Copier update: prepare for the prek migration (#113)

Pull in upstream template changes, tested in downstream repo

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Developer Tooling**
* Updated pinned versions of Python and JavaScript tooling and added
installation of `prek`.
* Improved lock-file-only setup for JavaScript projects and refined
validation output and CI failure reporting.
  * SHA tags are now limited to builds on the default branch.
* **Configuration**
* Updated template-managed settings and guidance to reflect current CI
checks.
* Restricted validation commands from selecting alternate configurations
or repository locations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: ejfine

.claude/CLAUDE.md

@@ -19,6 +19,7 @@
       "Bash(aws sts get*)",
       // Code Quality & Formatting
       "Bash(pre-commit run *)",
+      "Bash(prek run *)",
       // Core Shell Commands
       "Bash(COMMAND *)", // used in slash commands
       "Bash(kill *)",
@@ -165,6 +166,16 @@
       "Bash(task --dir=*)",
       "Bash(task -g *)",
       "Bash(task --global *)",
+      // Same reasoning for the hook runners: they must run the repo's own reviewed .pre-commit-config.yaml, and these flags are how to point them at another config or another repo
+      "Bash(pre-commit run -c *)",
+      "Bash(pre-commit run --config *)",
+      "Bash(pre-commit run --config=*)",
+      "Bash(prek run -c *)",
+      "Bash(prek run --config *)",
+      "Bash(prek run --config=*)",
+      "Bash(prek run -C *)",
+      "Bash(prek run --cd *)",
+      "Bash(prek run --cd=*)",
 
       // Destructive File Operations
       "Bash(chmod -R *)",

.claude/settings/permissions/bash.jsonc

@@ -13,7 +13,7 @@ reviews:
     - path: "**/vendor_files/**"
       instructions: "These files came from a vendor and we're not allowed to change them. Refer to it if you need to understand how the main code interacts with it, but do not make comments about it."
     - path: "**/*.py"
-      instructions: "Never express concerns about potential ruff rule violations, even those rules mentioned in other agent instructions; a pre-commit hook already runs a ruff check. Do not warn about unnecessary super().__init__() calls; pyrefly prefers those to be present. Do not warn about missing type hints; a pre-commit hook already checks for that."
+      instructions: "Never express concerns about potential ruff rule violations, even those rules mentioned in other agent instructions; the CI pipeline already runs a ruff check. Do not warn about unnecessary super().__init__() calls; pyrefly prefers those to be present. Do not warn about missing type hints; the CI pipeline already checks for that."
     - path: "**/.copier-answers.yml"
       instructions: "Do not comment about the `_commit` value needing to be a clean release tag. A CI job will fail if that is not the case."
     - path: ".config/.copier-managed-files.json"
@@ -26,11 +26,11 @@ reviews:
     appears in multiple entries, the last entry is the authoritative owner; use parent_src to
     trace the full chain and identify the correct template repo for backporting.
   tools:
-    eslint: # when the code contains typescript, eslint will be run by pre-commit, and coderabbit often generates false positives
+    eslint: # when the code contains typescript, eslint will be run in the CI pipeline, and coderabbit often generates false positives
       enabled: false
-    ruff: # when the code contains python, ruff will be run by pre-commit, and coderabbit often generates false positives
+    ruff: # when the code contains python, ruff will be run in the CI pipeline, and coderabbit often generates false positives
       enabled: false
-    pylint: # when the code contains python, pylint will be run by pre-commit, and coderabbit often generates false positives
+    pylint: # when the code contains python, pylint will be run in the CI pipeline, and coderabbit often generates false positives
       enabled: false
     flake8: # we use ruff instead (when we use Python)
       enabled: false

.coderabbit.yaml

@@ -1,5 +1,5 @@
 # Changes here will be overwritten by Copier
-_commit: v0.1.10
+_commit: v0.1.13
 _src_path: gh:LabAutomationAndScreening/copier-base-template.git
 copier_answers_directory: .config
 description: Copier template for creating Python libraries and executables

.config/.copier-answers.yml

@@ -6,7 +6,6 @@
         ".claude/.beads/.gitignore",
         ".claude/.beads/config.yaml",
         ".claude/.beads/metadata.json",
-        ".claude/CLAUDE.md",
         ".claude/commands/add-command.md",
         ".claude/commands/commit.md",
         ".claude/commands/create-adr.md",
@@ -90,6 +89,7 @@
         ".github/zizmor.yml",
         ".gitignore",
         ".pre-commit-config.yaml",
+        ".prekignore",
         ".python-version",
         "AGENTS.md",
         "CHANGELOG.md",
@@ -113,7 +113,6 @@
         "template/.claude/.beads/.gitignore",
         "template/.claude/.beads/config.yaml",
         "template/.claude/.beads/metadata.json",
-        "template/.claude/CLAUDE.md",
         "template/.claude/commands/add-command.md",
         "template/.claude/commands/commit.md",
         "template/.claude/commands/create-adr.md",

