ci: unify auto-merge across bots (#322)

* ci: unify auto-merge across bots

Rename dependabot-auto-merge.yml to auto-merge.yml and add a job that
merges the weekly pre-commit hook bump. The bump reaches every
repository at once and carries nothing but `rev:` changes, yet each one
had to be merged by hand.

Add lf-pre-commit.yml so the updated hooks run over the whole tree
before such a pull request is merged.

* ci: run the pre-commit job on 3.13

The pinned pre-commit stack requires Python 3.10 or newer, so the py39
floor the controller plugins support cannot run it.

Author: markuslf

…thub/workflows/dependabot-auto-merge.yml .github/workflows/auto-merge.yml.github/workflows/dependabot-auto-merge.yml renamed to .github/workflows/auto-merge.yml .github/workflows/dependabot-auto-merge.yml renamed to .github/workflows/auto-merge.yml

@@ -1,4 +1,4 @@
-name: 'Linuxfabrik: Dependabot auto-merge'
+name: 'Linuxfabrik: Auto-merge'
 
 on:
   pull_request: {}
@@ -17,7 +17,7 @@ env:
   FROZEN_LOCKFILES: '[]'
 
 jobs:
-  auto-merge:
+  dependabot:
     runs-on: 'ubuntu-latest'
     if: 'github.actor == ''dependabot[bot]'''
     permissions:
@@ -63,3 +63,24 @@ jobs:
         env:
           GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
           PR_URL: '${{ github.event.pull_request.html_url }}'
+
+  # The weekly hook bump carries nothing but `rev:` changes in
+  # .pre-commit-config.yaml, and it arrives in every repository at once.
+  # Merging that by hand is pure overhead, so it goes in as soon as the
+  # required checks pass. The same fallback as above applies, and it is only
+  # safe because the ruleset keeps enforcing those checks server-side.
+  pre-commit-autoupdate:
+    runs-on: 'ubuntu-latest'
+    if: >-
+      github.actor == 'linuxfabrik-automation[bot]'
+      && github.head_ref == 'chore/pre-commit-autoupdate'
+    permissions:
+      contents: 'write'
+      pull-requests: 'write'
+    steps:
+
+      - run: |
+          gh pr merge --auto --squash "$PR_URL" || gh pr merge --squash "$PR_URL"
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          PR_URL: '${{ github.event.pull_request.html_url }}'

.github/workflows/lf-pre-commit.yml

@@ -0,0 +1,41 @@
+name: 'Linuxfabrik: Pre-commit'
+
+on:
+  push:
+    branches:
+      - 'main'
+  pull_request: {}
+
+permissions:
+  contents: 'read'
+
+jobs:
+  pre-commit:
+    name: 'Pre-commit'
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Harden the runner (Audit all outbound calls)'
+        uses: 'step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40' # v2.20.1
+        with:
+          egress-policy: 'audit'
+
+      - name: 'Checkout repository'
+        uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
+
+      # This runs pre-commit itself, not the collection.  The pinned stack in
+      # .github/pre-commit/requirements.txt needs 3.10 or newer, so it cannot
+      # be the py39 floor the controller plugins support.  That floor is
+      # covered by the matrix in lf-unit-tests.yml instead.
+      - name: 'Set up Python'
+        uses: 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97' # v7.0.0
+        with:
+          python-version: '3.13'
+
+      - name: 'Install pre-commit'
+        run: 'pip install --require-hashes --requirement .github/pre-commit/requirements.txt'
+
+      # --all-files, because the hooks otherwise only see what a commit
+      # happens to touch, and nothing guarantees a contributor ran
+      # `pre-commit install` at all.
+      - name: 'Run the hooks over the whole tree'
+        run: 'pre-commit run --all-files --show-diff-on-failure'