add additional pre-commit hooks

ndgrigorian · ndgrigorian · commit c52e36d98bbe · 2026-03-04T11:07:56.000-08:00
diff --git a/.github/workflows/build-with-clang.yml b/.github/workflows/build-with-clang.yml
@@ -13,7 +13,7 @@ jobs:
     strategy:
       matrix:
         python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
-        numpy_version: ["numpy'>=2'"]
+        numpy_version: ["numpy>=2"]
     env:
       ONEAPI_ROOT: /opt/intel/oneapi
 
@@ -55,22 +55,22 @@ jobs:
       - name: Install mkl_random dependencies
         run: |
           pip install cython setuptools">=77"
-          pip install ${{ matrix.numpy_version }}
+          pip install "${{ matrix.numpy_version }}"
 
       - name: List oneAPI folder content
-        run: ls ${{ env.ONEAPI_ROOT }}/compiler
+        run: ls "${{ env.ONEAPI_ROOT }}/compiler"
 
       - name: Build mkl_random
         run: |
-          source ${{ env.ONEAPI_ROOT }}/setvars.sh
-          echo $CMPLR_ROOT
-          export CC=$CMPLR_ROOT/bin/icx
-          export CXX=$CMPLR_ROOT/bin/icpx
+          source "${{ env.ONEAPI_ROOT }}/setvars.sh"
+          echo "$CMPLR_ROOT"
+          export CC="$CMPLR_ROOT/bin/icx"
+          export CXX="$CMPLR_ROOT/bin/icpx"
           export CFLAGS="${CFLAGS} -fno-fast-math -O2"
           pip install -e . --no-build-isolation --no-deps --verbose
 
       - name: Run mkl_random tests
         run: |
-          source ${{ env.ONEAPI_ROOT }}/setvars.sh
+          source "${{ env.ONEAPI_ROOT }}/setvars.sh"
           pip install pytest
           pytest -s -v --pyargs mkl_random
diff --git a/.github/workflows/conda-package-cf.yml b/.github/workflows/conda-package-cf.yml
@@ -53,21 +53,21 @@ jobs:
             ${{ runner.os }}-conda-${{ env.CACHE_NUMBER }}-
 
       - name: Add conda to system path
-        run: echo $CONDA/bin >> $GITHUB_PATH
+        run: echo "$CONDA/bin" >> "$GITHUB_PATH"
 
       - name: Install conda-build
         run: conda install conda-build
 
       - name: Build conda package
         run: |
-          CHANNELS="-c conda-forge --override-channels"
-          VERSIONS="--python ${{ matrix.python }} --numpy ${{ matrix.numpy }}"
-          TEST="--no-test"
+          CHANNELS=(-c conda-forge --override-channels)
+          VERSIONS=(--python "${{ matrix.python }}" --numpy "${{ matrix.numpy }}")
+          TEST=(--no-test)
 
           conda build \
-            $TEST \
-            $VERSIONS \
-            $CHANNELS \
+            "${TEST[@]}" \
+            "${VERSIONS[@]}" \
+            "${CHANNELS[@]}" \
             conda-recipe-cf
 
       - name: Upload artifact
@@ -162,27 +162,27 @@ jobs:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python }}
 
       - name: Add conda to system path
-        run: echo $CONDA/bin >> $GITHUB_PATH
+        run: echo "$CONDA/bin" >> "$GITHUB_PATH"
 
       - name: Install conda-build
         run: conda install conda-build
 
       - name: Create conda channel
         run: |
-          mkdir -p $GITHUB_WORKSPACE/channel/linux-64
-          conda index $GITHUB_WORKSPACE/channel || exit 1
-          mv ${PACKAGE_NAME}-*.conda $GITHUB_WORKSPACE/channel/linux-64 || exit 1
-          conda index $GITHUB_WORKSPACE/channel || exit 1
+          mkdir -p "$GITHUB_WORKSPACE/channel/linux-64"
+          conda index "$GITHUB_WORKSPACE/channel" || exit 1
+          mv "${PACKAGE_NAME}"-*.conda "$GITHUB_WORKSPACE/channel/linux-64" || exit 1
+          conda index "$GITHUB_WORKSPACE/channel" || exit 1
           # Test channel
-          conda search $PACKAGE_NAME -c $GITHUB_WORKSPACE/channel --override-channels --info --json > $GITHUB_WORKSPACE/ver.json
+          conda search "$PACKAGE_NAME" -c "$GITHUB_WORKSPACE/channel" --override-channels --info --json > "$GITHUB_WORKSPACE/ver.json"
           cat ver.json
 
