From 358261e6c9cdbc0852b7245fa1b93b2b8d712f79 Mon Sep 17 00:00:00 2001
From: William Martin <97306842+wmartin-gss@users.noreply.github.com>
Date: Fri, 25 Sep 2026 10:32:47 +0100
Subject: [PATCH 1/5] Hash-pin pre-commit hooks

Just adding an extra layer of security.
---
 .pre-commit-config.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index e41d3b4..26affdf 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
@@ -12,7 +12,7 @@ repos:
         description: Forces to replace line ending by the UNIX 'lf' character.
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.16.8
+    rev: 2eeb5678de71a00c0902cbda7105d328432f72cb  # frozen: v0.16.8
     hooks:
       # Run the linter.
       - id: ruff
@@ -20,10 +20,10 @@ repos:
       # Run the formatter.
       - id: ruff-format
   - repo: https://github.com/kynan/nbstripout
-    rev: 0.9.1
+    rev: f5da19ce3b7b40e97c12ee9cd8ce97f48f97ddf7  # frozen: 0.9.1
     hooks:
       - id: nbstripout
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.12.17
+    rev: 17a6b18b8006d390e476d419631aae885cadfa40  # frozen: 0.12.17
     hooks:
       - id: uv-lock

From a6b91788b9d7b98d2fda42fe6b84c8dd21375041 Mon Sep 17 00:00:00 2001
From: William Martin <97306842+wmartin-gss@users.noreply.github.com>
Date: Fri, 25 Sep 2026 10:39:26 +0100
Subject: [PATCH 2/5] Update ruff pre-commit hooks

We were using the legacy ruff hooks, and we were auto-formatting. It's
been pointed out that having it auto-format stuff is not always
super-helpful, so I've taken that out and used the non-legacy hook
names.
---
 .pre-commit-config.yaml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 26affdf..bd5cb5c 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -11,13 +11,9 @@ repos:
         args: ["--fix=lf"]
         description: Forces to replace line ending by the UNIX 'lf' character.
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    # Ruff version.
     rev: 2eeb5678de71a00c0902cbda7105d328432f72cb  # frozen: v0.16.8
     hooks:
-      # Run the linter.
-      - id: ruff
-        args: [--fix]
-      # Run the formatter.
+      - id: ruff-check
       - id: ruff-format
   - repo: https://github.com/kynan/nbstripout
     rev: f5da19ce3b7b40e97c12ee9cd8ce97f48f97ddf7  # frozen: 0.9.1

From 6e4b694afa77a3606dd918b75e638e27c01422ca Mon Sep 17 00:00:00 2001
From: William Martin <97306842+wmartin-gss@users.noreply.github.com>
Date: Fri, 25 Sep 2026 10:45:52 +0100
Subject: [PATCH 3/5] Add betterleaks pre-commit hook

This is to limit the potential for secrets being committed.
---
 .pre-commit-config.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index bd5cb5c..b27f51f 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -23,3 +23,7 @@ repos:
     rev: 17a6b18b8006d390e476d419631aae885cadfa40  # frozen: 0.12.17
     hooks:
       - id: uv-lock
+  - repo: https://github.com/betterleaks/betterleaks
+    rev: 5eab48332cc48565864514e3bc6de89df091a7c4  # frozen: v1.8.1
+    hooks:
+      - id: betterleaks

From ddd28a04a4b7416f1d0e6018ef086476d1c8720f Mon Sep 17 00:00:00 2001
From: William Martin <97306842+wmartin-gss@users.noreply.github.com>
Date: Fri, 25 Sep 2026 15:58:59 +0100
Subject: [PATCH 4/5] Prevent Ruff auto-formatting files in pre-commit

Changing the behaviour so, similarly to disabling the --fix flag for
ruff lint, this will flag non-compliant formatting but not automatically
fix it, leaving it up to the author to manually fix.
---
 .pre-commit-config.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b27f51f..1dd826e 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -15,6 +15,7 @@ repos:
     hooks:
       - id: ruff-check
       - id: ruff-format
+        args: ["--check"]
   - repo: https://github.com/kynan/nbstripout
     rev: f5da19ce3b7b40e97c12ee9cd8ce97f48f97ddf7  # frozen: 0.9.1
     hooks:

From bf14ee664271799a33cf3ddae0e124fdde336df6 Mon Sep 17 00:00:00 2001
From: Max Freedman <92523094+mfreedman-moj@users.noreply.github.com>
Date: Fri, 9 Oct 2026 10:05:08 +0100
Subject: [PATCH 5/5] Upgrade ruff-pre-commit to version v0.16.10

Updated ruff-pre-commit version from v0.16.8 to v0.16.10.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .pre-commit-config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 1dd826e..f12cc59 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -11,7 +11,7 @@ repos:
         args: ["--fix=lf"]
         description: Forces to replace line ending by the UNIX 'lf' character.
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 2eeb5678de71a00c0902cbda7105d328432f72cb  # frozen: v0.16.8
+    rev: f12be1ebaa5351c1fc76472de98db2c3446c8253  # frozen: v0.16.10
     hooks:
       - id: ruff-check
       - id: ruff-format