Migrate to prek (#73)

* Migrate to prek

* Set up zizimor

* Apply zizmor fixes

* Autoupdate

* Validate and format YAML and TOML

* Add `no-commit-to-branch`

* Use tomlkit for toml operations

* Update pre-commit reference in development docs

* Typo

Author: puddly

.github/workflows/ci.yml

@@ -4,33 +4,45 @@ on:
   push:
     branches:
       - dev
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
-  pages: write
-  id-token: write
+
 jobs:
   build:
+    name: Build documentation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.14"
-      - uses: astral-sh/setup-uv@v8.0.0
+      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
         with:
           enable-cache: true
       - run: uv run --extra docs sphinx-build -b html docs site
-      - uses: actions/upload-pages-artifact@v4
+      - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
         with:
           path: site
+
   deploy:
+    name: Deploy to GitHub Pages
     if: github.event_name != 'pull_request'
     needs: build
+    permissions:
+      pages: write # required by actions/deploy-pages to publish the artifact
+      id-token: write # required by actions/deploy-pages for OIDC verification
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/configure-pages@v5
-      - uses: actions/deploy-pages@v4
+      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
+      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
         id: deployment

.github/workflows/docs.yml

@@ -1,8 +1,5 @@
 name: Build and Publish to PyPI
 
-permissions:
-  id-token: write
-
 on:
   release:
     types:
@@ -15,6 +12,13 @@ on:
     paths:
       - ".github/workflows/publish-to-pypi.yml"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
 jobs:
   build-wheels:
     name: Build wheels (${{ matrix.name }})
@@ -37,15 +41,16 @@ jobs:
             cibw_before_all: "rustup target add x86_64-apple-darwin aarch64-apple-darwin"
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@stable
+        run: rustup default stable && rustup update stable
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v3.4
+        uses: pypa/cibuildwheel@8d2b08b68458a16aeb24b64e68a09ab1c8e82084 # v3.4
         env:
           CIBW_BUILD: "cp310-*"
           CIBW_ARCHS: "${{ matrix.cibw_archs }}"
@@ -54,12 +59,12 @@ jobs:
           # Validate abi3 compliance and repair wheels
           CIBW_BEFORE_BUILD: "pip install abi3audit"
           # Ensure wheels include a loadable Rust extension on supported test platforms
-          CIBW_TEST_COMMAND: 'python -m serialx.tools.list_ports'
+          CIBW_TEST_COMMAND: "python -m serialx.tools.list_ports"
           CIBW_REPAIR_WHEEL_COMMAND_MACOS: "abi3audit {wheel} && delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}"
           CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: "abi3audit {wheel} && cp {wheel} {dest_dir}"
 
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-${{ matrix.name }}
           path: ./wheelhouse/*.whl
@@ -68,12 +73,13 @@ jobs:
     name: Build sdist and pure Python wheel
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.10"
 
@@ -93,13 +99,13 @@ jobs:
           rm dist/*-cp*-*.whl
 
       - name: Upload sdist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: sdist
           path: dist/*.tar.gz
 
       - name: Upload wheel
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-ubuntu
           path: dist/*.whl
@@ -109,33 +115,36 @@ jobs:
     needs: [build-wheels, build-sdist]
     runs-on: ubuntu-latest
     if: github.event_name == 'release'
+    permissions:
+      id-token: write # required for PyPI trusted publishing (OIDC)
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: dist
           merge-multiple: true
 
       - name: Publish serialx to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
 
   build-serialx-compat:
     name: Build serialx-compat
     needs: [build-wheels, build-sdist, publish-pypi]
     runs-on: ubuntu-latest
     if: ${{ always() && (github.event_name != 'release' || needs['publish-pypi'].result == 'success') }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
-          python-version: "3.10"
+          python-version: "3.11"
 
       - name: Install build tools
-        run: pip install build pkginfo
+        run: pip install build pkginfo tomlkit
 
       - name: Resolve version context for release
         if: github.event_name == 'release'
@@ -178,19 +187,20 @@ jobs:
         shell: python
         run: |
           import os
+          import tomlkit
           from pathlib import Path
 
           version = os.environ["SERIALX_PIN_VERSION"]
           path = Path("serialx_compat/pyproject.toml")
-          text = path.read_text()
+          doc = tomlkit.parse(path.read_text())
+
+          assert doc["project"]["version"] == "0.0.0"
+          assert list(doc["project"]["dependencies"]) == ["serialx"]
 
-          assert 'version = "0.0.0"' in text
-          assert 'dependencies = ["serialx"]' in text
+          doc["project"]["version"] = version
+          doc["project"]["dependencies"] = [f"serialx=={version}"]
 
