Merge 6a511c4331 into 41c5b9677a

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.0 to 4.32.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](b20883b0cd...45cbd0c69e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/dependencies.yml

@@ -13,12 +13,12 @@ jobs:
       contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - name: Authenticate as @ohmyzsh
@@ -28,7 +28,7 @@ jobs:
           app-id: ${{ secrets.OHMYZSH_APP_ID }}
           private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }}
       - name: Setup Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
           cache: "pip"

.github/workflows/installer.yml

@@ -26,12 +26,12 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
         with:
           egress-policy: audit
 
       - name: Set up git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install zsh
         if: runner.os == 'Linux'
         run: sudo apt-get update; sudo apt-get install zsh
@@ -47,12 +47,12 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install Vercel CLI
         run: npm install -g vercel
       - name: Setup project and deploy

.github/workflows/main.yml

@@ -24,12 +24,12 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
         with:
           egress-policy: audit
 
       - name: Set up git repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install zsh
         run: sudo apt-get update; sudo apt-get install zsh
       - name: Check syntax

.github/workflows/project.yml

@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh

.github/workflows/scorecard.yml

@@ -36,12 +36,12 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
         with:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
+        uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
         with:
           sarif_file: results.sarif

plugins/pre-commit/README.md

@@ -17,3 +17,50 @@ plugins=(... pre-commit)
 | prcr    | `pre-commit run`                       | The `pre-commit run` command                           |
 | prcra   | `pre-commit run --all-files`           | Run pre-commit hooks on all files                      |
 | prcrf   | `pre-commit run --files`               | Run pre-commit hooks on a given list of files          |
+
+
+## Auto install `pre-commit` hook
+
+This plugin can auto install the defined pre-commit hooks from a `.pre-commit-config.yaml`, if it detects that file in your current working dir.
+
+## Settings
+
+#### ZSH_PRE_COMMIT_AUTO_INSTALL
+
+Set `ZSH_PRE_COMMIT_AUTO_INSTALL` to control auto install.
+
+- `prompt` (default) will prompt on a per-directory basis
+- `off` will turn the feature off
+- any other setting will auto install without prompting.
+
+```zsh
+# in ~/.zshrc, before Oh My Zsh is sourced:
+ZSH_PRE_COMMIT_AUTO_INSTALL=prompt|off|anything_else_is_on
+```
+
+#### ZSH_PRE_COMMIT_CONFIG_FILE
+
+The plugin will default to use `.pre-commit-config.yaml`.
+
+You can override this with the variable `$ZSH_PRE_COMMIT_CONFIG_FILE`, like so:
+
+```zsh
+# in ~/.zshrc, before Oh My Zsh is sourced:
+ZSH_PRE_COMMIT_CONFIG_FILE=.my-custom-pre-commit-config.yaml
+```
+
+#### ZSH_PRE_COMMIT_INSTALLED_LIST
+
+The default behavior of the plugin is to prompt for installation. It will also remember it did so, which will be cached in a list to be defined by: `$ZSH_PRE_COMMIT_INSTALLED_LIST`.
+
+The details for the three options are:
+- **Y**es: install and write the current dir into the list.
+- **A**sk again for this directory: don't do anything now.
+- **N**ever ask again for this directory: don't install, but write the current dir into the list.
+
+By default, this list will be here `${ZSH_CACHE_DIR:-$ZSH/cache}/pre-commit-installed.list"`, but you can set the filename of that list to whatever you want:
+
+```zsh
+# in ~/.zshrc, before Oh My Zsh is sourced:
+ZSH_PRE_COMMIT_INSTALLED_LIST=/path/to/list
+```

plugins/pre-commit/pre-commit.plugin.zsh

@@ -6,3 +6,74 @@ alias prcau='pre-commit autoupdate'
 alias prcr='pre-commit run'
 alias prcra='pre-commit run --all-files'
 alias prcrf='pre-commit run --files'
+
+# Auto install
+
+## Settings
+
+# Filename of the pre-commit file to look for
+: ${ZSH_PRE_COMMIT_CONFIG_FILE:=.pre-commit-config.yaml}
+
+# Path to the file containing installed paths
+: ${ZSH_PRE_COMMIT_INSTALLED_LIST:="${ZSH_CACHE_DIR:-$ZSH/cache}/pre-commit-installed.list"}
+
+# Default setting for auto install to prompt
+: ${ZSH_PRE_COMMIT_AUTO_INSTALL:="prompt"}
+
+## Functions
+
+autoload -U add-zsh-hook
+if [[ "$ZSH_PRE_COMMIT_AUTO_INSTALL" == "off" ]]; then
+  add-zsh-hook -d chpwd auto_install_pre_commit
+  return
+fi
+
+auto_install_pre_commit() {
+  if [[ ! -f "$ZSH_PRE_COMMIT_CONFIG_FILE" ]]; then
+    return
+  fi
+
+  local dirpath="${PWD:A}"
+
+  # early return if already installed
+  if command grep -Fx -q "$dirpath" "$ZSH_PRE_COMMIT_INSTALLED_LIST" &>/dev/null; then
+    return
+  fi
+
+  if [[ "$ZSH_PRE_COMMIT_AUTO_INSTALL" == "prompt" ]]; then
+    local confirmation
+
+    touch "$ZSH_PRE_COMMIT_INSTALLED_LIST"
+
+    # get cursor column and print new line before prompt if not at line beginning
+    local column
+    echo -ne "\e[6n" > /dev/tty
+    read -t 1 -s -d R column < /dev/tty
+    column="${column##*\[*;}"
+    [[ $column -eq 1 ]] || echo
+
+    # print same-line prompt and output newline character if necessary
+    echo -n "pre-commit: found '$ZSH_PRE_COMMIT_CONFIG_FILE' file. Install hooks? ([Y]es/[A]sk again/[N]ever)"
+    read -k 1 confirmation
+    [[ "$confirmation" = $'\n' ]] || echo
+
+    # check input
+    case "$confirmation" in
+      [yY]) ;; # yes
+      [aA]) return ;; # ask again
+      [nN]) echo "$dirpath" >> "$ZSH_PRE_COMMIT_INSTALLED_LIST"; return ;; # never ask again
+      *) return ;; # interpret anything else as ask again
+    esac
+  fi
+
+  # check if pre-commit is installed
+  if ! type pre-commit > /dev/null; then
+    echo "You need to install pre-commit first. https://pre-commit.com/#install can help you out.";
+    return
+  fi
+
+  pre-commit install && echo "$dirpath" >> "$ZSH_PRE_COMMIT_INSTALLED_LIST"
+}
+
+add-zsh-hook chpwd auto_install_pre_commit
+auto_install_pre_commit