       - name: Collect dependencies
         run: |
-          . $CONDA/etc/profile.d/conda.sh
-          CHANNELS="-c $GITHUB_WORKSPACE/channel ${{ env.CHANNELS }}"
-          export PACKAGE_VERSION=$(python -c "${VER_SCRIPT1} ${VER_SCRIPT2}")
-          conda create -n ${{ env.TEST_ENV_NAME }} $PACKAGE_NAME=${PACKAGE_VERSION} python=${{ matrix.python }} numpy=${{ matrix.numpy }} $CHANNELS --only-deps --dry-run > lockfile
+          . "$CONDA/etc/profile.d/conda.sh"
+          PACKAGE_VERSION="$(python -c "${VER_SCRIPT1} ${VER_SCRIPT2}")"
+          export PACKAGE_VERSION
+          conda create -n "${{ env.TEST_ENV_NAME }}" "${PACKAGE_NAME}=${PACKAGE_VERSION}" "python=${{ matrix.python }}" "numpy=${{ matrix.numpy }}" -c "$GITHUB_WORKSPACE/channel" -c conda-forge --override-channels --only-deps --dry-run > lockfile
           cat lockfile
 
       - name: Set pkgs_dirs
@@ -203,17 +203,17 @@ jobs:
 
       - name: Install mkl_random
         run: |
-          . $CONDA/etc/profile.d/conda.sh
-          CHANNELS="-c $GITHUB_WORKSPACE/channel ${{ env.CHANNELS }}"
-          export PACKAGE_VERSION=$(python -c "${VER_SCRIPT1} ${VER_SCRIPT2}")
-          conda create -n ${{ env.TEST_ENV_NAME }} $PACKAGE_NAME=${PACKAGE_VERSION} pytest python=${{ matrix.python }} numpy=${{ matrix.numpy }} $CHANNELS
+          . "$CONDA/etc/profile.d/conda.sh"
+          PACKAGE_VERSION="$(python -c "${VER_SCRIPT1} ${VER_SCRIPT2}")"
+          export PACKAGE_VERSION
+          conda create -n "${{ env.TEST_ENV_NAME }}" "${PACKAGE_NAME}=${PACKAGE_VERSION}" pytest "python=${{ matrix.python }}" "numpy=${{ matrix.numpy }}" -c "$GITHUB_WORKSPACE/channel" -c conda-forge --override-channels
           # Test installed packages
           conda list
 
       - name: Run tests
         run: |
-          . $CONDA/etc/profile.d/conda.sh
-          conda activate ${{ env.TEST_ENV_NAME }}
+          . "$CONDA/etc/profile.d/conda.sh"
+          conda activate "${{ env.TEST_ENV_NAME }}"
           pytest -vv --pyargs ${{ env.MODULE_NAME }}
 
   test_windows:
diff --git a/.github/workflows/conda-package.yml b/.github/workflows/conda-package.yml
@@ -49,26 +49,26 @@ jobs:
             ${{ runner.os }}-conda-${{ env.CACHE_NUMBER }}-
 
       - name: Add conda to system path
-        run: echo $CONDA/bin >> $GITHUB_PATH
+        run: echo "$CONDA/bin" >> "$GITHUB_PATH"
 
