name: Update Pre-commit Hooks
on:
  workflow_dispatch:
  schedule:
    - cron: '0 8 * * 5'   # every Friday at 08:00 UTC (day after NPM updates)

permissions: {}  # Minimal top-level for OSSF Scorecard Token-Permissions

jobs:
  update:
    name: 🪝 Update Pre-commit Hooks
    runs-on: ubuntu-latest
    permissions:
      contents: write  # Required for creating PRs
      pull-requests: write  # Required for creating PRs
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: 📰 Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          ref: main

      - name: 🐍 Setup Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: '3.x'

      - name: 📦 Install pre-commit-update
        run: |
          python -m pip install pip==25.0 \
            --hash=sha256:b6eb97a803356a52b2dd4bb73ba9e65b2ba16caa6bcb25a7497350a4e5859b65
          pip install pre-commit-update==0.6.1 \
            --hash=sha256:db00891b3384776daaaa5721fd54a448ded19daf87635a3c77b7508eaf7d1634

      - name: 🔄 Update pre-commit hooks (stable versions only)
        run: |
          # pre-commit-update skips alpha/beta/rc versions by default
          pre-commit-update

      - name: 📝 Check for changes
        id: verify-changed-files
        run: |
          if git diff --quiet .pre-commit-config.yaml; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
            echo "No changes detected in .pre-commit-config.yaml"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
            echo "Changes detected in .pre-commit-config.yaml"
            echo "## Changes:" >> "$GITHUB_STEP_SUMMARY"
            git diff .pre-commit-config.yaml >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: 📝 Create pull request
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        if: steps.verify-changed-files.outputs.changed == 'true'
        with:
          branch: update-precommit-hooks-${{ github.run_number }}
          title: 🤖 Update pre-commit hooks
          body: |
            This PR updates pre-commit hooks to their latest versions.

            **Changes include:**
            - Updated hook versions for better linting and bug fixes
            - Ensures consistency with latest tool versions

            This PR was created by the Pre-commit Update Bot.
          sign-commits: true
          add-paths: .pre-commit-config.yaml
          commit-message: 🤖 Update pre-commit hooks
          labels: maintenance
          draft: false
          base: main
          reviewers: djpetti,HashedViking,LearningCircuit