.config/.copier-managed-files.json

@@ -67,5 +67,5 @@
   "initializeCommand": "sh .devcontainer/initialize-command.sh",
   "onCreateCommand": "sh .devcontainer/on-create-command.sh",
   "postStartCommand": "sh .devcontainer/post-start-command.sh"
-  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 0b1abb95 # spellchecker:disable-line
+  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 3db73231 # spellchecker:disable-line
 }

.devcontainer/devcontainer.json

@@ -14,13 +14,14 @@
 import tempfile
 from pathlib import Path
 
-UV_VERSION = "0.12.15"
-PNPM_VERSION = "12.4.2"
+UV_VERSION = "0.12.23"
+PNPM_VERSION = "12.9.1"
 COPIER_VERSION = "==9.18.2"
 COPIER_TEMPLATE_EXTENSIONS_VERSION = "==0.3.3"
 PRE_COMMIT_VERSION = "==4.6.2"
 # identify decides which files each pre-commit hook runs on, so a floating version silently changes what CI checks
 IDENTIFY_VERSION = "==2.6.20"
+PREK_VERSION = "==0.5.5"
 TASK_VERSION = "==3.53.1"
 DOWNLOAD_TIMEOUT_SECONDS = 90
 # Where uv places both itself and the executables of the tools it installs. Resolves from USERPROFILE
@@ -282,6 +283,17 @@ def main():
             env=uv_env,
             timeout=DOWNLOAD_TIMEOUT_SECONDS,
         )
+        _ = subprocess.run(  # noqa: S603 # this is all our own input
+            [
+                uv_path,
+                "tool",
+                "install",
+                f"prek{PREK_VERSION}",
+            ],
+            check=True,
+            env=uv_env,
+            timeout=DOWNLOAD_TIMEOUT_SECONDS,
+        )
     if not args.no_node:
         run_node_cmds(["npm -v", f"npm install -g pnpm@{PNPM_VERSION}", "pnpm -v"], is_windows=is_windows)
     # Task is installed outside the --no-node branch because CI always passes --no-node (pnpm/setup handles pnpm there), and every job still needs the task runner

.devcontainer/install-ci-tooling.py

@@ -169,6 +169,8 @@ def main():  # noqa: C901,PLR0912,PLR0915 # TODO: cleanup into some subfunctions
             pnpm_command = ["pnpm", "install", "--dir", str(env.path)]
             if env_check_lock:
                 pnpm_command[1] = "ci"
+            if generate_lock_file_only:
+                pnpm_command.append("--lockfile-only")
             if is_windows:
                 pwsh = shutil.which("pwsh") or shutil.which("powershell")
                 if not pwsh:

.devcontainer/manual-setup-deps.py

@@ -92,7 +92,7 @@ runs:
       uses: pnpm/setup@v2.1.0
       with:
         # an empty version makes pnpm/setup read it from the manifest in working-directory instead. Passing both a version and a package.json with a conflicting `packageManager` field is a hard error in pnpm/setup.
-        version: ${{ inputs.working-directory == 'notUsing' && '12.4.2' || '' }}
+        version: ${{ inputs.working-directory == 'notUsing' && '12.9.1' || '' }}
         working-directory: ${{ steps.pnpm-project.outputs.dir }}
         # cache-dependency-path is left at its default, which is the lock file inside working-directory -- the same one the probe above checks
         runtime: node@${{ inputs.node-version }}

.github/actions/install_deps/action.yml

@@ -194,14 +194,14 @@ jobs:
           tags: ${{ steps.calculate-build-context-hash.outputs.full_image_tag }}
 
       - name: Add git sha tag
-        if: ${{ inputs.push-role-name != 'no-push' }}
+        if: ${{ inputs.push-role-name != 'no-push' && github.ref_name == github.event.repository.default_branch }} # feature branch CI runs would otherwise pile hundreds of sha tags onto an unchanged image
         run: |
           GIT_SHA_TAG="git-sha-${{ github.sha }}"
           if aws ecr describe-images --region ${{ steps.parse_ecr_url.outputs.aws_region }} --registry-id=${{ steps.parse_ecr_url.outputs.aws_account_id }} --repository-name=${{ inputs.image_name }} --image-ids imageTag="$GIT_SHA_TAG" > /dev/null 2>&1; then
             echo "Tag $GIT_SHA_TAG already exists in ECR, skipping"
           else
             aws ecr batch-get-image --registry-id=${{ steps.parse_ecr_url.outputs.aws_account_id }} --repository-name=${{ inputs.image_name }} --image-ids imageTag=${{ steps.calculate-build-context-hash.outputs.build_context_tag }} --query 'images[].imageManifest' --output text > manifest.json
-            # Every job on the push path tags the git sha, and jobs that find their image already in ECR no longer serialize on the mutex,
+            # Every default-branch job on the push path tags the git sha, and jobs that find their image already in ECR no longer serialize on the mutex,
             # so another job can apply this same tag between the check above and the put below. ECR reports that as
             # ImageAlreadyExistsException, which by definition means the tag already points at this exact manifest, so it is safe to ignore.
             # ImageTagAlreadyExistsException (a different manifest on an immutable repository) is a real conflict and still fails the step.