       - name: Install conda-build
         run: conda install conda-build
 
       - name: Store conda paths as envs
         shell: bash -el {0}
         run: |
-          echo "CONDA_BLD=/usr/share/miniconda/conda-bld/linux-64/" >> $GITHUB_ENV
+          echo "CONDA_BLD=/usr/share/miniconda/conda-bld/linux-64/" >> "$GITHUB_ENV"
 
       - name: Build conda package
         run: |
-          CHANNELS="-c https://software.repos.intel.com/python/conda -c conda-forge --override-channels"
-          VERSIONS="--python ${{ matrix.python }}"
-          TEST="--no-test"
+          CHANNELS=(-c https://software.repos.intel.com/python/conda -c conda-forge --override-channels)
+          VERSIONS=(--python "${{ matrix.python }}")
+          TEST=(--no-test)
 
           conda build \
-            $TEST \
-            $VERSIONS \
-            $CHANNELS \
+            "${TEST[@]}" \
+            "${VERSIONS[@]}" \
+            "${CHANNELS[@]}" \
             conda-recipe
 
       - name: Upload artifact
@@ -120,10 +120,10 @@ jobs:
       - name: Store conda paths as envs
         shell: bash -el {0}
         run: |
-          echo "CONDA_BLD=$CONDA_PREFIX\\conda-bld\\win-64\\" >> $GITHUB_ENV
+          echo "CONDA_BLD=${CONDA_PREFIX}\\conda-bld\\win-64\\" >> "$GITHUB_ENV"
 
       - name: Build conda package
-        run: conda build --no-test --python ${{ matrix.python }} -c https://software.repos.intel.com/python/conda -c conda-forge --override-channels conda-recipe
+        run: conda build --no-test --python "${{ matrix.python }}" -c https://software.repos.intel.com/python/conda -c conda-forge --override-channels conda-recipe
 
       - name: Upload artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
@@ -160,27 +160,27 @@ jobs:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python }}
 
       - name: Add conda to system path
-        run: echo $CONDA/bin >> $GITHUB_PATH
+        run: echo "$CONDA/bin" >> "$GITHUB_PATH"
 
       - name: Install conda-build
         run: conda install conda-build
 
       - name: Create conda channel
         run: |
-          mkdir -p $GITHUB_WORKSPACE/channel/linux-64
-          conda index $GITHUB_WORKSPACE/channel || exit 1
-          mv ${PACKAGE_NAME}-*.conda $GITHUB_WORKSPACE/channel/linux-64 || exit 1
-          conda index $GITHUB_WORKSPACE/channel || exit 1
+          mkdir -p "$GITHUB_WORKSPACE/channel/linux-64"
+          conda index "$GITHUB_WORKSPACE/channel" || exit 1
+          mv "${PACKAGE_NAME}"-*.conda "$GITHUB_WORKSPACE/channel/linux-64" || exit 1
+          conda index "$GITHUB_WORKSPACE/channel" || exit 1
           # Test channel
-          conda search $PACKAGE_NAME -c $GITHUB_WORKSPACE/channel --override-channels --info --json > $GITHUB_WORKSPACE/ver.json
+          conda search "$PACKAGE_NAME" -c "$GITHUB_WORKSPACE/channel" --override-channels --info --json > "$GITHUB_WORKSPACE/ver.json"
           cat ver.json
 
       - name: Collect dependencies
         run: |
-          . $CONDA/etc/profile.d/conda.sh
-          CHANNELS="-c $GITHUB_WORKSPACE/channel ${{ env.CHANNELS }}"
-          export PACKAGE_VERSION=$(python -c "${VER_SCRIPT1} ${VER_SCRIPT2}")
-          conda create -n ${{ env.TEST_ENV_NAME }} $PACKAGE_NAME=${PACKAGE_VERSION} python=${{ matrix.python }} numpy=${{ matrix.numpy }} $CHANNELS --only-deps --dry-run > lockfile
+          . "$CONDA/etc/profile.d/conda.sh"
+          PACKAGE_VERSION="$(python -c "${VER_SCRIPT1} ${VER_SCRIPT2}")"
+          export PACKAGE_VERSION
+          conda create -n "${{ env.TEST_ENV_NAME }}" "${PACKAGE_NAME}=${PACKAGE_VERSION}" "python=${{ matrix.python }}" "numpy=${{ matrix.numpy }}" -c "$GITHUB_WORKSPACE/channel" -c https://software.repos.intel.com/python/conda -c conda-forge --override-channels --only-deps --dry-run > lockfile
           cat lockfile
 
