chore: implement pre-commit with make-target hooks

.pre-commit-config.yaml

@@ -3,27 +3,34 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 repos:
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.2
-    hooks:
-      - id: ruff
-        args: [--fix]
-        files: ^(src|tests)/
-      - id: ruff-format
-        files: ^(src|tests)/
-
   - repo: local
     hooks:
+      - id: lint
+        name: lint
+        language: system
+        entry: make lint
+        pass_filenames: false
+
+      - id: format-check
+        name: format-check
+        language: system
+        entry: make format-check
+        pass_filenames: false
+
       - id: license-headers
-        name: Check license headers
-        language: python
-        entry: python scripts/check_license_headers.py
-        files: \.py$
+        name: license-headers
+        language: system
+        entry: make license
+        pass_filenames: false
+
+      - id: security
+        name: security
+        language: system
+        entry: make security
         pass_filenames: false
 
-      - id: bandit
-        name: bandit security scan
-        language: python
-        entry: python -m bandit -r src/ipsdk --configfile pyproject.toml
-        files: ^src/ipsdk/
+      - id: typecheck
+        name: typecheck
+        language: system
+        entry: make typecheck
         pass_filenames: false

AGENTS.md

@@ -45,6 +45,7 @@ Port auto-resolution: if `port=0` (default), uses 443 for TLS, 80 without. Ports
 ```bash
 # Setup: requires uv
 uv sync --all-extras --dev
+make hooks             # Install pre-commit hooks (once after cloning)
 
 # Daily workflow
 make test              # pytest
@@ -98,10 +99,6 @@ CI (`ci.yaml`): runs lint, format-check, typecheck, security, license, then a ma
 - Gateway: always basic auth. Defaults are `user="admin@itential"`, `password="admin"`. No OAuth support; `client_id`/`client_secret` are not accepted.
 - Never mix OAuth + basic auth params.
 
-## Known Issues
-
-**Missing `.pre-commit-config.yaml`**: `pre-commit` is listed as a dev dependency but the config file doesn't exist in the repo.
-
 ## Gotchas
 
 - `want_async=False` by default — easy to forget when you need async

Makefile

@@ -53,7 +53,7 @@ build: ## Build distribution packages (wheel + sdist)
 # Quality checks
 # ------------------------------------------------------------------------------
 
-.PHONY: lint format format-check ruff-fix security typecheck license license-fix notice-check
+.PHONY: hooks lint format format-check ruff-fix security typecheck license license-fix notice-check
 
 typecheck: ## Run mypy static type checking
 	$(UV) run mypy $(SRC)
@@ -79,6 +79,9 @@ license: ## Check all Python files for license headers
 license-fix: ## Add missing license headers to Python files
 	$(UV) run python $(SCRIPTS)/check_license_headers.py --fix
 
+hooks: ## Install pre-commit hooks (run once after cloning)
+	$(UV) run pre-commit install
+
 notice-check: ## Verify NOTICE file lists all packages in uv.lock
 	@echo "Packages in uv.lock not mentioned in NOTICE:"
 	@grep -E '^name = "' uv.lock | sed 's/name = "\(.*\)"/\1/' | \

pyproject.toml

@@ -59,6 +59,7 @@ dev = [
     "coverage",
     "build",
     "bandit[toml]",
+    "pre-commit",
     "tox",
     "tox-uv",
 ]