Justin BollingerandClaude 4418c4e4d6 ci: mirror hashview lint/security gates ...

Adds the gates the hashview repo runs, adapted to hate_crack's uv toolchain:

- ruff format --check as a CI step + a ruff-format prek pre-push hook
  (the package was reformatted in the preceding commit).
- Bandit SAST vs a committed baseline (.bandit-baseline.json, 114 reviewed
  low-severity subprocess/shlex findings); [tool.bandit] config in
  pyproject.toml; CI job + prek pre-push hook. Only NEW findings fail.
- pip-audit dependency-CVE gate (CI job). PYSEC-2026-2447 (diskcache 5.6.3,
  transitive via instructor -> atomic-agents) is ignored — no upstream fix.
- Hygiene pre-commit hooks (trailing-whitespace, end-of-file-fixer, check-yaml,
  check-merge-conflict, check-added-large-files) via the pre-commit-hooks repo.
- CLAUDE.md updated: lint/security commands, prek install (+pre-commit hook
  type), and the active-hooks list.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-07-25 13:21:22 -04:00

..

workflows

ci: mirror hashview lint/security gates

2026-07-25 13:21:22 -04:00

dependabot.yml

fix(ci): add test CI, repair auto-tag releases, harden action pins (2.11.4)

2026-07-24 16:39:59 -04:00