       - name: Set pkgs_dirs
@@ -201,19 +201,19 @@ jobs:
 
       - name: Install mkl_random
         run: |
-          . $CONDA/etc/profile.d/conda.sh
-          CHANNELS="-c $GITHUB_WORKSPACE/channel ${{ env.CHANNELS }}"
-          export PACKAGE_VERSION=$(python -c "${VER_SCRIPT1} ${VER_SCRIPT2}")
-          conda create -n ${{ env.TEST_ENV_NAME }} $PACKAGE_NAME=${PACKAGE_VERSION} pytest python=${{ matrix.python }} numpy=${{ matrix.numpy }} $CHANNELS
-          conda activate ${{ env.TEST_ENV_NAME }}
+          . "$CONDA/etc/profile.d/conda.sh"
+          PACKAGE_VERSION="$(python -c "${VER_SCRIPT1} ${VER_SCRIPT2}")"
+          export PACKAGE_VERSION
+          conda create -n "${{ env.TEST_ENV_NAME }}" "${PACKAGE_NAME}=${PACKAGE_VERSION}" pytest "python=${{ matrix.python }}" "numpy=${{ matrix.numpy }}" -c "$GITHUB_WORKSPACE/channel" -c https://software.repos.intel.com/python/conda -c conda-forge --override-channels
+          conda activate "${{ env.TEST_ENV_NAME }}"
 
           # Test installed packages
           conda list
 
       - name: Run tests
         run: |
-          . $CONDA/etc/profile.d/conda.sh
-          conda activate ${{ env.TEST_ENV_NAME }}
+          . "$CONDA/etc/profile.d/conda.sh"
+          conda activate "${{ env.TEST_ENV_NAME }}"
           pytest -vv --pyargs ${{ env.MODULE_NAME }}
 
   test_windows:
@@ -259,7 +259,7 @@ jobs:
         run: |
           mkdir ${{ env.GITHUB_WORKSPACE }}\channel\win-64
           move ${{ env.PACKAGE_NAME }}-*.conda ${{ env.GITHUB_WORKSPACE }}\channel\win-64
-          python -m conda_index ${{ env.GITHUB_WORKSPACE }}/channel
+          python -m conda_index "${{ env.GITHUB_WORKSPACE }}/channel"
 
           # Test channel
           conda search ${{ env.PACKAGE_NAME }} -c ${{ env.GITHUB_WORKSPACE }}/channel --override-channels --info --json > ${{ env.GITHUB_WORKSPACE }}\ver.json
@@ -309,5 +309,5 @@ jobs:
 
       - name: Run tests
         run: |
-          conda activate -n ${{ env.TEST_ENV_NAME }}
+          conda activate -n "${{ env.TEST_ENV_NAME }}"
           pytest -v --pyargs ${{ env.MODULE_NAME }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -2,6 +2,13 @@ repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
   rev: v6.0.0
   hooks:
+  # Git
+    - id: check-added-large-files
+    - id: no-commit-to-branch
+      name: "ensure no direct commit to master/maintenance branches"
+      args: [--branch, "master", --pattern, "maintenance/.*"]
+    - id: check-case-conflict
+    - id: check-illegal-windows-names
     - id: check-ast
     - id: check-builtin-literals
     - id: check-case-conflict
@@ -101,3 +108,14 @@ repos:
   rev: 3.0.0
   hooks:
   - id: shellcheck
+
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.30.0
+  hooks:
+  - id: gitleaks
+
+- repo: https://github.com/rhysd/actionlint
+  rev: v1.7.11
+  hooks:
+  - id: actionlint
+    args: ["-ignore", "SC2317"]
