5f8096615e
The local hook pinned ruff to v0.15.1. CI ran a bare `pip install ruff` and got whatever astral had shipped that morning. Those are not the same checker, so `just lint` passing locally said nothing about CI, and the gap widened on astral's release schedule rather than on ours. That is exactly how dlp-scanner went red: 0.16.0 stabilized PLR0917 out of preview, CI adopted it unasked, and four signatures failed a rule the local hook had never once run. Pin CI to the rev in .pre-commit-config.yaml instead of hardcoding a second version here. The hook rev is now the only place a ruff version is written, so bumping it moves both sides in the same commit and the two can no longer disagree. If that rev ever goes missing or stops looking like a version, the step exits non-zero rather than falling back to unpinned - both failure modes were tested. Bump the pin 0.15.1 -> 0.16.1, which is the version CI was already silently using. Censused first: all 18 ruff projects pass under 0.16.1, and the freshly built hook env reports 0.16.1 at the binary and still catches the original four errors in an unfixed tree. |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| learn-folder-template | ||
| workflows | ||
| CHANGELOG.rst | ||
| CODE_OF_CONDUCT.md | ||
| CONTRIBUTING.md | ||
| FUNDING.yml | ||
| PULL_REQUEST_TEMPLATE.md | ||
| SECURITY.md | ||
| dependabot.yml | ||
| secret_scanning.yml | ||