chore(pre-commit): pin hook revs to commit SHAs

Pin each rev to the commit SHA of its current tag with a "# frozen: <tag>"
comment so Renovate updates both the SHA and the tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: iwstkhr

.pre-commit-config.yaml

@@ -1,5 +1,6 @@
 # Shared pre-commit config template for all repositories.
 # Copy it into each repository; Renovate keeps the rev values up to date.
+# Pin each rev to a commit SHA with a "# frozen: <tag>" comment so Renovate updates both.
 # Hooks with no matching files are skipped, so unused hooks can stay in place.
 # See README.md for per-repository adjustments, such as excluding generated files.
 # Install both hook types so the commit-msg hook runs: pre-commit install
@@ -14,7 +15,7 @@ repos:
   ##########################################################
   # General file fixers and syntax checks
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
     hooks:
       # Change to [--unsafe] for YAML with custom tags, such as CloudFormation
       - id: check-yaml
@@ -26,25 +27,25 @@ repos:
 
   # Lint GitHub Actions workflows
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.12
+    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca # frozen: v1.7.12
     hooks:
       - id: actionlint
 
   # Check commit messages against Conventional Commits (commit-msg stage)
   - repo: https://github.com/compilerla/conventional-pre-commit
-    rev: v4.4.0
+    rev: 91ab4bf57e58b32adf1a122681f6ebe164d081c8 # frozen: v4.4.0
     hooks:
       - id: conventional-pre-commit
 
   # Detect secrets such as API keys and tokens
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.1
+    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e # frozen: v8.30.1
     hooks:
       - id: gitleaks
 
   # Static analysis for security issues and bugs
   - repo: https://github.com/semgrep/pre-commit
-    rev: v1.180.0
+    rev: 225f70772e8c65f2bdd38ef3164807e907d09e49 # frozen: v1.180.0
     hooks:
       - id: semgrep
         # args replace the hook defaults, so keep --skip-unknown-extensions and the others here
@@ -53,7 +54,7 @@ repos:
 
   # Scan dependencies for vulnerabilities and IaC for misconfigurations (requires Docker)
   - repo: https://github.com/mxab/pre-commit-trivy
-    rev: v0.73.0
+    rev: db55d941954f2342c6355b6b9fba61f9ce6583e0 # frozen: v0.73.0
     hooks:
       - id: trivyfs-docker
         # Secret scanning is left to gitleaks; the last arg is the path to scan
@@ -63,13 +64,13 @@ repos:
 
   # Lint Markdown
   - repo: https://github.com/DavidAnson/markdownlint-cli2
-    rev: v0.23.3
+    rev: 916ad0aaa108c64d294101002066f530ea170b10 # frozen: v0.23.3
     hooks:
       - id: markdownlint-cli2
 
   # Lint shell scripts
   - repo: https://github.com/koalaman/shellcheck-precommit
-    rev: v0.11.0
+    rev: 99470f5e12208ff0fb17ab81c3c494f7620a1d8d # frozen: v0.11.0
     hooks:
       - id: shellcheck
 
@@ -78,13 +79,13 @@ repos:
   ##########################################################
   # Lint JavaScript and TypeScript files with Biome
   - repo: https://github.com/biomejs/pre-commit
-    rev: v2.5.13 # Use the sha / tag you want to point at
+    rev: 742ab683a70977bd4648797d799ddd6b5496ae87 # frozen: v2.5.13
     hooks:
       - id: biome-check
 
   # Lint and format Python files with Ruff
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.16.8
+    rev: 2eeb5678de71a00c0902cbda7105d328432f72cb # frozen: v0.16.8
     hooks:
       - id: ruff-check
         # --extend-select S adds the flake8-bandit security rules on top of the repository's Ruff config

README.md

@@ -20,7 +20,7 @@ pre-commit install
 
 `default_install_hook_types` in the config makes `pre-commit install` set up both the `pre-commit` and the `commit-msg` hook, so no extra flags are needed. Repositories that ran `pre-commit install` before the `commit-msg` hook was added need to run it once more.
 
-After copying, Renovate (`:enablePreCommit`) keeps each repository's `rev` values up to date.
+After copying, Renovate (`:enablePreCommit`) keeps each repository's `rev` values up to date. Each `rev` is pinned to a commit SHA with a `# frozen: <tag>` comment, and Renovate updates both the SHA and the tag. A bare SHA without the comment is treated as a version and is not updated correctly, so keep the comment when adding a hook. `pre-commit autoupdate --freeze` writes the same format.
 
 ### Included hooks