Repository navigation
Improve pre-commit actions - #221
Merged
Merged
Conversation
Just adding an extra layer of security.
We were using the legacy ruff hooks, and we were auto-formatting. It's been pointed out that having it auto-format stuff is not always super-helpful, so I've taken that out and used the non-legacy hook names.
This is to limit the potential for secrets being committed.
Changing the behaviour so, similarly to disabling the --fix flag for ruff lint, this will flag non-compliant formatting but not automatically fix it, leaving it up to the author to manually fix.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new hashes unintentionally downgrade Ruff and uv from their previously configured versions.
1 open finding
What changed in this PR
Hash-pins pre-commit hooks, updates Ruff hook behavior, and adds secret detection.
Changes:
- Replaces version tags with immutable commit hashes.
- Makes Ruff linting and formatting check-only.
- Adds the Betterleaks secret scanner.
| File | Description |
|---|---|
.pre-commit-config.yaml |
Updates and expands pre-commit hook configuration. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Updated ruff-pre-commit version from v0.16.8 to v0.16.10. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Contributor
|
LGTM just need to resolve test failure |
Max Freedman (mfreedman-moj)
approved these changes
Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR introduces a few improvements to the pre-commit hooks:
betterleaksTo test, clone the repo, update your pre-commit hooks and maybe experiment with the new behaviour (namely ruff and secrets detection). In my testing,
betterleaksmanaged to catch an API key.