chore: Adopt ruff for unused-import enforcement

Wire ruff F401 (unused-import) checking into the repo so dead imports are
caught automatically going forward, instead of relying on IDE highlights.

- [tool.ruff] in pyproject.toml: select F401, exempt __init__.py (public
  re-exports), and exclude four files that hardcode googleapis.com URLs
  so cleanup does not trip the check-file-contents mTLS policy.
- ruff pre-commit hook scoped to src/.
- scripts/run_precommit_checks.py (the no-git standalone runner) learns
  the ruff hook, passing --force-exclude so excludes are honored on
  explicit file args.
- Pin ruff in the dev extra to match the hook version.

Change-Id: I0d1dab0011e2418af41f9ff983beb7a4930bae1f

Author: Jacksunwei

.pre-commit-config.yaml

@@ -11,6 +11,12 @@ repos:
     rev: v2.24.0
     hooks:
       - id: pyproject-fmt
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.17
+    hooks:
+      - id: ruff
+        args: [--fix]
+        files: ^src/
   - repo: https://github.com/PyCQA/isort
     rev: 8.0.1
     hooks:

pyproject.toml

@@ -117,6 +117,7 @@ optional-dependencies.dev = [
   "pyink==25.12",
   "pylint>=2.6",
   "pyproject-fmt==2.24",
+  "ruff==0.15.17",
   "tox>=4.23.2",
   "tox-uv>=1.33.2",
 ]
@@ -260,6 +261,25 @@ module.include = [ "py.typed" ]
 sdist.include = [ "src/**/*", "README.md", "pyproject.toml", "LICENSE" ]
 sdist.exclude = [ "src/**/*.sh", "src/**/README.md" ]
 
+[tool.ruff]
+extend-exclude = [
+  "src/google/adk/cli/browser/",
+  # These hardcode googleapis.com endpoints and trip the check-file-contents
+  # mTLS policy check the moment they change. Excluded so unused-import
+  # cleanup does not pull them into a PR; clean them up when the mTLS policy
+  # is addressed.
+  "src/google/adk/integrations/bigquery/bigquery_credentials.py",
+  "src/google/adk/integrations/bigquery/data_insights_tool.py",
+  "src/google/adk/plugins/bigquery_agent_analytics_plugin.py",
+  "src/google/adk/tools/data_agent/data_agent_tool.py",
+  "src/google/adk/v1/",
+  "v1_tests/",
+]
+lint.select = [ "F401" ]
+# __init__.py files re-export symbols for the public API; unused imports
+# there are intentional, not dead code.
+lint.per-file-ignores."**/__init__.py" = [ "F401" ]
+
 [tool.isort]
 profile = "google"
 line_length = 200

scripts/run_precommit_checks.py

@@ -95,6 +95,11 @@ class HookSpec:
 # from its .pre-commit-hooks.yaml. The `local` hooks (addlicense,
 # check-new-py-prefix) are handled by _LOCAL_HOOKS below instead.
 _HOOK_SPECS: dict[str, HookSpec] = {
+    'ruff': HookSpec(
+        ['ruff', 'check', '--force-exclude'],
+        ['ruff', 'check', '--fix', '--force-exclude'],
+        _PY,
+    ),
     'isort': HookSpec(['isort', '--check-only', '--diff'], ['isort'], _PY),
     'pyink': HookSpec(['pyink', '--check', '--diff'], ['pyink'], _PY),
     'pyproject-fmt': HookSpec(
@@ -317,7 +322,11 @@ def run_standard_hook(
   if spec.is_fixer and not fix:
     return _run_fixer_in_check_mode(tool, files)
   command = spec.fix_cmd if (fix and spec.fix_cmd) else spec.check_cmd
-  return _run(command + hook.args, files)
+  # Drop `--fix` from the config args: check mode must not modify files, and
+  # fix mode already gets `--fix` from the spec's fix_cmd (passing it twice is
+  # an error, e.g. ruff rejects a repeated `--fix`).
+  args = [a for a in hook.args if a != '--fix']
+  return _run(command + args, files)
 
 
 # --- local hooks (no upstream tool; bespoke handling) -----------------------