Infra: Add zizmor, actionlint and check-jsonschema to pre-commit/CI (#5030)

hugovk · web-flow · commit 339af2b4776a · 2026-07-11T13:37:17.000+03:00
diff --git a/.github/workflows/render.yml b/.github/workflows/render.yml
@@ -43,7 +43,7 @@ jobs:
           python -m pip install --upgrade pip
 
       - name: Render PEPs
-        run: make dirhtml search JOBS=$(nproc)
+        run: make dirhtml search JOBS="$(nproc)"
 
         # remove the .doctrees folder when building for deployment as it takes two thirds of disk space
       - name: Clean up files
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -48,7 +48,7 @@ repos:
         name: "Check YAML"
 
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 25.12.0
+    rev: 26.5.1
     hooks:
       - id: black
         name: "Format with Black"
@@ -58,7 +58,7 @@ repos:
         files: '^(peps/conf\.py|pep_sphinx_extensions/tests/.*)$'
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.10
+    rev: v0.15.21
     hooks:
       - id: ruff-check
         name: "Lint with Ruff"
@@ -71,8 +71,24 @@ repos:
           - '--check'
         files: '^release_management/'
 
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 0.37.4
+    hooks:
+      - id: check-dependabot
+      - id: check-github-workflows
+
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.12
+    hooks:
+      - id: actionlint
+
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.26.1
+    hooks:
+      - id: zizmor
+
   - repo: https://github.com/tox-dev/tox-ini-fmt
-    rev: 1.7.1
+    rev: 1.7.2
     hooks:
       - id: tox-ini-fmt
         name: "Format tox.ini"
@@ -99,7 +115,7 @@ repos:
 
   # Manual codespell check
   - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.1
+    rev: v2.4.2
     hooks:
       - id: codespell
         name: "Check for common misspellings in text files"
@@ -125,3 +141,8 @@ repos:
         files: "^release_management/"
         pass_filenames: false
         require_serial: true
+
+  - repo: meta
+    hooks:
+      - id: check-hooks-apply
+      - id: check-useless-excludes
