From 5f8096615edf9a645e8dfef7eb86307b2dfbd7b1 Mon Sep 17 00:00:00 2001
From: CarterPerez-dev <cartertechsolution@gmail.com>
Date: Fri, 31 Jul 2026 19:13:44 -0400
Subject: [PATCH] ci: two linters wearing the same name are not one gate

The local hook pinned ruff to v0.15.1. CI ran a bare `pip install ruff`
and got whatever astral had shipped that morning. Those are not the same
checker, so `just lint` passing locally said nothing about CI, and the
gap widened on astral's release schedule rather than on ours.

That is exactly how dlp-scanner went red: 0.16.0 stabilized PLR0917 out
of preview, CI adopted it unasked, and four signatures failed a rule the
local hook had never once run.

Pin CI to the rev in .pre-commit-config.yaml instead of hardcoding a
second version here. The hook rev is now the only place a ruff version
is written, so bumping it moves both sides in the same commit and the
two can no longer disagree. If that rev ever goes missing or stops
looking like a version, the step exits non-zero rather than falling
back to unpinned - both failure modes were tested.

Bump the pin 0.15.1 -> 0.16.1, which is the version CI was already
silently using. Censused first: all 18 ruff projects pass under 0.16.1,
and the freshly built hook env reports 0.16.1 at the binary and still
catches the original four errors in an unfixed tree.
---
 .github/workflows/lint.yml | 20 +++++++++++++++++++-
 .pre-commit-config.yaml    |  5 ++++-
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 8c1b1c30..3820c9b7 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -187,9 +187,27 @@ jobs:
       with:
         python-version: '3.12'
 
+    # Ruff is pinned to the rev in .pre-commit-config.yaml rather than
+    # hardcoded here, so bumping the hook bumps CI in the same commit.
+    # An unpinned `pip install ruff` silently adopts newly-stabilized
+    # rules and fails code the local hook just passed.
+    - name: Resolve pinned ruff version
+      if: matrix.type == 'ruff'
+      id: ruff_version
+      run: |
+        version=$(grep -A1 'astral-sh/ruff-pre-commit' \
+          "$GITHUB_WORKSPACE/.pre-commit-config.yaml" \
+          | grep -oP 'rev:\s*v\K[0-9]+\.[0-9]+\.[0-9]+')
+        if [[ -z "$version" ]]; then
+          echo "Could not resolve ruff rev from .pre-commit-config.yaml"
+          exit 1
+        fi
+        echo "Pinned ruff version: $version"
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
     - name: Install ruff
       if: matrix.type == 'ruff'
-      run: pip install ruff
+      run: pip install "ruff==${{ steps.ruff_version.outputs.version }}"
 
     # Biome / Frontend Setup
     - name: Setup Node.js
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index f1716f02..357909bc 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,7 +1,10 @@
 repos:
   # Python Ruff Checks
+  # This rev is the single source of truth for the ruff version.
+  # .github/workflows/lint.yml reads it from this file so CI and the
+  # local hook can never lint with two different rule sets.
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.1
+    rev: v0.16.1
     hooks:
       # Beginner projects
       - id: ruff