ci: block on mypy and bandit and run hooks from the lock

Pre-commit runs ruff, isort and bandit through uv run, so it uses the versions in uv.lock. Bandit moves from runtime dependencies to the dev group.

.pre-commit-config.yaml

@@ -8,25 +8,6 @@ repos:
     hooks:
       - id: conventional-pre-commit
         stages: [commit-msg]
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.12
-    hooks:
-      - id: ruff-check
-        args: [--fix]
-      - id: ruff-format
-  - repo: https://github.com/pycqa/isort
-    rev: 9.0.0a3
-    hooks:
-      - id: isort
-  - repo: https://github.com/PyCQA/bandit
-    rev: 1.9.4
-    hooks:
-      - id: bandit
-        args:
-          - -c=pyproject.toml
-          - --severity-level=medium
-          - --confidence-level=medium
-        additional_dependencies: ['bandit[toml]']
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
@@ -35,6 +16,30 @@ repos:
         args: [--markdown-linebreak-ext=md]
   - repo: local
     hooks:
+      - id: ruff-check
+        name: ruff check
+        entry: uv run ruff check --fix
+        language: system
+        types: [python]
+        require_serial: true
+      - id: ruff-format
+        name: ruff format
+        entry: uv run ruff format
+        language: system
+        types: [python]
+        require_serial: true
+      - id: isort
+        name: isort
+        entry: uv run isort
+        language: system
+        types: [python]
+        require_serial: true
+      - id: bandit
+        name: bandit
+        entry: uv run bandit -q -c pyproject.toml --severity-level medium --confidence-level medium
+        language: system
+        types: [python]
+        files: ^unshackle/
       - id: mypy
         name: mypy
         entry: uv run mypy unshackle