ci(prek): protect main and versions/ branches from direct commits

.pre-commit-config.yaml

@@ -28,6 +28,11 @@ repos:
       - id: mixed-line-ending
       - id: name-tests-test
         args: ["--pytest-test-first"]
+      - id: no-commit-to-branch
+        args: ["--branch", "main", "--pattern", "^versions/.*"]
+        always_run: true
+        # Restrict to pre-commit so a push (e.g. a release tag) isn't mistaken for a commit.
+        stages: [pre-commit]
       - id: trailing-whitespace
 
   - repo: https://github.com/pre-commit/pygrep-hooks

noxfile.py

@@ -5,6 +5,7 @@
 """Nox setup."""
 
 import argparse
+import os
 import shutil
 from enum import StrEnum, auto
 from pathlib import Path
@@ -71,8 +72,11 @@ def lint(s: nox.Session, /) -> None:
 
 @session(uv_groups=["lint"], reuse_venv=True)
 def precommit(s: nox.Session, /) -> None:
-    """Run prek."""
-    s.run("prek", "run", "--all-files", *s.posargs)
+    """Run the pre-commit hooks (via prek)."""
+    # Not a real commit -- no-commit-to-branch would always fail here.
+    # Merge into any SKIP already set, rather than clobber it.
+    skip = ",".join(filter(None, [os.environ.get("SKIP"), "no-commit-to-branch"]))
+    s.run("prek", "run", "--all-files", *s.posargs, env={"SKIP": skip})
 
 
 @session(uv_groups=["typecheck"], uv_extras=["all"], reuse_venv=True)