move ruff and bandit checks to pre-commit

[zacharyburnett]

uses pre-commit for linting, formatting, and security checking. By default, pre-commit is run only on changes lines. Putting these checks in .pre-commit-config.yaml ensures that we can pin the ruff version to make sure that new rules don't break style checks randomly

Checklist for PR authors (skip items if you don't have permissions or they are not applicable)

• added entry in CHANGES.rst within the relevant release section
• updated or added relevant tests
• updated relevant documentation
• added relevant milestone
• added relevant label(s)
• ran regression tests, post a link to the Jenkins job below.
  How to run regression tests on a PR
• All comments are resolved
• Make sure the JIRA ticket is resolved properly

[braingram]

I always get this mixed up but does adding this file also mean the pre-commit bot will auto-fix PRs?

[braingram]

I'm also failing to find where pre-commit runs in the CI.

Perhaps we need a new workflow to run pre-commit (perhaps like the one in asdf).

We could also enable the bot (but I don't trust it as you already know).

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 59.60%. Comparing base (2d15511) to head (d0dbbe7).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #8646   +/-   ##
=======================================
  Coverage   59.60%   59.60%           
=======================================
  Files         391      391           
  Lines       39286    39286           
=======================================
  Hits        23418    23418           
  Misses      15868    15868           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[braingram]

:-O I think we should dial back those pre-commit hooks or exclude more files. The log for the pre-commit job is over 50k lines long...

[zacharyburnett]

:-O I think we should dial back those pre-commit hooks or exclude more files. The log for the pre-commit job is over 50k lines long...

yeah it looks like it was ruff format, trim-trailing-whitespace, and end-of-file-fixer. I thought they would only run on changed files, though...

[braingram]

Thanks!

Once this is merged the branch protection rules can be updated to check for pre-commit instead of check-style.