feat: apply the third-party review fixes to exit codes, parsing, config and tooling

.github/workflows/action.yml

@@ -4,27 +4,30 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   action_hook:
     runs-on: ubuntu-latest
     name: Docstring Linter
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         name: Git Checkout
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         name: Install Python ${{ vars.PYTHON_VERSION }}
         with:
           python-version: ${{ vars.PYTHON_VERSION }}
 
-      - uses: bastgau/docstring-linter@main
+      - uses: ./
         name: Execute Docstring Linter via GitHub Action
         with:
           paths: src/
           format: github-annotations
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 

.github/workflows/build.yml

@@ -4,23 +4,26 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     name: Build
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         name: Git Checkout
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
       - name: Build package
         run: uv build
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         name: Upload build artifacts
         with:
           name: dist

.github/workflows/ci.yml

@@ -7,6 +7,9 @@ on:
     branches: [main, develop]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     uses: ./.github/workflows/lint.yml
@@ -16,7 +19,8 @@ jobs:
     needs: lint
     uses: ./.github/workflows/tests.yml
     name: Tests
-    secrets: inherit
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   build:
     needs: tests

.github/workflows/lint.yml

@@ -4,6 +4,9 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   GROUP: "github-src"
 
@@ -12,33 +15,33 @@ jobs:
     runs-on: ubuntu-latest
     name: Lint
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         name: Git Checkout
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         name: Install Python ${{ vars.PYTHON_VERSION }}
         with:
           python-version: ${{ vars.PYTHON_VERSION }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
       - name: Install dependencies
         run: uv sync --no-dev --group ${{ env.GROUP }}
 
       - name: Install dotenv-linter
-        run: curl -sSfL https://raw.githubusercontent.com/dotenv-linter/dotenv-linter/master/install.sh | sudo sh -s -- -b /usr/local/bin v4.0.0
-
-      - uses: j178/prek-action@v3.0.1
-        name: Execute Prek on push
-        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-        with:
-          extra-args: --group ${{ env.GROUP }} --all-files
-
-      - uses: j178/prek-action@v3.0.1
-        name: Execute Prek on pull_request
-        if: github.event_name == 'pull_request'
+        env:
+          DOTENV_LINTER_VERSION: v4.0.0
+          DOTENV_LINTER_SHA256: 9e2f1f6eb88a71ac15ef209f78f5a68644db82f132d2677112b4f80ec2bd2127
+        run: |
+          archive="$RUNNER_TEMP/dotenv-linter.tar.gz"
+          curl -sSfL -o "$archive" "https://github.com/dotenv-linter/dotenv-linter/releases/download/${DOTENV_LINTER_VERSION}/dotenv-linter-linux-x86_64.tar.gz"
+          echo "${DOTENV_LINTER_SHA256}  $archive" | sha256sum -c -
+          sudo tar -xzf "$archive" -C /usr/local/bin dotenv-linter
+
+      - uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204 # v3.0.1
+        name: Execute Prek
         with:
-          extra-args: --group ${{ env.GROUP }} --files origin/${{ github.base_ref }}..HEAD
+          extra-args: --verbose --group ${{ env.GROUP }} --all-files

.github/workflows/publish-release.yml

@@ -19,15 +19,16 @@ jobs:
     needs: lint
     uses: ./.github/workflows/tests.yml
     name: Tests
-    secrets: inherit
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   guard:
     needs: tests
     if: ${{ !contains(github.ref_name, '-') }}
     runs-on: ubuntu-latest
     name: Guard
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         name: Git Checkout
         with:
           fetch-depth: 0
@@ -45,13 +46,13 @@ jobs:
     runs-on: ubuntu-latest
     name: Build
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         name: Git Checkout
         with:
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
@@ -62,7 +63,7 @@ jobs:
         run: uv build
 
       - name: Upload distributions
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dist
           path: dist/
@@ -74,13 +75,13 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         name: Git Checkout
         with:
           fetch-depth: 0
 
       - name: Download distributions
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist/
@@ -119,7 +120,7 @@ jobs:
 
