chore: more linters and pre-commit hooks

Author: danfimov

.github/dependabot.yml

@@ -4,7 +4,11 @@ updates:
     directory: "/"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 30
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 30

.github/workflows/code-check.yml

@@ -5,6 +5,11 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  actions: read
+  contents: read
+  pull-requests: read
+
 jobs:
   test:
     name: Tests
@@ -28,9 +33,11 @@ jobs:
        ports:
          - 5432:5432
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - id: setup-uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d # v7.1.0
         with:
           enable-cache: true
           cache-suffix: ${{ matrix.python-version }}

.github/workflows/release_docs.yml

@@ -21,22 +21,24 @@ jobs:
     steps:
       - name: Checkout merge commit (auto on merge to main)
         if: ${{ github.event_name == 'pull_request' }}
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
+          persist-credentials: false
 
       - name: Checkout PR merge ref (manual on PR)
         if: ${{ github.event_name == 'workflow_dispatch' }}
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: refs/pull/${{ inputs.pr }}/merge
+          persist-credentials: false
 
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]
           git config user.email 41898282+github-actions[bot]@users.noreply.github.com
 
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d # v7.1.0
         with:
           enable-cache: true
           python-version: "3.12"

.github/workflows/release_pypi.yml

@@ -15,12 +15,14 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
-          enable-cache: true
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d # v7.1.0
+        with:
+          enable-cache: false
           python-version: "3.12"
           version: "latest"
-      - run: uv version "${{ github.ref_name }}"
+      - run: uv version "${GITHUB_REF_NAME}"
       - run: uv build
       - run: uv publish --trusted-publishing always

.pre-commit-config.yaml

@@ -1,7 +1,73 @@
+# See https://pre-commit.com for more information
+# See https://pre-commit.com/hooks.html for more hooks
 repos:
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.0
+-   repo: https://github.com/compilerla/conventional-pre-commit
+    rev: v4.3.0
     hooks:
-      - id: ruff-check
-        args: [--fix]
-      - id: ruff-format
+    -   id: conventional-pre-commit
+        stages: [commit-msg]
+
+-   repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+    -   id: trailing-whitespace
+    -   id: mixed-line-ending
+    -   id: check-case-conflict
+    -   id: check-ast
+    -   id: check-toml
+    -   id: check-yaml
+    -   id: check-added-large-files
+    -   id: end-of-file-fixer
+
+-   repo: https://github.com/crate-ci/typos
+    rev: v1.38.1
+    hooks:
+      - id: typos
+
+-   repo: https://github.com/Yelp/detect-secrets
+    rev: v1.5.0
+    hooks:
+    -   id: detect-secrets
+        args: [
+            '--exclude-lines', 'look_in_vault',
+            '--exclude-lines', 'taskiq_postgres',
+            '--exclude-lines', 'postgresql://postgres:postgres@localhost:5432/postgres',
+        ]
+
+-   repo: local
+    hooks:
+    -   id: ruff
+        name: Ruff
+        entry: make ruff
+        language: python
+        types: [python]
+        require_serial: true
+        verbose: true
+        pass_filenames: false
+
+    -   id: mypy
+        name: Mypy
+        entry: make mypy
+        language: python
+        types: [python]
+        require_serial: true
+        verbose: true
+        pass_filenames: false
+
+    -   id: bandit
+        name: bandit
+        entry: uv run --active --frozen bandit -c pyproject.toml -r src
+        language: python
+        types: [python]
+        require_serial: true
+        verbose: true
+        pass_filenames: false
+
+    -   id: zizmor
+        name: zizmor
+        language: python
+        entry: uv run --active --frozen zizmor .
+        files: ^\.github
+        require_serial: true
+        verbose: true
+        pass_filenames: false

Makefile

@@ -1,5 +1,7 @@
 args := $(wordlist 2, 100, $(MAKECMDGOALS))
 
+VIRTUAL_ENV=.venv
+
 .DEFAULT:
 	@echo "No such command (or you pass two or many targets to ). List of possible commands: make help"
 
@@ -35,8 +37,16 @@ run_infra: ## Run rabbitmq in docker for integration tests
 
 .PHONY: lint
 lint: ## Run linting
-	@uv run ruff check src tests
-	@uv run mypy src
+	@$(MAKE) ruff
+	@$(MAKE) mypy
+
+.PHONY: ruff
+ruff: ## Run ruff linting
+	@uv run --active --frozen ruff check src tests
+
+.PHONY: mypy
+mypy: ## Run mypy type checking
+	@uv run --active --frozen mypy src
 
 .PHONY: format
 format: ## Run formatting

docs/tutorial/common_issues.md

@@ -7,7 +7,7 @@ title: Common Issues
 Ensure your connection string is correct:
 
   ```python
-  dsn = "postgresql://username:password@host:port/database"
+  dsn = "postgresql://postgres:postgres@localhost:5432/postgres"
   ```
 
 Check PostgreSQL is running and accessible: