Copier update: prepare for the prek migration

.claude/settings/permissions/bash.jsonc

@@ -19,6 +19,7 @@
       "Bash(aws sts get*)",
       // Code Quality & Formatting
       "Bash(pre-commit run *)",
+      "Bash(prek run *)",
       // Core Shell Commands
       "Bash(COMMAND *)", // used in slash commands
       "Bash(kill *)",
@@ -165,6 +166,16 @@
       "Bash(task --dir=*)",
       "Bash(task -g *)",
       "Bash(task --global *)",
+      // Same reasoning for the hook runners: they must run the repo's own reviewed .pre-commit-config.yaml, and these flags are how to point them at another config or another repo
+      "Bash(pre-commit run -c *)",
+      "Bash(pre-commit run --config *)",
+      "Bash(pre-commit run --config=*)",
+      "Bash(prek run -c *)",
+      "Bash(prek run --config *)",
+      "Bash(prek run --config=*)",
+      "Bash(prek run -C *)",
+      "Bash(prek run --cd *)",
+      "Bash(prek run --cd=*)",
 
       // Destructive File Operations
       "Bash(chmod -R *)",

.coderabbit.yaml

@@ -13,7 +13,7 @@ reviews:
     - path: "**/vendor_files/**"
       instructions: "These files came from a vendor and we're not allowed to change them. Refer to it if you need to understand how the main code interacts with it, but do not make comments about it."
     - path: "**/*.py"
-      instructions: "Never express concerns about potential ruff rule violations, even those rules mentioned in other agent instructions; a pre-commit hook already runs a ruff check. Do not warn about unnecessary super().__init__() calls; pyrefly prefers those to be present. Do not warn about missing type hints; a pre-commit hook already checks for that."
+      instructions: "Never express concerns about potential ruff rule violations, even those rules mentioned in other agent instructions; the CI pipeline already runs a ruff check. Do not warn about unnecessary super().__init__() calls; pyrefly prefers those to be present. Do not warn about missing type hints; the CI pipeline already checks for that."
     - path: "**/.copier-answers.yml"
       instructions: "Do not comment about the `_commit` value needing to be a clean release tag. A CI job will fail if that is not the case."
     - path: ".config/.copier-managed-files.json"
@@ -26,11 +26,11 @@ reviews:
     appears in multiple entries, the last entry is the authoritative owner; use parent_src to
     trace the full chain and identify the correct template repo for backporting.
   tools:
-    eslint: # when the code contains typescript, eslint will be run by pre-commit, and coderabbit often generates false positives
+    eslint: # when the code contains typescript, eslint will be run in the CI pipeline, and coderabbit often generates false positives
       enabled: false
-    ruff: # when the code contains python, ruff will be run by pre-commit, and coderabbit often generates false positives
+    ruff: # when the code contains python, ruff will be run in the CI pipeline, and coderabbit often generates false positives
       enabled: false
-    pylint: # when the code contains python, pylint will be run by pre-commit, and coderabbit often generates false positives
+    pylint: # when the code contains python, pylint will be run in the CI pipeline, and coderabbit often generates false positives
       enabled: false
     flake8: # we use ruff instead (when we use Python)
       enabled: false

.config/.copier-answers.yml

@@ -1,5 +1,5 @@
 # Changes here will be overwritten by Copier
-_commit: v0.1.10
+_commit: v0.1.13
 _src_path: gh:LabAutomationAndScreening/copier-base-template.git
 copier_answers_directory: .config
 description: Copier template for creating Python libraries and executables

.config/.copier-managed-files.json

@@ -6,7 +6,6 @@
         ".claude/.beads/.gitignore",
         ".claude/.beads/config.yaml",
         ".claude/.beads/metadata.json",
-        ".claude/CLAUDE.md",
         ".claude/commands/add-command.md",
         ".claude/commands/commit.md",
         ".claude/commands/create-adr.md",
@@ -90,6 +89,7 @@
         ".github/zizmor.yml",
         ".gitignore",
         ".pre-commit-config.yaml",
+        ".prekignore",
         ".python-version",
         "AGENTS.md",
         "CHANGELOG.md",
@@ -113,7 +113,6 @@
         "template/.claude/.beads/.gitignore",
         "template/.claude/.beads/config.yaml",
         "template/.claude/.beads/metadata.json",
-        "template/.claude/CLAUDE.md",
         "template/.claude/commands/add-command.md",
         "template/.claude/commands/commit.md",
         "template/.claude/commands/create-adr.md",

.devcontainer/devcontainer.json

@@ -67,5 +67,5 @@
   "initializeCommand": "sh .devcontainer/initialize-command.sh",
   "onCreateCommand": "sh .devcontainer/on-create-command.sh",
   "postStartCommand": "sh .devcontainer/post-start-command.sh"
-  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 0b1abb95 # spellchecker:disable-line
+  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 3db73231 # spellchecker:disable-line
 }

.devcontainer/install-ci-tooling.py

@@ -14,13 +14,14 @@
 import tempfile
 from pathlib import Path
 
-UV_VERSION = "0.12.15"
-PNPM_VERSION = "12.4.2"
+UV_VERSION = "0.12.23"
+PNPM_VERSION = "12.9.1"
 COPIER_VERSION = "==9.18.2"
 COPIER_TEMPLATE_EXTENSIONS_VERSION = "==0.3.3"
 PRE_COMMIT_VERSION = "==4.6.2"
 # identify decides which files each pre-commit hook runs on, so a floating version silently changes what CI checks
 IDENTIFY_VERSION = "==2.6.20"
+PREK_VERSION = "==0.5.5"
 TASK_VERSION = "==3.53.1"
 DOWNLOAD_TIMEOUT_SECONDS = 90
 # Where uv places both itself and the executables of the tools it installs. Resolves from USERPROFILE
@@ -282,6 +283,17 @@ def main():
             env=uv_env,
             timeout=DOWNLOAD_TIMEOUT_SECONDS,
         )
+        _ = subprocess.run(  # noqa: S603 # this is all our own input
+            [
+                uv_path,
+                "tool",
+                "install",
+                f"prek{PREK_VERSION}",
+            ],
+            check=True,
+            env=uv_env,
+            timeout=DOWNLOAD_TIMEOUT_SECONDS,
+        )
     if not args.no_node:
         run_node_cmds(["npm -v", f"npm install -g pnpm@{PNPM_VERSION}", "pnpm -v"], is_windows=is_windows)
     # Task is installed outside the --no-node branch because CI always passes --no-node (pnpm/setup handles pnpm there), and every job still needs the task runner

.devcontainer/manual-setup-deps.py

@@ -169,6 +169,8 @@ def main():  # noqa: C901,PLR0912,PLR0915 # TODO: cleanup into some subfunctions
             pnpm_command = ["pnpm", "install", "--dir", str(env.path)]
             if env_check_lock:
                 pnpm_command[1] = "ci"
+            if generate_lock_file_only:
+                pnpm_command.append("--lockfile-only")
             if is_windows:
                 pwsh = shutil.which("pwsh") or shutil.which("powershell")
                 if not pwsh:

.github/actions/install_deps/action.yml

@@ -92,7 +92,7 @@ runs:
       uses: pnpm/setup@v2.1.0
       with:
         # an empty version makes pnpm/setup read it from the manifest in working-directory instead. Passing both a version and a package.json with a conflicting `packageManager` field is a hard error in pnpm/setup.
-        version: ${{ inputs.working-directory == 'notUsing' && '12.4.2' || '' }}
+        version: ${{ inputs.working-directory == 'notUsing' && '12.9.1' || '' }}
         working-directory: ${{ steps.pnpm-project.outputs.dir }}
         # cache-dependency-path is left at its default, which is the lock file inside working-directory -- the same one the probe above checks
         runtime: node@${{ inputs.node-version }}

.github/reusable_workflows/build-docker-image.yaml

@@ -194,14 +194,14 @@ jobs:
           tags: ${{ steps.calculate-build-context-hash.outputs.full_image_tag }}
 
       - name: Add git sha tag
-        if: ${{ inputs.push-role-name != 'no-push' }}
+        if: ${{ inputs.push-role-name != 'no-push' && github.ref_name == github.event.repository.default_branch }} # feature branch CI runs would otherwise pile hundreds of sha tags onto an unchanged image
         run: |
           GIT_SHA_TAG="git-sha-${{ github.sha }}"
           if aws ecr describe-images --region ${{ steps.parse_ecr_url.outputs.aws_region }} --registry-id=${{ steps.parse_ecr_url.outputs.aws_account_id }} --repository-name=${{ inputs.image_name }} --image-ids imageTag="$GIT_SHA_TAG" > /dev/null 2>&1; then
             echo "Tag $GIT_SHA_TAG already exists in ECR, skipping"
           else
             aws ecr batch-get-image --registry-id=${{ steps.parse_ecr_url.outputs.aws_account_id }} --repository-name=${{ inputs.image_name }} --image-ids imageTag=${{ steps.calculate-build-context-hash.outputs.build_context_tag }} --query 'images[].imageManifest' --output text > manifest.json
-            # Every job on the push path tags the git sha, and jobs that find their image already in ECR no longer serialize on the mutex,
+            # Every default-branch job on the push path tags the git sha, and jobs that find their image already in ECR no longer serialize on the mutex,
             # so another job can apply this same tag between the check above and the put below. ECR reports that as
             # ImageAlreadyExistsException, which by definition means the tag already points at this exact manifest, so it is safe to ignore.
             # ImageTagAlreadyExistsException (a different manifest on an immutable repository) is a real conflict and still fails the step.

.github/workflows/ci.yaml

@@ -149,14 +149,10 @@ jobs:
 
       - name: Delete files from initial repo
         run: |
-          # Delete everything except the folder containing the instantiated template
+          # Delete everything except the folder containing the instantiated template, including dotfiles so that none of them can mask one missing from the instantiated template
           # https://stackoverflow.com/questions/34057047/delete-all-directories-except-one
-          shopt -s extglob
-          rm -rf !(new-template)
-          rm -rf .github # apparently this folder doesn't get removed with the previous command for some reason
-          rm -rf .devcontainer # apparently this folder doesn't get removed with the previous command for some reason
-          rm -rf .claude # apparently this folder doesn't get removed with the previous command for some reason
-          rm -rf .config # apparently this folder doesn't get removed with the previous command for some reason
+          shopt -s extglob dotglob
+          rm -rf !(new-template|.git)
           ls -la
 
       - name: Move the instantiated template into the repo root
@@ -172,7 +168,6 @@ jobs:
 
       - name: install new dependencies
         env:
-          SKIP_PLAYWRIGHT_INSTALL: "1"
           # Provide a fake token so it doesn't attempt to access AWS to generate a new one when the script is run if CodeArtifact is set as the registry
           CODEARTIFACT_AUTH_TOKEN: 'faketoken'
         run: |
@@ -215,13 +210,7 @@ jobs:
       - name: Run pre-commit
         run: |
           # skip devcontainer context hash because the template instantiation may make it different every time
-          SKIP=git-dirty,compute-devcontainer-context-hash pre-commit run -a || PRE_COMMIT_EXIT_CODE=$?
-          if [ -n "$PRE_COMMIT_EXIT_CODE" ]; then
-            echo "Pre-commit failed with exit code $PRE_COMMIT_EXIT_CODE"
-            echo "Showing git diff:"
-            git --no-pager diff
-            exit $PRE_COMMIT_EXIT_CODE
-          fi
+          SKIP=git-dirty,compute-devcontainer-context-hash pre-commit run -a --show-diff-on-failure
 
       - name: Save Pre-commit hooks cache
         if: ${{ steps.cache-probe.outputs.cache-hit != 'true' && steps.cache-recheck.outputs.cache-hit != 'true' }}
@@ -234,7 +223,7 @@ jobs:
         if: ${{ failure() }}
         uses: actions/upload-artifact@v4.4.3
         with:
-          name: pre-commit-log--${{ github.jobs.lint-matrix.name }}
+          name: pre-commit-log--${{ matrix.python-version }}--${{ strategy.job-index }}
           path: "${{ github.workspace }}/.precommit_cache/pre-commit.log"
 
   confirm-on-tagged-copier-template:

