ci: adopt the standard pre-commit, ruff, and semgrep toolchain

.deepsource.toml

@@ -6,4 +6,3 @@ enabled = true
 
   [analyzers.meta]
   runtime_version = "3.x.x"
-

.github/workflows/linter.yml

@@ -8,51 +8,55 @@ permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: linters-propms-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
-  linter:
-    name: 'Frappe Linter'
+  semgrep:
+    name: Frappe Linter
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
 
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
+          python-version: "3.11"
           cache: pip
-      - name: Install pre-commit
-        run: pip install pre-commit
-      - name: Run pre-commit on changed files
-        run: |
-          pre-commit run \
-            --show-diff-on-failure \
-            --color=always \
-            --from-ref origin/${{ github.base_ref }} \
-            --to-ref HEAD
 
       - name: Download Semgrep rules
         run: git clone --depth 1 https://github.com/frappe/semgrep-rules.git frappe-semgrep-rules
 
+      - name: Install Semgrep
+        run: pip install semgrep
+
+      # Blocking: real bugs and security issues only
       - name: Run Semgrep rules
         run: |
-          pip install semgrep
-          semgrep ci --config ./frappe-semgrep-rules/rules --config r/python.lang.correctness
+          semgrep scan --config ./frappe-semgrep-rules/rules \
+            --config r/python.lang.security \
+            --severity=ERROR --error propms
+
+      # Informational: style and i18n warnings, never fails the build
+      - name: Semgrep warnings (non-blocking)
+        if: always()
+        run: |
+          semgrep scan --config ./frappe-semgrep-rules/rules \
+            --config r/python.lang.security \
+            --severity=WARNING propms || true
 
   deps-vulnerable-check:
-    name: 'Vulnerable Dependency Check'
+    name: Vulnerable Dependency Check
     runs-on: ubuntu-latest
 
     steps:
+      - uses: actions/checkout@v4
+
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
-
-      - uses: actions/checkout@v4
+          python-version: "3.11"
 
       - name: Cache pip
         uses: actions/cache@v4
@@ -66,5 +70,4 @@ jobs:
       - name: Install and run pip-audit
         run: |
           pip install pip-audit
-          cd ${GITHUB_WORKSPACE}
           pip-audit --desc on .

.github/workflows/pre-commit.yml

@@ -0,0 +1,31 @@
+name: Pre-commit
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: precommit-propms-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pre-commit:
+    name: pre-commit
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - uses: pre-commit/action@v3.0.1

.github/workflows/semantic-commits.yml

@@ -0,0 +1,31 @@
+name: Semantic Commits
+
+on:
+  pull_request: {}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: commitcheck-propms-${{ github.event.number }}
+  cancel-in-progress: true
+
+jobs:
+  commitlint:
+    name: Check Commit Messages
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 200
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          check-latest: true
+
+      - name: Check commit messages
+        run: |
+          npm install @commitlint/cli @commitlint/config-conventional conventional-changelog-conventionalcommits
+          npx commitlint --verbose --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }}