ci: block on mypy and bandit and run hooks from the lock

Pre-commit runs ruff, isort and bandit through uv run, so it uses the versions in uv.lock. Bandit moves from runtime dependencies to the dev group.

.github/workflows/ci.yml

@@ -36,10 +36,15 @@ jobs:
       - name: Import order
         run: uv run isort --check-only unshackle tests --skip-glob "*/services/*"
       - name: Type check
+        if: ${{ !cancelled() }}
         run: |
-          out=$(uv run mypy unshackle) || true
+          out=$(uv run mypy unshackle) || rc=$?
           echo "$out"
-          echo "$out" | sed -nE 's/^([^:]+):([0-9]+): error: (.*)$/::warning file=\1,line=\2::\3/p'
+          echo "$out" | sed -nE 's/^([^:]+):([0-9]+): error: (.*)$/::error file=\1,line=\2::\3/p'
+          exit ${rc:-0}
+      - name: Security lint
+        if: ${{ !cancelled() }}
+        run: uv run bandit -q -c pyproject.toml -r unshackle --severity-level medium --confidence-level medium
 
   test:
     strategy:

.pre-commit-config.yaml

@@ -8,25 +8,6 @@ repos:
     hooks:
       - id: conventional-pre-commit
         stages: [commit-msg]
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.12
-    hooks:
-      - id: ruff-check
-        args: [--fix]
-      - id: ruff-format
-  - repo: https://github.com/pycqa/isort
-    rev: 9.0.0a3
-    hooks:
-      - id: isort
-  - repo: https://github.com/PyCQA/bandit
-    rev: 1.9.4
-    hooks:
-      - id: bandit
-        args:
-          - -c=pyproject.toml
-          - --severity-level=medium
-          - --confidence-level=medium
-        additional_dependencies: ['bandit[toml]']
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
@@ -35,6 +16,30 @@ repos:
         args: [--markdown-linebreak-ext=md]
   - repo: local
     hooks:
+      - id: ruff-check
+        name: ruff check
+        entry: uv run ruff check --fix
+        language: system
+        types: [python]
+        require_serial: true
+      - id: ruff-format
+        name: ruff format
+        entry: uv run ruff format
+        language: system
+        types: [python]
+        require_serial: true
+      - id: isort
+        name: isort
+        entry: uv run isort
+        language: system
+        types: [python]
+        require_serial: true
+      - id: bandit
+        name: bandit
+        entry: uv run bandit -q -c pyproject.toml --severity-level medium --confidence-level medium
+        language: system
+        types: [python]
+        files: ^unshackle/
       - id: mypy
         name: mypy
         entry: uv run mypy unshackle

pyproject.toml

@@ -65,7 +65,6 @@ dependencies = [
     "language-data>=1.4.0",
     "wasmtime>=41.0.0",
     "rnet>=2.4.2",
-    "bandit>=1.9.4",
     "jsonpath-ng>=1.8.0",
     "mutagen>=1.47.0,<2",
     "defusedxml>=0.7.1",
@@ -95,6 +94,7 @@ dev = [
     "isort>=5.13.2,<8",
     "ruff>=0.15.12,<0.16",
     "types-pyyaml>=6.0,<7",
+    "bandit>=1.9.4,<2",
 ]
 test = [
     "pytest>=8.3.0,<9",

uv.lock

@@ -2176,7 +2176,6 @@ dependencies = [
     { name = "aiohttp" },
     { name = "aiohttp-swagger3" },
     { name = "appdirs" },
-    { name = "bandit" },
     { name = "brotli" },
     { name = "chardet" },
     { name = "click" },
@@ -2222,6 +2221,7 @@ dependencies = [
 
 [package.dev-dependencies]
 dev = [
+    { name = "bandit" },
     { name = "isort" },
     { name = "mypy" },
     { name = "mypy-protobuf" },
@@ -2247,7 +2247,6 @@ requires-dist = [
     { name = "aiohttp", specifier = ">=3.14.0,<4" },
     { name = "aiohttp-swagger3", specifier = ">=0.9.0,<1" },
     { name = "appdirs", specifier = ">=1.4.4,<2" },
-    { name = "bandit", specifier = ">=1.9.4" },
     { name = "brotli", specifier = ">=1.1.0,<2" },
     { name = "chardet", specifier = ">=5.2.0,<6" },
     { name = "click", specifier = ">=8.2,<9" },
@@ -2293,6 +2292,7 @@ requires-dist = [
 
 [package.metadata.requires-dev]
 dev = [
+    { name = "bandit", specifier = ">=1.9.4,<2" },
     { name = "isort", specifier = ">=5.13.2,<8" },
     { name = "mypy", specifier = ">=1.9.0,<2" },
     { name = "mypy-protobuf", specifier = ">=3.6.0,<4" },