.github/workflows/hash_git_files.py

@@ -16,6 +16,10 @@
 DEVCONTAINER_COMMENT_LINE_PREFIX = (
     "  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): "
 )
+# Recognized before it is ever written, so that switching DEVCONTAINER_COMMENT_LINE_PREFIX to it later cannot leave a copy of this script that fails to find the line and inserts a duplicate
+GIT_HOOK_DEVCONTAINER_COMMENT_LINE_PREFIX = (
+    "  // Devcontainer context hash (do not manually edit this, it's managed by a git hook): "
+)
 
 DEVCONTAINER_COMMENT_LINE_SUFFIX = (
     " # spellchecker:disable-line"  # the typos hook can sometimes mess with the hash without this
@@ -116,7 +120,7 @@ def find_devcontainer_hash_line(lines: list[str]) -> tuple[int, str | None]:
             # Check the line above it
             if i > 0:
                 above_line = lines[i - 1]
-                if above_line.startswith(DEVCONTAINER_COMMENT_LINE_PREFIX):
+                if above_line.startswith((DEVCONTAINER_COMMENT_LINE_PREFIX, GIT_HOOK_DEVCONTAINER_COMMENT_LINE_PREFIX)):
                     part_after_prefix = above_line.split(": ", 1)[1]
                     part_before_suffix = part_after_prefix.split("#")[0]
                     current_hash = part_before_suffix.strip()

.github/workflows/pre-commit.yaml

@@ -53,8 +53,6 @@ jobs:
 
       - name: Install latest versions of packages
         uses: ./.github/actions/install_deps
-        env:
-          SKIP_PLAYWRIGHT_INSTALL: "1"
         with:
           python-version: ${{ inputs.python-version }}
           node-version: ${{ inputs.node-version }}
@@ -91,14 +89,7 @@ jobs:
           restore-keys: ${{ env.CACHE_RESTORE_KEY }}
 
       - name: Run pre-commit
-        run: |
-          pre-commit run -a || PRE_COMMIT_EXIT_CODE=$?
-          if [ -n "$PRE_COMMIT_EXIT_CODE" ]; then
-            echo "Pre-commit failed with exit code $PRE_COMMIT_EXIT_CODE"
-            echo "Showing git diff:"
-            git --no-pager diff
-            exit $PRE_COMMIT_EXIT_CODE
-          fi
+        run: pre-commit run -a --show-diff-on-failure
 
       - name: Save Pre-commit hooks cache
         if: ${{ steps.cache-probe.outputs.cache-hit != 'true' && steps.cache-recheck.outputs.cache-hit != 'true' }}

.pre-commit-config.yaml

@@ -30,8 +30,8 @@ repos:
         name: ensure python dependencies are up to date during commits
         stages:
           [pre-commit]
-          # When the install does change things, it exits 0, so needed to check for the phrase 'operations' in stdout in order to cause things pre-commit command to fail
-        entry: python -c "import subprocess,sys; results=subprocess.run(['uv', 'sync', '--frozen'],timeout=360,capture_output=True); print ('stdout- ' + results.stdout.decode('utf-8', 'strict')); print ('stderr- ' + results.stderr.decode('utf-8', 'strict')); sys.exit(int(results.returncode or int('Installed' in results.stdout.decode('utf-8', 'strict'))));"
+          # When the install does change things, it exits 0, so needed to check for the phrase 'Installed' in stderr (where uv writes its progress) in order to cause things pre-commit command to fail
+        entry: python -c "import subprocess,sys; results=subprocess.run(['uv', 'sync', '--frozen'],timeout=360,capture_output=True); print ('stdout- ' + results.stdout.decode('utf-8', 'strict')); print ('stderr- ' + results.stderr.decode('utf-8', 'strict')); sys.exit(int(results.returncode or int('Installed' in results.stderr.decode('utf-8', 'strict'))));"
         # don't pass filenames else the command line sees them twice
         pass_filenames: false
         language: system
@@ -287,7 +287,7 @@ repos:
     hooks:
       - id: pyrefly
         name: pyrefly
-        entry: bash -c "uv run pyrefly check -c ./.config/pyrefly.toml"
+        entry: bash -c "uv run --frozen pyrefly check -c ./.config/pyrefly.toml"
         files: '.+\.py$'
         exclude: |
           (?x)^(

.prekignore

@@ -0,0 +1,8 @@
+# ============== WARNING ==============================================================================
+# File is managed by copier template: gh:LabAutomationAndScreening/copier-base-template.git
+# See .config/.copier-managed-files.json for details.
+#
+# You are welcome to make changes to this file in your repo if they are custom to your project,
+# but if the change should be shared with other projects, please backport it to the template repo.
+# =====================================================================================================
+/template/

README.md

@@ -10,7 +10,7 @@ To create a new repository using this template:
 1. Inside that devcontainer, run `python .devcontainer/install-ci-tooling.py` to install necessary tooling to instantiate the template (you can copy/paste the script from this repo...and you can paste it in the root of the repo if you want)
 1. Delete all files currently in the repository. Optional...but makes it easiest to avoid git conflicts.
 1. Run copier to instantiate the template: `copier copy --trust gh:LabAutomationAndScreening/copier-python-package-template.git .`
-1. Run `SKIP_PLAYWRIGHT_INSTALL=1 python .devcontainer/manual-setup-deps.py --only-create-lock --allow-uv-to-install-python --skip-updating-devcontainer-hash` to generate the lock file(s)
+1. Run `python .devcontainer/manual-setup-deps.py --only-create-lock --allow-uv-to-install-python --skip-updating-devcontainer-hash` to generate the lock file(s)
 1. Stage all files to prepare for commit (`git add .`)
 1. Run `python3 .github/workflows/hash_git_files.py . --for-devcontainer-config-update` to update the hash for your devcontainer file
 1. Commit the changes (optional)

extensions/context.py

@@ -19,12 +19,13 @@ class ContextUpdater(ContextHook):
     def hook(  # noqa: PLR0915 # yes, this is a lot of statements, but it's all just creating the dict
         self, context: dict[Any, Any]
     ) -> dict[Any, Any]:
-        context["uv_version"] = "0.12.15"
-        context["pnpm_version"] = "12.4.2"
+        context["uv_version"] = "0.12.23"
+        context["pnpm_version"] = "12.9.1"
         context["npm_version"] = "11.13.0"
         context["nvm_version"] = "0.40.5"
         context["pre_commit_version"] = "==4.6.2"
         context["identify_version"] = "==2.6.20"
+        context["prek_version"] = "==0.5.5"
         context["task_version"] = "==3.53.1"
         context["pytest_version"] = ">=9.1.1"
         context["pytest_randomly_version"] = ">=5.0.0"
@@ -45,10 +46,10 @@ def hook(  # noqa: PLR0915 # yes, this is a lot of statements, but it's all just
         context["pyinstaller_version"] = ">=6.22.3"
         context["setuptools_version"] = "80.7.1"
         context["strawberry_graphql_version"] = "==0.298.0"
-        context["fastapi_version"] = ">=0.141.1"
+        context["fastapi_version"] = ">=0.142.2"
         context["fastapi_offline_version"] = ">=1.7.7"
         context["starlette_version"] = ">=1.7.0"
-        context["uvicorn_version"] = ">=0.53.0"
+        context["uvicorn_version"] = ">=0.54.0"
         context["lab_auto_pulumi_version"] = ">=0.3.0"
         context["ariadne_codegen_version"] = ">=0.18.0"
         context["pytest_mock_version"] = ">=3.16.0"
@@ -63,7 +64,7 @@ def hook(  # noqa: PLR0915 # yes, this is a lot of statements, but it's all just
         context["pytest_asyncio_version"] = ">=1.4.0"
         context["pytest_timeout_version"] = ">=2.4.0"
         context["pytest_reserial_version"] = ">=0.6.1"
-        context["python_faker_version"] = ">=40.39.0"
+        context["python_faker_version"] = ">=40.41.0"
         context["mutmut_version"] = ">=3.8.0"
         context["pyright_version"] = ">=1.1.414"
         context["pyrefly_version"] = ">=1.3.2"

pyproject.toml

@@ -19,7 +19,7 @@ dependencies = [
     "pytest>=9.1.1",
     "pytest-cov>=7.1.0",
     "pytest-randomly>=5.0.0",
-    "faker>=40.39.0",
+    "faker>=40.41.0",
     "pyrefly>=1.3.2",
     "copier==9.18.2",
     "copier-template-extensions==0.3.3"