages = [
+              pkgs.coreutils
+              pkgs.diffutils
+              pkgs.patch
+              python.pkgs.pip
+              python.pkgs.ruamel-yaml
+              python.pkgs.venvShellHook
+            ];
+          };
+      }
+    );
+}

renovate.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "local>cclib/.github:renovate-config"
   ]
 }