Align pre-commit, lint and changelog tooling with Salt

.github/workflows/test.yaml

@@ -6,15 +6,18 @@ on:
   schedule:
     - cron: "0 8 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     name: pre-commit
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.10"
       - name: Install dependencies
@@ -28,36 +31,42 @@ jobs:
   test:
     name: test ${{ matrix.py }} - ${{ matrix.netapi }} - ${{ matrix.salt }}
     runs-on: ubuntu-22.04
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
         py:
-          - "3.8"
-          - "3.9"
           - "3.10"
           - "3.11"
+          - "3.12"
+          - "3.13"
         netapi:
           - "cherrypy"
           - "tornado"
         salt:
-          - "v3006.9"
-          - "v3007.1"
+          - "v3006.30"
+          - "v3007.17"
+          - "v3008.5"
           - "master"
         exclude:
-          - py: "3.8"
-            salt: "v3007.1"
-          - py: "3.9"
-            salt: "v3007.1"
-          - py: "3.8"
-            salt: "master"
-          - py: "3.9"
-            salt: "master"
+          # The test minion never completes authentication with Salt 3006 on
+          # Python 3.12+ or Salt 3007 on Python 3.13. Salt 3007 on Python 3.12
+          # usually passes, but the minion intermittently fails to start or
+          # stops answering.
+          - py: "3.12"
+            salt: "v3006.30"
+          - py: "3.13"
+            salt: "v3006.30"
+          - py: "3.12"
+            salt: "v3007.17"
+          - py: "3.13"
+            salt: "v3007.17"
     env:
       SALT_REQUIREMENT: ${{ matrix.salt == 'master' && 'salt@git+https://github.com/saltstack/salt.git@master' || format('salt=={0}', matrix.salt) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Set up Python ${{ matrix.py }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ matrix.py }}
 

.gitignore

@@ -8,3 +8,4 @@ dist/
 salt_pepper.egg-info/
 .nox/
 artifacts/
+tests/.pepperrc

.pre-commit-config.yaml

@@ -1,27 +1,47 @@
 ---
 minimum_pre_commit_version: 3.5.0
 repos:
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.5.0
     hooks:
       - id: check-merge-conflict  # Check for files that contain merge conflict strings.
       - id: trailing-whitespace   # Trims trailing whitespace.
-        args: [--markdown-linebreak-ext=md]
+        args:
+          - --markdown-linebreak-ext=md
       - id: mixed-line-ending     # Replaces or checks mixed line ending.
-        args: [--fix=lf]
+        args:
+          - --fix=lf
       - id: end-of-file-fixer     # Makes sure files end in a newline and only a newline.
-      - id: check-merge-conflict  # Check for files that contain merge conflict strings.
       - id: check-ast             # Simply check whether files parse as valid python.
+      - id: check-case-conflict   # Check for files with names that would conflict on a
+                                  # case-insensitive filesystem like MacOS HFS+ or Windows FAT.
+      - id: check-json            # Attempts to load all json files to verify syntax.
+      - id: check-symlinks        # Checks for symlinks which do not point to anything.
+      - id: debug-statements      # Check for debugger imports and breakpoint() calls in python source.
+      - id: fix-byte-order-marker # removes UTF-8 byte order marker
+      - id: forbid-submodules     # forbids any submodules in the repository.
+      - id: fix-encoding-pragma   # Remove `# -*- coding: utf-8 -*-` from the top of python files.
+        args:
+          - --remove
 