-          path.write_text(
-              text.replace('version = "0.0.0"', f'version = "{version}"')
-                  .replace('dependencies = ["serialx"]', f'dependencies = ["serialx=={version}"]')
-          )
+          path.write_text(tomlkit.dumps(doc))
 
       - name: Build serialx-compat
         run: python -m build --sdist --wheel --outdir dist-serialx-compat serialx_compat
@@ -223,7 +233,7 @@ jobs:
               print(f"{wheel}: {metadata.name} version {version}")
 
       - name: Upload serialx-compat artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: serialx-compat-dist
           path: dist-serialx-compat/*
@@ -233,14 +243,16 @@ jobs:
     needs: [build-serialx-compat]
     runs-on: ubuntu-latest
     if: github.event_name == 'release'
+    permissions:
+      id-token: write # required for PyPI trusted publishing (OIDC)
     steps:
       - name: Download serialx-compat artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: serialx-compat-dist
           path: dist-serialx-compat
 
       - name: Publish serialx-compat to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
         with:
           packages-dir: dist-serialx-compat/

.github/workflows/publish-to-pypi.yml

@@ -12,9 +12,9 @@ uv pip install '.[dev,docs]'
 On macOS and Windows, a Rust toolchain is required to build the native serial port
 enumeration extension. Install Rust via [rustup](https://rustup.rs/).
 
-Set up pre-commit hooks with `pre-commit install`. Your code will then be type checked
+Set up pre-commit hooks with `prek install`. Your code will then be type checked
 and auto-formatted when you run `git commit`. You can do this on-demand with
-`pre-commit run`.
+`prek run`.
 
 Serialx relies on automated testing. CI runs tests using both `socat` virtual PTYs
 (Linux/macOS) and socket-based serial pairs. To also test with physical adapter pairs,

.pre-commit-config.yaml

@@ -0,0 +1,93 @@
+# Configuration file for `prek`, a git hook framework written in Rust.
+# See https://prek.j178.dev for more information.
+#:schema https://www.schemastore.org/prek.json
+
+[[repos]]
+repo = "builtin"
+
+[[repos.hooks]]
+id = "no-commit-to-branch"
+args = ["--branch", "dev"]
+
+[[repos]]
+repo = "https://github.com/codespell-project/codespell"
+rev = "v2.4.2"
+
+[[repos.hooks]]
+id = "codespell"
+additional_dependencies = ["tomli"]
+args = ["--toml", "pyproject.toml"]
+
+[[repos]]
+repo = "https://github.com/pre-commit/mirrors-mypy"
+rev = "v1.20.2"
+
+[[repos.hooks]]
+id = "mypy"
+additional_dependencies = ["types-pywin32"]
+
+[[repos]]
+repo = "https://github.com/astral-sh/ruff-pre-commit"
+rev = "v0.15.12"
+
+[[repos.hooks]]
+id = "ruff-check"
+args = ["--fix"]
+
+[[repos.hooks]]
+id = "ruff-format"
+
+[[repos]]
+repo = "https://github.com/rbubley/mirrors-prettier"
+rev = "v3.8.3"
+
+[[repos.hooks]]
+id = "prettier"
+files = '^tests/data/pyodide/.*\.(ts|json)$'
+
+[[repos]]
+repo = "https://github.com/google/yamlfmt"
+rev = "v0.21.0"
+
+[[repos.hooks]]
+id = "yamlfmt"
+args = ["-formatter", "retain_line_breaks=true"]
+
+[[repos]]
+repo = "https://github.com/ComPWA/taplo-pre-commit"
+rev = "v0.9.3"
+
+[[repos.hooks]]
+id = "taplo-format"
+
+[[repos]]
+repo = "local"
+
+[[repos.hooks]]
+id = "cargo-fmt"
+name = "Cargo fmt"
+entry = "cargo fmt --all"
+language = "system"
+pass_filenames = false
+
+[[repos.hooks]]
+id = "cargo-check"
+name = "Cargo check"
+entry = "cargo check --workspace"
+language = "system"
+pass_filenames = false
+
+[[repos.hooks]]
+id = "rust-clippy"
+name = "Cargo clippy"
+entry = "cargo clippy --all-targets --all-features -- -Dclippy::all -Dclippy::nursery"
+language = "system"
+pass_filenames = false
+
+[[repos]]
+repo = "https://github.com/zizmorcore/zizmor-pre-commit"
+rev = "v1.24.1"
+
+[[repos.hooks]]
+id = "zizmor"
+args = ["--pedantic"]