chore: align CI and tooling with global development standards

- Remove 6 duplicate per-version pytest workflows (matrix build covers all)
- Pin GitHub Actions to SHA hashes with version comments
- Add persist-credentials: false to checkout steps
- Replace mypy with ty for type checking (faster, stricter)
- Pin dev deps to exact versions (ty==0.0.17, ruff==0.15.1, pytest==9.0.2, pytest-cov==7.0.0)
- Remove types-* stub packages (ty doesn't need them)
- Remove stale [dependency-groups] section from pyproject.toml
- Update shell scripts to use set -euo pipefail
- Add prek.toml for git hook management (pre-push, post-commit)
- Add lint-infra.yml workflow (shellcheck + actionlint)
- Fix actionlint warning: pass github.head_ref through env var
- Track CLAUDE.md and .claude/ scripts in git
- Update README.md and Makefile references from mypy to ty

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/lint-infra.yml

@@ -0,0 +1,40 @@
+name: lint-infra
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          persist-credentials: false
+
+      - name: Run shellcheck
+        run: |
+          find . -name "*.sh" \
+            -not -path "./hashcat-utils/*" \
+            -not -path "./princeprocessor/*" \
+            -not -path "./omen/*" \
+            -not -path "./PACK/*" \
+            -not -path "./build/*" \
+            -not -path "./dist/*" \
+            -not -path "./.venv/*" \
+            -print0 | xargs -0 shellcheck
+
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          persist-credentials: false
+
+      - name: Install actionlint
+        run: |
+          curl -sL https://github.com/rhysd/actionlint/releases/latest/download/actionlint_1.7.7_linux_amd64.tar.gz | tar xz
+          sudo mv actionlint /usr/local/bin/
+
+      - name: Run actionlint
+        run: actionlint

.github/workflows/pytest-py310.yml

@@ -1,34 +0,0 @@
-name: pytest-py310
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  pytest:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.10"
-
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y p7zip-full transmission-cli
-
-      - name: Install uv
-        run: python -m pip install --upgrade pip uv==0.9.28
-
-      - name: Install project dependencies
-        run: |
-          uv venv .venv
-          uv pip install --python .venv/bin/python ".[dev]"
-
-      - name: Run tests
-        env:
-          HATE_CRACK_RUN_E2E: "0"
-          HATE_CRACK_RUN_DOCKER_TESTS: "0"
-          HATE_CRACK_RUN_LIVE_TESTS: "0"
-          HATE_CRACK_SKIP_INIT: "1"
-        run: .venv/bin/python -m pytest

.github/workflows/pytest-py311.yml

@@ -1,34 +0,0 @@
-name: pytest-py311
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  pytest:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y p7zip-full transmission-cli
-
-      - name: Install uv
-        run: python -m pip install --upgrade pip uv==0.9.28
-
-      - name: Install project dependencies
-        run: |
-          uv venv .venv
-          uv pip install --python .venv/bin/python ".[dev]"
-
-      - name: Run tests
-        env:
-          HATE_CRACK_RUN_E2E: "0"
-          HATE_CRACK_RUN_DOCKER_TESTS: "0"
-          HATE_CRACK_RUN_LIVE_TESTS: "0"
-          HATE_CRACK_SKIP_INIT: "1"
-        run: .venv/bin/python -m pytest

.github/workflows/pytest-py312.yml

@@ -1,34 +0,0 @@
-name: pytest-py312
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  pytest:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y p7zip-full transmission-cli
-
-      - name: Install uv
-        run: python -m pip install --upgrade pip uv==0.9.28
-
-      - name: Install project dependencies
-        run: |
-          uv venv .venv
-          uv pip install --python .venv/bin/python ".[dev]"
-
-      - name: Run tests
-        env:
-          HATE_CRACK_RUN_E2E: "0"
-          HATE_CRACK_RUN_DOCKER_TESTS: "0"
-          HATE_CRACK_RUN_LIVE_TESTS: "0"
-          HATE_CRACK_SKIP_INIT: "1"
-        run: .venv/bin/python -m pytest