-  # ----- Formatting ---------------------------------------------------------------------------->
-  - repo: https://github.com/myint/autoflake
-    rev: v2.2.1
+  - repo: https://github.com/adrienverge/yamllint
+    rev: v1.38.0
     hooks:
-      - id: autoflake
-        name: Remove unused variables and imports
-        language: python
-        args: ["--in-place", "--remove-all-unused-imports", "--remove-unused-variables", "--expand-star-imports"]
-        files: \.py$
+      - id: yamllint
+        name: Check for duplicate keys in pre-commit config
+        files: ^\.pre-commit-config\.yaml$
+        args:
+          - -d
+          - "{rules: {key-duplicates: enable}}"
+
+  # ----- Code Formatting ------------------------------------------------------------------------------------------->
+  - repo: https://github.com/asottile/pyupgrade
+    rev: v3.21.2
+    hooks:
+      - id: pyupgrade
+        name: Upgrade code to Py3.10+
+        args: [--py310-plus, --keep-mock]
 
   - repo: https://github.com/saltstack/pre-commit-remove-import-headers
     rev: 1.1.0
@@ -33,32 +53,70 @@ repos:
     rev: 2.5.2
     hooks:
       - id: salt-rewrite
-        alias: rewrite-tests
-        name: Rewrite the test suite
-        files: ^tests/.*\.py$
-        args: [--silent, -E, fix_docstrings]
-
-  - repo: https://github.com/asottile/pyupgrade
-    rev: v3.15.0
-    hooks:
-      - id: pyupgrade
-        name: Rewrite Code to be Py3+
-        args: [
-          --py3-plus
-        ]
+        alias: rewrite-docstrings
+        name: Pepper docstrings auto-fixes
+        files: ^pepper/.*\.py$
+        args: [--silent, -F, fix_docstrings]
 
-  - repo: https://github.com/asottile/reorder_python_imports
-    rev: v3.12.0
+  - repo: https://github.com/timothycrosley/isort
+    rev: 5.13.2
     hooks:
-      - id: reorder-python-imports
-        args: [
-          --py3-plus,
-        ]
+      - id: isort
+        additional_dependencies: ['toml']
 
   - repo: https://github.com/psf/black
-    rev: 23.12.1
+    rev: 24.2.0
     hooks:
       - id: black
-        args: [-l 100]
 
-  # <---- Formatting -----------------------------------------------------------------------------
+  - repo: https://github.com/asottile/blacken-docs
+    rev: 1.16.0
+    hooks:
+      - id: blacken-docs
+        args: [--skip-errors]
+        files: ^README\.rst$
+        additional_dependencies:
+          - black==24.2.0
+  # <---- Code Formatting --------------------------------------------------------------------------------------------
+
+  # ----- Security -------------------------------------------------------------------------------------------------->
+  - repo: https://github.com/PyCQA/bandit
+    rev: "1.7.7"
+    hooks:
+      - id: bandit
+        alias: bandit-pepper
+        name: Run bandit against Pepper
+        args: [--silent, -lll, --skip, "B701,B324"]
+        exclude: ^tests/.*
+        additional_dependencies: ['importlib_metadata<5']
+  - repo: https://github.com/PyCQA/bandit
+    rev: "1.7.7"
+    hooks:
+      - id: bandit
+        alias: bandit-tests
+        name: Run bandit against the test suite
+        args: [--silent, -lll, --skip, "B701,B324"]
+        files: ^tests/.*
+        additional_dependencies: ['importlib_metadata<5']
+  # <---- Security ---------------------------------------------------------------------------------------------------
+
+  # ----- Lint ------------------------------------------------------------------------------------------------------>
+  - repo: local
+    hooks:
+      - id: lint-pepper
+        name: Lint Pepper
+        entry: pylint --rcfile=.pylintrc --disable=I
+        language: python
+        files: ^((setup|noxfile)\.py|pepper/.*\.py)$
+        additional_dependencies: &lint_deps
+          - pylint==3.1.1
+          - astroid==3.1.0
+          - saltpylint==2024.2.5
+
+      - id: lint-tests
+        name: Lint Tests
+        entry: pylint --rcfile=.pylintrc --disable=I
+        language: python
+        files: ^tests/.*\.py$
+        additional_dependencies: *lint_deps
+  # <---- Lint -------------------------------------------------------------------------------------------------------