       - name: Create GitHub Release
         if: steps.check_release.outputs.exists == 'false'
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           name: Release ${{ github.ref_name }}
           files: |
@@ -138,13 +139,13 @@ jobs:
       id-token: write
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist/
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
 
       - name: Publish to PyPI
         run: uv publish --trusted-publishing always

.github/workflows/pull-request-validation.yml

@@ -4,13 +4,17 @@ on:
   pull_request:
     types: [opened, edited, synchronize, reopened]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   lint-pr-title:
     if: github.base_ref != 'main'
     runs-on: ubuntu-latest
     name: Lint PR title
     steps:
-      - uses: amannn/action-semantic-pull-request@v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -30,10 +34,10 @@ jobs:
     runs-on: ubuntu-latest
     name: Lint commits
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - uses: wagoid/commitlint-github-action@v6
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
         with:
           configFile: .commitlintrc.mjs

.github/workflows/tests.yml

@@ -2,8 +2,14 @@ name: Tests
 
 on:
   workflow_call:
+    secrets:
+      CODECOV_TOKEN:
+        required: false
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   GROUP: "github-tests"
 
@@ -12,40 +18,33 @@ jobs:
     runs-on: ubuntu-latest
     name: Tests
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         name: Git Checkout
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         name: Install Python ${{ vars.PYTHON_VERSION }}
         with:
           python-version: ${{ vars.PYTHON_VERSION }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: true
 
       - name: Install dependencies
         run: uv sync --no-dev --group ${{ env.GROUP }}
 
-      - uses: j178/prek-action@v3.0.1
-        name: Execute Prek on push
-        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-        with:
-          extra-args: --group ${{ env.GROUP }} --all-files
-
-      - uses: j178/prek-action@v3.0.1
-        name: Execute Prek on pull_request
-        if: github.event_name == 'pull_request'
+      - uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204 # v3.0.1
+        name: Execute Prek
         with:
-          extra-args: --group ${{ env.GROUP }} --files origin/${{ github.base_ref }}..HEAD
+          extra-args: --verbose --group ${{ env.GROUP }} --all-files
 
-      - uses: codecov/codecov-action@v7
+      - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         name: Upload coverage to Codecov
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         name: Upload coverage report as artifact
         with:
           name: coverage-report

.pre-commit-config.yaml

@@ -1,5 +1,5 @@
 repos:
-  # ── Hooks génériques ─────────────────────────────────────────────────────────
+  # ── Generic hooks ────────────────────────────────────────────────────────────
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
@@ -17,7 +17,7 @@ repos:
       - id: mixed-line-ending
         args: ['--fix=lf']
         stages: [pre-commit]
-        groups: [locals]
+        groups: [local]
       - id: check-json
         stages: [pre-commit]
         groups: [local,github-src]
@@ -61,7 +61,7 @@ repos:
         files: \.env(-example)?$
         groups: [local,github-src]
 
-  # ── Fichiers interdits ───────────────────────────────────────────────────────
+  # ── Forbidden files ──────────────────────────────────────────────────────────
   - repo: local
     hooks:
       - id: forbid-files
@@ -131,6 +131,7 @@ repos:
         language: system
         stages: [pre-commit]
         types: [python]
+        files: ^src/
         groups: [local,github-src]
 
   # ── Docstring linters (src/) ──────────────────────────────────────────────────
@@ -187,7 +188,7 @@ repos:
         files: ^tests/
         groups: [local,github-tests]
 
-  # ── Tests & qualite ──────────────────────────────────────────────────────────
+  # ── Tests & quality ──────────────────────────────────────────────────────────
   - repo: local
     hooks:
       - id: pytest-coverage-all-files
@@ -201,7 +202,7 @@ repos:
 
       - id: vulture-all-files
         name: vulture-all-files
-        entry: uv run vulture tests/ src/ .vulture
+        entry: uv run vulture tests/ src/
         language: system
         stages: [pre-commit]
         pass_filenames: false

.pre-commit-hooks.yaml

@@ -1,6 +1,6 @@
 - id: docstring-linter
   name: docstring-linter
   description: Validate Python docstrings against style conventions.
-  entry: docstring-linter
+  entry: docstring-linter --force-exclude
   language: python
   types: [python]