.github/workflows/pytest-py313.yml

@@ -1,34 +0,0 @@
-name: pytest-py313
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  pytest:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.13"
-
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y p7zip-full transmission-cli
-
-      - name: Install uv
-        run: python -m pip install --upgrade pip uv==0.9.28
-
-      - name: Install project dependencies
-        run: |
-          uv venv .venv
-          uv pip install --python .venv/bin/python ".[dev]"
-
-      - name: Run tests
-        env:
-          HATE_CRACK_RUN_E2E: "0"
-          HATE_CRACK_RUN_DOCKER_TESTS: "0"
-          HATE_CRACK_RUN_LIVE_TESTS: "0"
-          HATE_CRACK_SKIP_INIT: "1"
-        run: .venv/bin/python -m pytest

.github/workflows/pytest-py314.yml

@@ -1,34 +0,0 @@
-name: pytest-py314
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  pytest:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.14"
-
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y p7zip-full transmission-cli
-
-      - name: Install uv
-        run: python -m pip install --upgrade pip uv==0.9.28
-
-      - name: Install project dependencies
-        run: |
-          uv venv .venv
-          uv pip install --python .venv/bin/python ".[dev]"
-
-      - name: Run tests
-        env:
-          HATE_CRACK_RUN_E2E: "0"
-          HATE_CRACK_RUN_DOCKER_TESTS: "0"
-          HATE_CRACK_RUN_LIVE_TESTS: "0"
-          HATE_CRACK_SKIP_INIT: "1"
-        run: .venv/bin/python -m pytest

.github/workflows/pytest-py39.yml

@@ -1,34 +0,0 @@
-name: pytest-py39
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  pytest:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.9"
-
-      - name: Install system dependencies
-        run: sudo apt-get update && sudo apt-get install -y p7zip-full transmission-cli
-
-      - name: Install uv
-        run: python -m pip install --upgrade pip uv==0.9.28
-
-      - name: Install project dependencies
-        run: |
-          uv venv .venv
-          uv pip install --python .venv/bin/python ".[dev]"
-
-      - name: Run tests
-        env:
-          HATE_CRACK_RUN_E2E: "0"
-          HATE_CRACK_RUN_DOCKER_TESTS: "0"
-          HATE_CRACK_RUN_LIVE_TESTS: "0"
-          HATE_CRACK_SKIP_INIT: "1"
-        run: .venv/bin/python -m pytest

.github/workflows/pytest.yml

@@ -11,9 +11,11 @@ jobs:
       matrix:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: ${{ matrix.python-version }}
 

.github/workflows/ruff.yml

@@ -8,9 +8,11 @@ jobs:
   ruff:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: "3.13"
 

.github/workflows/ty.yml

@@ -1,16 +1,18 @@
-name: mypy
+name: ty
 
 on:
   push:
   pull_request:
 
 jobs:
-  mypy:
+  ty:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
         with:
           python-version: "3.13"
 
@@ -22,5 +24,5 @@ jobs:
           uv venv .venv
           uv pip install --python .venv/bin/python ".[dev]"
 
-      - name: Run mypy
-        run: .venv/bin/mypy --exclude HashcatRosetta --exclude hashcat-utils --ignore-missing-imports hate_crack
+      - name: Run ty
+        run: .venv/bin/ty check hate_crack

.github/workflows/version-bump.yml

@@ -13,15 +13,17 @@ jobs:
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Determine version bump type
         id: bump-type
+        env:
+          BRANCH: ${{ github.head_ref }}
+          TITLE: ${{ github.event.pull_request.title }}
         run: |
-          BRANCH="${{ github.head_ref }}"
-          TITLE="${{ github.event.pull_request.title }}"
           # Feature branches (feat/) bump minor, everything else bumps patch
           if echo "$BRANCH" | grep -qiE '^feat/'; then
             echo "type=minor" >> "$GITHUB_OUTPUT"