@@ -58,13 +58,14 @@ Lib/venv/scripts/posix/* text eol=lf
 #
 [attr]generated linguist-generated=true diff=generated
 
-Lib/_opcode_metadata.py                             generated
-Lib/keyword.py                                      generated
-Lib/idlelib/help.html                               generated
-Lib/test/certdata/*.pem                             generated
-Lib/test/certdata/*.0                               generated
-Lib/test/levenshtein_examples.json                  generated
-Lib/test/test_stable_abi_ctypes.py                  generated
-Lib/token.py                                        generated
+Lib/_opcode_metadata.py                                 generated
+Lib/keyword.py                                          generated
+Lib/idlelib/help.html                                   generated
+Lib/test/certdata/*.pem                                 generated
+Lib/test/certdata/*.0                                   generated
+Lib/test/levenshtein_examples.json                      generated
+Lib/test/test_stable_abi_ctypes.py                      generated
+Lib/token.py                                            generated
+crates/compiler-core/src/bytecode/opcode_metadata.rs    generated
 
-.github/workflows/*.lock.yml linguist-generated=true merge=ours
+.github/workflows/*.lock.yml linguist-generated=true merge=ours
@@ -519,6 +519,8 @@ jobs:
       security-events: write # for zizmor
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 
@@ -544,12 +546,35 @@ jobs:
           package-manager-cache: false
           node-version: "24"
 
-      - name: prek
+      - name: install prek
         id: prek
         uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2.0.4
         with:
           cache: false
           show-verbose-logs: false
+          install-only: true
+
+      - name: prek run
+        run: prek run --show-diff-on-failure --color=always --all-files
+
+      - name: Get target CPython version
+        id: cpython-version
+        run: |
+          version=$(cat .python-version)
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+
+      - name: Clone CPython
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: python/cpython
+          path: cpython
+          ref: "v${{ steps.cpython-version.outputs.version }}"
+          persist-credentials: false
+
+      - name: prek run (manual stage)
+        run: prek run --show-diff-on-failure --color=always --all-files --hook-stage manual
+        env:
+          CPYTHON_ROOT: ${{ github.workspace }}/cpython
 
       - name: save prek cache
         if: ${{ github.ref == 'refs/heads/main' }} # only save on main
 
@@ -40,14 +40,27 @@ repos:
         types: [rust]
         priority: 0
 
-      - id: generate-opcode-metadata
-        name: generate opcode metadata
-        entry: python scripts/generate_opcode_metadata.py
-        files: '^(crates/compiler-core/src/bytecode/instruction\.rs|scripts/generate_opcode_metadata\.py)$'
+      - id: generate-rs-opcode-metadata
+        name: generate rust opcode metadata
+        entry: python tools/opcode_metadata/generate_rs_opcode_metadata.py
+        files: '^(crates/compiler-core/src/bytecode/instruction\.rs|tools/opcode_metadata/*)$'
         pass_filenames: false
         language: system
         require_serial: true
         priority: 1 # so rustfmt runs first
+        stages:
+          - manual
+
+      - id: generate-py-opcode-metadata
+        name: generate python opcode metadata
+        entry: python tools/opcode_metadata/generate_py_opcode_metadata.py
+        files: '^(crates/compiler-core/src/bytecode/instruction\.rs|tools/opcode_metadata/*)$'
+        pass_filenames: false
+        language: system
+        require_serial: true
+        priority: 1 # so rustfmt runs first
+        stages:
+          - manual
 
   - repo: https://github.com/streetsidesoftware/cspell-cli
     rev: v10.0.0