build: integrate prek

.github/dependabot.yml

@@ -26,6 +26,18 @@ updates:
     cooldown:
       default-days: 7
 
+  # python dependencies in /dev-tools
+  - package-ecosystem: uv
+    directory: /dev-tools/
+    open-pull-requests-limit: 25
+    schedule:
+      interval: monthly
+    commit-message:
+      prefix: build(deps)
+    labels: [dependencies, skip-changelog]
+    cooldown:
+      default-days: 7
+
   - package-ecosystem: gradle
     directory: /
     open-pull-requests-limit: 25

.github/problem-matchers/actionlint-matcher.json

@@ -0,0 +1,17 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "actionlint",
+      "pattern": [
+        {
+          "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4,
+          "code": 5
+        }
+      ]
+    }
+  ]
+}

.github/problem-matchers/ruff-check.json

@@ -0,0 +1,17 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "ruff-check",
+      "pattern": [
+        {
+          "code": 4,
+          "column": 3,
+          "file": 1,
+          "line": 2,
+          "message": 5,
+          "regexp": "^Error: (.*):(\\d+):(\\d+): (\\w+) (.*)$"
+        }
+      ]
+    }
+  ]
+}

.github/problem-matchers/ruff-format.json

@@ -0,0 +1,20 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "ruff-format",
+      "pattern": [
+        {
+          "code": 2,
+          "column": 5,
+          "endColumn": 7,
+          "endLine": 6,
+          "file": 3,
+          "line": 4,
+          "message": 8,
+          "regexp": "^(?:(error|warning|notice))\\s+title=([^,]+),file=([^,]+),line=(\\d+),col=(\\d+)(?:,endLine=(\\d+))?(?:,endColumn=(\\d+))?::(.+)$",
+          "severity": 1
+        }
+      ]
+    }
+  ]
+}

.github/problem-matchers/shellcheck-gcc.json

@@ -0,0 +1,18 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "shellcheck-gcc",
+      "pattern": [
+        {
+          "regexp": "^(.+):(\\d+):(\\d+):\\s(note|warning|error):\\s(.*)\\s\\[(SC\\d+)\\]$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "severity": 4,
+          "message": 5,
+          "code": 6
+        }
+      ]
+    }
+  ]
+}

.github/workflows/actions.yml

@@ -1,35 +1,14 @@
 ---
 # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
-name: Validate Actions
+name: Validate Actions (online checks)
 on:
   workflow_dispatch:
-  pull_request:
-    paths:
-      - '.github/**'
-  push:
-    branches:
-      - main
-    paths:
-      - '.github/**'
   schedule:
     - cron: '22 2 * * *'
 
 permissions: {}
 
 jobs:
-  actionlint:
-    name: Run actionlint
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          persist-credentials: false
-      - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
-      - name: Check workflows with actionlint
-        run: uvx --from actionlint-py actionlint -color
   zizmor:
     name: Run zizmor
     runs-on: ubuntu-latest
@@ -47,8 +26,6 @@ jobs:
         run: uvx zizmor --pedantic --format=sarif . > results.sarif
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # run offline for branches and PRs to avoid rate limits
-          ZIZMOR_OFFLINE: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}
       - name: Upload SARIF file
         uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
         with:

.github/workflows/run-checks-all.yml

@@ -25,11 +25,47 @@ env:
 # the other runs all tests without other validation checks.
 
 jobs:
+  # Fast repository check
+  lint:
+    name: lint repository
+    runs-on: ubuntu-slim
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Configure problem matchers
+        run: |
+          echo "::add-matcher::.github/problem-matchers/actionlint-matcher.json"
+          echo "::add-matcher::.github/problem-matchers/ruff-check.json"
+          echo "::add-matcher::.github/problem-matchers/ruff-format.json"
+          echo "::add-matcher::.github/problem-matchers/shellcheck-gcc.json"
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
+        with:
+          version: "0.9.27"
+          enable-cache: true
+          prune-cache: false
+          save-cache: ${{ github.event_name != 'pull_request' }}
+          cache-dependency-glob: dev-tools/uv.lock
+          cache-suffix: dev-tools
+
+      - name: Run prek
+        run: uv run prek --all-files --show-diff-on-failure
+        env:
+          UV_PROJECT: dev-tools
+          UV_FROZEN: "1"
+
 
   # This runs all validation checks without tests.
   checks:
     name: checks without tests (JDK ${{ matrix.java }} on ${{ matrix.os }})
     timeout-minutes: 15
+    needs: lint
 
     strategy:
       matrix:
@@ -54,12 +90,6 @@ jobs:
         if: ${{ ! startsWith(matrix.os, 'windows') }}
         uses: ./.github/actions/eclint
 
-      - name: Install ast-grep
-        if: ${{ ! startsWith(matrix.os, 'windows') }}
-        run: |
-          npm -g i @ast-grep/cli
-          echo "lucene.tool.ast-grep=ast-grep" >> build-options.local.properties
-
       - name: Run gradle check (without tests)
         run: ./gradlew check -x test "-Ptask.times=true"
 
@@ -68,6 +98,7 @@ jobs:
   tests:
     name: tests (JDK ${{ matrix.java }} on ${{ matrix.os }})
     timeout-minutes: 30
+    needs: lint
 
     strategy:
       matrix: