Swap pre-commit for prek (#20305)

.github/workflows/add-new-language.yml

@@ -44,13 +44,9 @@ jobs:
         crowdinProjectID: ${{ vars.CROWDIN_PROJECT_ID }}
         crowdinAuthToken: ${{ secrets.CROWDIN_AUTH_TOKEN }}
 
-    - name: Install pre-commit
-      run: |
-        python -m pip install --upgrade pip
-        pip install pre-commit
-        pre-commit install
-
-    # Job will fail if pre-commit checks fail
+    # Linting is handled by the autofix-or-fail workflow, which runs on the push
+    # of the addLanguage branch below (a non-protected branch); no local hook is
+    # installed here.
     - name: Commit language files only
       id: commit
       shell: bash

.github/workflows/autofix.yml

@@ -0,0 +1,106 @@
+# A part of NonVisual Desktop Access (NVDA)
+# Copyright (C) 2026 NV Access Limited, Leonard de Ruijter
+# This file may be used under the terms of the GNU General Public License, version 2 or later, as modified by the NVDA license.
+# For full terms and any additional permissions, see the NVDA license file: https://github.com/nvaccess/nvda/blob/master/copying.txt
+
+# This flow has a single job with two roles:
+#   - Autofix: on push events, run the fixer hooks (the "autofix" group), commit
+#     any fixes back to the branch, and push them.
+#   - Gate: on every event, run all hooks (minus the heavy/env-bound ones that
+#     have their own dedicated jobs in testAndPublish.yml) as a blocking check.
+#
+# The autofix step needs write access. On fork `pull_request` events GitHub
+# downgrades the token to read-only, so autofix is guarded to push events only
+# (it runs in a contributor's fork when they enable Actions, and on NV Access
+# branches). On a fork PR with Actions disabled nothing gets fixed, so
+# any lint issue fails the gate, forcing a manual fix or enabling fork Actions.
+
+name: Autofix or fail
+
+on:
+  push:
+    # Never auto-fix or push to the protected branches; PRs targeting them are
+    # handled by the pull_request trigger below.
+    branches-ignore:
+      - master
+      - beta
+      - rc
+  pull_request:
+    branches:
+      - master
+      - beta
+      - rc
+permissions:
+  contents: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  autofix:
+    name: Auto-fix and lint gate
+    runs-on: windows-2025-vs2026
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+      with:
+        submodules: true
+    - name: Set up python
+      uses: actions/setup-python@v6
+      with:
+        # Keep in sync with defaultPythonVersion in testAndPublish.yml.
+        python-version: '3.13.13'
+    - name: Install the latest version of uv
+      uses: astral-sh/setup-uv@v7
+      with:
+        activate-environment: "false"
+    # prek is run via `uvx` (an ephemeral, isolated tool run) rather than
+    # `uv run`. `uv run` would sync the project environment and could silently
+    # regenerate uv.lock as a side effect, masking a genuinely stale lock and
+    # causing spurious mid-run failures. `uvx` touches no project state, so the
+    # uv-lock hook itself is what gates lock staleness.
+    # Autofix only on push events (write token), and never react to the bot's
+    # own auto-fix commit. A commit pushed with this repo's GITHUB_TOKEN does
+    # not re-trigger this repo's own push workflow, so the fix commit cannot
+    # loop back into another autofix run here; the actor guard below just
+    # covers the rare manual re-run case too. (Note: on a fork PR the fix
+    # commit DOES start a fresh pull_request run on the base repo, since that
+    # is a different repository - but it lands as "action required" pending
+    # maintainer approval because the bot is the triggering actor.)
+    - name: Apply prek auto-fixes
+      if: github.event_name == 'push' && github.actor != 'github-actions[bot]'
+      shell: bash
+      env:
+        REF_NAME: ${{ github.ref_name }}
+      run: |
+        # Fixers exit non-zero when they change files; that is expected here, so
+        # do not let it fail the job.
+        uvx prek run --group autofix --all-files || true
+        if ! git diff --quiet; then
+          git config user.name "github-actions"
+          git config user.email "github-actions@github.com"
+          git add -A
+          git commit -m "Auto-fix: apply prek fixes"
+          # Push via an explicit refspec so this works even if checkout left us
+          # in a detached HEAD state.
+          git push origin HEAD:"$REF_NAME"
+        fi
+    # Blocking lint gate: runs on every event. The 6 skipped hooks are the
+    # heavy / environment-bound checks that have their own dedicated jobs in
+    # testAndPublish.yml. A non-zero exit here fails the job.
+    # Run via prek-action (not `uvx prek`) so prek's hook environments are
+    # cached across runs. The action installs prek standalone, so it does not
+    # touch uv.lock; on push events the gate runs against the tree already
+    # fixed by the autofix step above.
+    - name: Lint gate
+      uses: j178/prek-action@v2
+      with:
+        extra-args: >-
+          --all-files
+          --skip checkPo
+          --skip scons-source
+          --skip checkPot
+          --skip unitTest
+          --skip licenseCheck
+          --skip pyright

.github/workflows/prekAutoUpdate.yml

@@ -0,0 +1,49 @@
+# A part of NonVisual Desktop Access (NVDA)
+# Copyright (C) 2026 NV Access Limited, Leonard de Ruijter
+# This file may be used under the terms of the GNU General Public License, version 2 or later, as modified by the NVDA license.
+# For full terms and any additional permissions, see the NVDA license file: https://github.com/nvaccess/nvda/blob/master/copying.txt
+
+name: Prek auto-update
+
+on:
+  schedule:
+    # Monthly, at midnight on the first day of the month.
+    - cron: '0 0 1 * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  prekAutoUpdate:
+    name: Prek auto-update
+    # Upstream-only maintenance task. Forks enable Actions for the autofix
+    # workflow; without this guard they would also run this schedule and open
+    # spurious auto-update PRs against their own fork.
+    if: github.repository == 'nvaccess/nvda'
+    runs-on: ubuntu-latest
+    steps:
+      # Auto-update only rewrites hook revisions in prek.toml,
+      # so submodule content is not needed.
+      - name: Checkout code
+        uses: actions/checkout@v6
+      # Install prek as a standalone binary; auto-update only rewrites hook
+      # revisions in prek.toml, so neither uv nor the project environment is
+      # needed. The cargo-dist installer adds prek to $GITHUB_PATH.
+      - name: Install prek
+        run: curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/latest/download/prek-installer.sh | sh
+      # --cooldown-days skips releases younger than 3 days, avoiding pinning to
+      # a freshly published (and potentially yanked/broken) hook revision.
+      - name: Run prek auto-update
+        run: prek auto-update --cooldown-days 3
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          branch: prek-autoupdate
+          delete-branch: true
+          title: Prek auto-update
+          commit-message: Prek auto-update
+          author: github-actions <github-actions@github.com>
+          body: |
+            Automated update of prek hook revisions in `prek.toml`.

.github/workflows/testAndPublish.yml

@@ -184,14 +184,14 @@ jobs:
         architecture: ${{ env.defaultArch }}
     - name: Install the latest version of uv
       uses: astral-sh/setup-uv@v7
-    - name: Run pre-commit
+    - name: Run prek
       run: |
         # Ensure uv environment is up to date.
-        # If the uv environment is outdated, running pre-commit will trigger uv to generate a uv.lock file,
-        # which causes checkPo to fail without clear errors because pre-commit fails when files are changed during its run.
-        uv run pre-commit run uv-lock --all-files
-        # Run pre-commit on the translations
-        uv run pre-commit run checkPo --all-files
+        # If the uv environment is outdated, running prek will trigger uv to generate a uv.lock file,
+        # which causes checkPo to fail without clear errors because prek fails when files are changed during its run.
+        uv run prek run uv-lock --all-files
+        # Run prek on the translations
+        uv run prek run checkPo --all-files
     - name: Add job summary
       if: ${{ failure() }}
       shell: bash