ci: mirror hashview lint/security gates

Adds the gates the hashview repo runs, adapted to hate_crack's uv toolchain:

- ruff format --check as a CI step + a ruff-format prek pre-push hook
  (the package was reformatted in the preceding commit).
- Bandit SAST vs a committed baseline (.bandit-baseline.json, 114 reviewed
  low-severity subprocess/shlex findings); [tool.bandit] config in
  pyproject.toml; CI job + prek pre-push hook. Only NEW findings fail.
- pip-audit dependency-CVE gate (CI job). PYSEC-2026-2447 (diskcache 5.6.3,
  transitive via instructor -> atomic-agents) is ignored — no upstream fix.
- Hygiene pre-commit hooks (trailing-whitespace, end-of-file-fixer, check-yaml,
  check-merge-conflict, check-added-large-files) via the pre-commit-hooks repo.
- CLAUDE.md updated: lint/security commands, prek install (+pre-commit hook
  type), and the active-hooks list.

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -33,9 +33,12 @@ jobs:
       - name: Install dependencies
         run: uv sync --dev
 
-      - name: Ruff
+      - name: Ruff (lint)
         run: uv run ruff check hate_crack
 
+      - name: Ruff (format)
+        run: uv run ruff format --check hate_crack
+
       - name: Ty
         run: uv run ty check hate_crack
 
@@ -43,3 +46,48 @@ jobs:
         env:
           HATE_CRACK_SKIP_INIT: "1"
         run: uv run pytest -q
+
+  # Bandit SAST against the committed baseline (.bandit-baseline.json): only
+  # findings NOT already in the baseline fail the build. hate_crack shells out
+  # to hashcat extensively, so the baseline captures the reviewed low-severity
+  # subprocess/shlex findings. Config lives in [tool.bandit] in pyproject.toml.
+  bandit:
+    name: Bandit SAST
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
+
+      - name: Bandit (vs baseline)
+        run: >-
+          uvx --from "bandit[toml]==1.9.4" bandit
+          -r hate_crack -c pyproject.toml -b .bandit-baseline.json
+
+  # pip-audit: fail on dependencies with known CVEs (PyPI / OSV advisory DB).
+  # Audits the synced project environment. PYSEC-2026-2447 (diskcache 5.6.3, a
+  # transitive dep via instructor -> atomic-agents) is ignored because no fixed
+  # release exists upstream; revisit when diskcache ships a fix.
+  pip-audit:
+    name: pip-audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
+        with:
+          python-version: "3.13"
+          enable-cache: true
+          cache-dependency-glob: "**/uv.lock"
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Audit dependencies
+        run: >-
+          uv run --with pip-audit==2.10.0 pip-audit
+          --progress-spinner off --ignore-vuln PYSEC-2026-2447

prek.toml

@@ -10,6 +10,15 @@ stages = ["pre-push"]
 pass_filenames = false
 always_run = true
 
+[[repos.hooks]]
+id = "ruff-format"
+name = "ruff-format"
+entry = "uv run ruff format --check hate_crack"
+language = "system"
+stages = ["pre-push"]
+pass_filenames = false
+always_run = true
+
 [[repos.hooks]]
 id = "ty"
 name = "ty"
@@ -37,6 +46,15 @@ stages = ["pre-push"]
 pass_filenames = false
 always_run = true
 
+[[repos.hooks]]
+id = "bandit"
+name = "bandit security scan (vs baseline)"
+entry = "uvx --from 'bandit[toml]==1.9.4' bandit -r hate_crack -c pyproject.toml -b .bandit-baseline.json -q"
+language = "system"
+stages = ["pre-push"]
+pass_filenames = false
+always_run = true
+
 [[repos.hooks]]
 id = "audit-docs"
 name = "audit-docs"
@@ -45,3 +63,26 @@ language = "system"
 stages = ["post-commit"]
 pass_filenames = false
 always_run = true
+
+# General hygiene hooks (mirrors hashview's .pre-commit-config.yaml). These run
+# at the pre-commit stage, so `prek install` must include `--hook-type pre-commit`
+# (see CLAUDE.md). Auto-fixers modify files in place; re-stage and commit again.
+[[repos]]
+repo = "https://github.com/pre-commit/pre-commit-hooks"
+rev = "v5.0.0"
+
+[[repos.hooks]]
+id = "trailing-whitespace"
+
+[[repos.hooks]]
+id = "end-of-file-fixer"
+
+[[repos.hooks]]
+id = "check-yaml"
+
+[[repos.hooks]]
+id = "check-merge-conflict"
+
+[[repos.hooks]]
+id = "check-added-large-files"
+args = ["--maxkb=1024"]

pyproject.toml

@@ -50,6 +50,23 @@ exclude = [
     "rules",
 ]
 
+[tool.bandit]
+# hate_crack shells out to hashcat and its helper binaries extensively, so the
+# scan produces many low-severity subprocess/shlex findings. These are reviewed
+# and captured in .bandit-baseline.json; CI compares against that baseline so
+# only NEW findings fail the build (mirrors the hashview approach). Scan the
+# first-party package only — bundled third-party trees are excluded.
+exclude_dirs = [
+    "tests",
+    ".venv",
+    "build",
+    "dist",
+    "PACK",
+    "hashcat-utils",
+    "omen",
+    "princeprocessor",
+]
+
 [tool.ty.src]
 exclude = [
     "build/",