[pre-commit.ci] pre-commit autoupdate

[pre-commit-ci]

updates:

• github.com/astral-sh/ruff-pre-commit: v0.14.10 → v0.15.9
• github.com/psf/black-pre-commit-mirror: 25.12.0 → 26.3.1
• github.com/python-jsonschema/check-jsonschema: 0.36.0 → 0.37.1
• github.com/rhysd/actionlint: v1.7.10 → v1.7.12
• github.com/pre-commit/mirrors-mypy: v1.19.1 → v1.20.0
• github.com/woodruffw/zizmor-pre-commit: v1.14.2 → v1.23.1
• github.com/tox-dev/pyproject-fmt: v2.11.1 → v2.21.0
• github.com/abravalheri/validate-pyproject: v0.24.1 → v0.25
• github.com/codespell-project/codespell: v2.4.1 → v2.4.2

[hugovk]

I've pushed a fix for this, which is to assign the command tuple to a variable first, which is how the other tests do it. Feels more like a workaround.

ruff check...............................................................Failed
- hook id: ruff-check
- exit code: 1

  S607 Starting a process with a partial executable path
     --> cherry_picker/test_cherry_picker.py:136:34
      |
  134 |         git_init()
  135 |     except subprocess.CalledProcessError:
  136 |         version = subprocess.run(("git", "--version"), capture_output=True)
      |                                  ^^^^^^^^^^^^^^^^^^^^
  137 |         # the output looks like "git version 2.34.1"
  138 |         v = version.stdout.decode("utf-8").removeprefix("git version ").split(".")

[hugovk]

The other one:

  warning[: secrets referenced without a dedicated environment
    --> .github/workflows/main.yml:44:22
     |
  11 |   test:
     |   ---- this job
  ...
  44 |           token: ${{ secrets.CODECOV_ORG_TOKEN }}
     |                      ^^^^^^^^^^^^^^^^^^^^^^^^^ secret is accessed outside of a dedicated environment
     |
     = note: audit confidence → High
     = help: audit documentation → https://docs.zizmor.sh/audits/#secrets-outside-env

We can either allow this, as I think the worst someone can do if they manage to get hold of this is to fake the coverage report.

But better, we should be able to get rid of the token altogether now. I've pushed a commit to remove it. In another org, we just flipped this from required to not required:

@JacobCoffee Please could you select "Not required" at https://app.codecov.io/account/gh/python/org-upload-token ?

[JacobCoffee]

@hugovk

[hugovk]

Thanks!

I've restarted the tests, and it's uploading okay:

info - 2026-04-08 13:16:19,873 -- Your upload is now queued for processing. When finished, results will be available at: https://app.codecov.io/github/python/cherry-picker/commit/e09216f6efa531e42ab813bdd51348bd1cb0212c

https://github.com/python/cherry-picker/actions/runs/24131641814/job/70428993264?pr=177

[ezio-melotti]

Suggested change

	git_version_cmd = "git", "--version"
	version = subprocess.run(git_version_cmd, capture_output=True)
	git_version_cmd = ("git", "--version")
	version = subprocess.run(git_version_cmd, capture_output=True)

[hugovk]

We can commit this if you like, and we can watch the formatter remove them again :)

[zware]

Sounds like a broken formatter :). Took me a bit too long to see that git_version_cmd was in fact still a tuple and not just a string (I was apparently just glossing over the ", " as ).

Suggested change

	git_version_cmd = "git", "--version"
	version = subprocess.run(git_version_cmd, capture_output=True)
	git_version_cmd = ["git", "--version"]
	version = subprocess.run(git_version_cmd, capture_output=True)

then. Not sure why it's changing in the first place, though...

[hugovk]

It's actually my memory that is broken 🙃

Here's what was added to Black's 2026 style:

• remove_parens_from_assignment_lhs: Remove unnecessary parentheses from the left-hand side of assignments while preserving magic trailing commas and intentional multiline formatting

https://github.com/psf/black/blob/main/CHANGES.md#version-2610

So it's safe to add parentheses. PR welcome! There's more than this one instance though, so do them all.

[zware]

Oh, now I see the comment about this being a hack around S607. Honestly, I'd rather just ignore S607 (or use comment suppression), at least in test_*.py.

I'm just complaining with no intent to put time into fixing it in any kind of reasonable time though, so please feel free to ignore me! :)

[ezio-melotti]

Unrelated to this PR, but this seems to be unintentionally misspelled in several tests?

[hugovk]

Oh, didn't notice that! Might as well fix it. I'll slip it into this PR.