ci: harden CI workflows and configs per fleet-wide review feedback

- conventional-pr stub: dual pull_request/pull_request_target triggers
  so fork PRs from external contributors get labeled too (the reusable
  workflow never checks out PR code); explicit contents:read; pinned
  v1.4.3.
- pre-commit workflow: robust modified-files runner (null-delimited
  paths, deletion-only PRs handled, deleted paths filtered, no
  undocumented -r flag, cache keyed on config hash).
- flake8 args quoted correctly (the flow-scalar form split at commas
  and silently reduced the select list).
- hooks pinned to .github v1.4.3.

TRI-1100

Author: mc-nv

.github/workflows/conventional-pr.yml

@@ -33,10 +33,22 @@ name: conventional-pr
 on:
   pull_request:
     types: [opened, edited, synchronize, reopened]
+  pull_request_target:
+    types: [opened, edited, synchronize, reopened]
 
 jobs:
   conventional-pr:
+    # Same-repo PRs run on the safe pull_request event; fork PRs run on
+    # pull_request_target so the labeling job gets a writable token (safe
+    # here: the reusable workflow never checks out PR code - it only reads
+    # PR metadata via the API and manages labels).
+    if: >-
+      (github.event_name == 'pull_request' &&
+       github.event.pull_request.head.repo.full_name == github.repository) ||
+      (github.event_name == 'pull_request_target' &&
+       github.event.pull_request.head.repo.full_name != github.repository)
     permissions:
       pull-requests: write
       issues: write
-    uses: triton-inference-server/.github/.github/workflows/conventional-pr.yml@v1.4.2
+      contents: read
+    uses: triton-inference-server/.github/.github/workflows/conventional-pr.yml@v1.4.3

.github/workflows/pre-commit.yml

@@ -32,14 +32,23 @@ on:
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v5.0.0
       with:
         fetch-depth: 2
-    - name: Get modified files
-      id: modified-files
-      run: echo "modified_files=$(git diff --name-only -r HEAD^1 HEAD | xargs)" >> $GITHUB_OUTPUT
     - uses: actions/setup-python@v6.0.0
-    - uses: pre-commit/action@v3.0.1
+    - uses: actions/cache@v4
       with:
-        extra_args: --files ${{ steps.modified-files.outputs.modified_files }}
+        path: ~/.cache/pre-commit
+        key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
+    - name: Run pre-commit on the files modified by the PR
+      # Null-delimited so paths with spaces survive; --no-run-if-empty
+      # handles deletion-only PRs; deleted paths are filtered out before
+      # being handed to pre-commit.
+      run: |
+        python -m pip install --quiet pre-commit
+        git diff --name-only -z --diff-filter=d HEAD^1 HEAD \
+          | xargs -0 --no-run-if-empty \
+            pre-commit run --show-diff-on-failure --color=always --files

.pre-commit-config.yaml

@@ -41,7 +41,7 @@ repos:
   rev: 7.3.0
   hooks:
   - id: flake8
-    args: [--max-line-length=88, --select=C,E,F,W,B,B950, --extend-ignore = E203,E501]
+    args: ["--max-line-length=88", "--select=C,E,F,W,B,B950", "--extend-ignore=E203,E501"]
     types_or: [python, cython]
 - repo: https://github.com/pre-commit/mirrors-clang-format
   rev: v16.0.5
@@ -84,6 +84,6 @@ repos:
   - id: trailing-whitespace
 
 - repo: https://github.com/triton-inference-server/.github
-  rev: v1.4.2
+  rev: v1.4.3
   hooks:
   - id: add-license