Remove superlinter dependency and refactor/format the entire codebase

.github/dependabot.yml

@@ -0,0 +1,42 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+version: 2
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: daily
+    cooldown:
+      default-days: 7
+    allow:
+      - dependency-type: all
+    groups:
+      python-version-updates:
+        applies-to: version-updates
+        patterns: ["*"]
+        exclude-patterns: ["setuptools"]
+
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: daily
+    cooldown:
+      default-days: 7
+    groups:
+      hook-version-updates:
+        applies-to: version-updates
+        patterns: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+    cooldown:
+      default-days: 7
+    groups:
+      action-version-updates:
+        applies-to: version-updates
+        patterns: ["*"]

.github/workflows/lint.yml

@@ -5,7 +5,7 @@
 # under which the code may be used.
 # -----------------------------------------------------------------------------
 
-# Lint/analyse code with Super-Linter.
+# Run the same pre-commit checks used locally.
 name: Checks
 
 on:
@@ -16,7 +16,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 permissions:
@@ -27,42 +27,35 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    strategy:
-      max-parallel: 4
-      fail-fast: false
-      matrix:
-        python-version: ["3.11", "3.12", "3.14"]
-
-    permissions:
-      contents: read
-      statuses: write
-
     steps:
       - name: Checkout current
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0
 
-      - name: Super-Lint
-        uses: super-linter/super-linter/slim@d5b0a2ab116623730dd094f15ddc1b6b25bf7b99  # v8.3.2
+      - name: Set up uv with Python
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          python-version: '3.14'
+          enable-cache: false
+
+      - name: Install quality tools
+        run: uv sync --frozen --extra dev
+
+      - name: Check changed files
+        if: github.event_name != 'workflow_dispatch'
         env:
-          # Once the codebase is perfectly linted/formatted, switch to validating only changed files
-          # VALIDATE_ALL_CODEBASE: false  # lint and format new or changed files only
-          FILTER_REGEX_EXCLUDE: (.*[.]conf.py|pull_request_template.md)
-          IGNORE_GITIGNORED_FILES: true
-          VALIDATE_BASH: true
-          VALIDATE_CHECKOV: true
-          VALIDATE_GITHUB_ACTIONS: true
-          VALIDATE_GIT_LEAKS: true
-          VALIDATE_GIT_MERGE_CONFLICT_MARKERS: true
-          VALIDATE_JSON: true
-          VALIDATE_MARKDOWN: true
-          VALIDATE_NATURAL_LANGUAGE: true
-          VALIDATE_PERL: true
-          VALIDATE_PYTHON_RUFF_FORMAT: true
-          VALIDATE_PYTHON_RUFF: true
-          VALIDATE_YAML: true
-          # To report GitHub Actions status checks
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          FROM_REF: ${{ github.event.pull_request.base.sha || github.event.before }}
+          TO_REF: ${{ github.sha }}
+        run: |
+          if [[ "$FROM_REF" =~ ^0+$ ]]; then
+            uv run --frozen --extra dev pre-commit run --hook-stage manual --all-files --show-diff-on-failure
+          else
+            uv run --frozen --extra dev pre-commit run --hook-stage manual --from-ref "$FROM_REF" --to-ref "$TO_REF" --show-diff-on-failure
+          fi
+
+      - name: Audit all files
+        if: github.event_name == 'workflow_dispatch'
+        run: uv run --frozen --extra dev pre-commit run --hook-stage manual --all-files --show-diff-on-failure
 ...

.github/workflows/python_unit_tests.yaml

@@ -10,10 +10,14 @@ on:
   pull_request:
     paths:
       - '**.py'
+      - 'pyproject.toml'
+      - 'uv.lock'
       - '.github/workflows/python_unit_tests.yaml'
   push:
     paths:
       - '**.py'
+      - 'pyproject.toml'
+      - 'uv.lock'
       - '.github/workflows/python_unit_tests.yaml'
   workflow_dispatch:
 
@@ -32,22 +36,22 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up uv with Python
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           python-version: '3.14'
           enable-cache: true
 
       - name: Install dependencies
-        run: uv sync --extra test
+        run: uv sync --frozen --extra test
 
       - name: Test with pytest
         run: |
           # Setup git for git_bdiff and get_git_sources testing
           git config --global user.name 'Testing'
           git config --global user.email 'Testing'
-          uv run pytest -vv
+          uv run --frozen --extra test pytest -vv

.github/zizmor.yml

@@ -1,8 +1,8 @@
-# ------------------------------------------------------------------------------
-# (c) Crown copyright Met Office. All rights reserved.
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
 # The file LICENCE, distributed with this code, contains details of the terms
 # under which the code may be used.
-# ------------------------------------------------------------------------------
+# -----------------------------------------------------------------------------
 
 # Rules for Zizmor GitHub workflow linter. This file is used to configure which
 # rules to ignore for specific workflow files, allowing for exceptions to be

.gitignore

@@ -1,3 +1,8 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
 *.sublime-workspace
 *.code-workspace
 .vscode
@@ -7,4 +12,8 @@ __pycache__/
 *.swp
 .conda
 .idea
-uv.lock
+.venv/
+.ruff_cache/
+*.egg-info/
+.pytest_cache/
+.rumdl_cache/

.pre-commit-config.yaml

@@ -0,0 +1,71 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+minimum_pre_commit_version: '4.7.0'
+exclude: |
+  (?x)(
+    ^script_copyright_checker/file/
+    | ^script_umdp3_checker/tests/example_fortran_code\.F90$
+    | (^|/)([^/]+\.conf\.py|pull_request_template\.md)$
+  )
+
+repos:
+  - repo: local
+    hooks:
+      - id: ruff-check
+        name: Ruff lint
+        entry: ruff check --fix
+        language: system
+        types_or: [python, pyi]
+      - id: ruff-format
+        name: Ruff format
+        entry: ruff format
+        language: system
+        types_or: [python, pyi]
+      - id: rumdl
+        name: Markdown lint
+        entry: rumdl check --fix
+        language: system
+        types: [markdown]
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
+    hooks:
+      - id: check-merge-conflict
+      - id: check-json
+      - id: check-yaml
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: a6564f5d57444e123433a5c9af733e3975c77229  # frozen: v0.11.0.1-1
+    hooks:
+      - id: shellcheck
+        types: [shell]
+        args: ["--source-path=SCRIPTDIR"]
+
+  - repo: https://github.com/rhysd/actionlint
+    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca  # frozen: v1.7.12
+    hooks:
+      - id: actionlint
+
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: 06a39750ec31860bb44f2acf67182c40016cd1e7  # frozen: v1.32.0
+    hooks:
+      - id: zizmor
+        files: '(^|/)(\.github/(workflows/[^/]+|zizmor|dependabot)\.ya?ml|action\.ya?ml|\.pre-commit-(config|hooks)\.ya?ml)$'
+        pass_filenames: false
+        args: ["--no-progress", "--offline", "--config", ".github/zizmor.yml", "."]
+
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e  # frozen: v8.30.1
+    hooks:
+      - id: gitleaks
+        stages: [pre-commit]
+      - id: gitleaks
+        alias: gitleaks-history
+        name: Detect hardcoded secrets in Git history
+        entry: gitleaks git --redact --verbose
+        stages: [manual]