Add more pre-commit check to the config

Author: antonwolfy

.github/workflows/pre-commit.yml

@@ -14,11 +14,14 @@ jobs:
     steps:
     - name: Checkout repo
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        # use commit hash to make "no-commit-to-branch" check passing
+        ref: ${{ github.sha }}
 
     - name: Set up python
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
-        python-version: '3.13'
+        python-version: '3.14'
 
     - name: Set up pip packages
       uses: BSFishy/pip-action@8f2d471d809dc20b6ada98c91910b6ae6243f318 # v1

.pre-commit-config.yaml

@@ -2,6 +2,14 @@ repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
   rev: v6.0.0
   hooks:
+  # Git
+    - id: check-added-large-files
+    - id: no-commit-to-branch
+      name: "ensure no direct commit to master/maintenance branches"
+      args: [--branch, "master", --pattern, "maintenance/.*"]
+    - id: check-case-conflict
+    - id: check-illegal-windows-names
+  # Contents
     - id: check-ast
     - id: check-builtin-literals
     - id: check-case-conflict
@@ -15,19 +23,19 @@ repos:
     - id: mixed-line-ending
     - id: trailing-whitespace
 
--   repo: https://github.com/pre-commit/pygrep-hooks
-    rev: v1.10.0
-    hooks:
-    -   id: python-check-blanket-noqa
-    -   id: python-check-blanket-type-ignore
-    -   id: python-check-mock-methods
-    -   id: python-no-eval
-    -   id: python-no-log-warn
-    -   id: python-use-type-annotations
-    -   id: rst-backticks
-    -   id: rst-directive-colons
-    -   id: rst-inline-touching-normal
-    -   id: text-unicode-replacement-char
+- repo: https://github.com/pre-commit/pygrep-hooks
+  rev: v1.10.0
+  hooks:
+    - id: python-check-blanket-noqa
+    - id: python-check-blanket-type-ignore
+    - id: python-check-mock-methods
+    - id: python-no-eval
+    - id: python-no-log-warn
+    - id: python-use-type-annotations
+    - id: rst-backticks
+    - id: rst-directive-colons
+    - id: rst-inline-touching-normal
+    - id: text-unicode-replacement-char
 
 - repo: https://github.com/codespell-project/codespell
   rev: v2.4.1
@@ -62,7 +70,7 @@ repos:
     args: ["--config=.flake8"]
     additional_dependencies:
       - flake8-docstrings==1.7.0
-      - flake8-bugbear==24.4.26
+      - flake8-bugbear==25.11.29
 
 - repo: https://github.com/pycqa/isort
   rev: 8.0.0
@@ -102,3 +110,14 @@ repos:
   rev: 3.0.0
   hooks:
   - id: shellcheck
+
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.30.0
+  hooks:
+  - id: gitleaks
+
+- repo: https://github.com/rhysd/actionlint
+  rev: v1.7.11
+  hooks:
+  - id: actionlint
+    args: ["-ignore", "SC2317"]