COMP: Enable pre-commit-hooks safety nets on release-5.4

[hjmjohnson]

Enables the pre-commit-hooks safety nets on release-5.4, byte-identical to main at rev v5.0.0. Follow-up to #6837, implementing #6837 (comment).

The first four commits clear the violations these hooks report, one class per commit, so the final commit that turns them on is a no-op against the tree. Formatter hooks — clang-format, gersemi, black, spell check — are deliberately not included: those reformat the branch rather than guard it.

Commits

Commit	Change
STYLE: Pin a GitHub link…	1 line — blob/master/… → a commit SHA (check-vcs-permalinks)
STYLE: Mark VCL_ModernizeNaming.py executable…	mode only, 0 content lines (check-shebang-scripts-are-executable)
STYLE: Add missing end-of-file newlines	11 files (end-of-file-fixer)
STYLE: Remove trailing whitespace	6 files (trailing-whitespace)
COMP: Enable the pre-commit-hooks safety nets…	.pre-commit-config.yaml only

No source file that ITK formats is touched: every changed file is hooks.style: unspecified except one CMakeLists.txt (cmakeformat), and zero files carry the clangformat attribute — verified with git check-attr. clang-format.bash --tracked selects only clangformat files, so the lint job has nothing to act on here.

Verification

All 21 hooks pass against the final tree:

check for added large files ....... Passed      detect destroyed symlinks ......... Passed
check python ast .................. Passed      detect private key ................ Passed
check for case conflicts .......... Passed      fix end of files .................. Passed
check illegal windows names ....... Skipped     forbid new submodules ............. Skipped
check json ........................ Passed      forbid submodules ................. Skipped
check for merge conflicts ......... Passed      mixed line ending ................. Passed
check toml ........................ Passed      python tests naming ............... Skipped
check vcs permalinks .............. Passed      don't commit to branch ............ Passed
check xml ......................... Passed      trim trailing whitespace .......... Passed
check yaml ........................ Passed
check that scripts with shebangs are executable ... Passed
debug statements (python) ......... Passed

The four skips are "no files to check" on this branch, not failures.

Before these fixes, four hooks failed: check-vcs-permalinks, check-shebang-scripts-are-executable, end-of-file-fixer, and trailing-whitespace. The other 17 passed unmodified — release-5.4 was already clean against them.

Note on the shebang commit

Utilities/Maintenance/VCL_ModernizeNaming.py starts with #!python, the Windows py-launcher form. Only the file mode changes; the content is untouched. If the preference is to drop the shebang instead, say so and I will swap that commit.

[dzenanz]

Looks good on a glance.

[greptile-apps]

Greptile Summary

The executable-bit update leaves Utilities/Maintenance/VCL_ModernizeNaming.py unable to run directly because its interpreter line cannot be resolved. The remaining issue is non-blocking, but the script's executable entry point should be fixed before relying on direct invocation.

Confidence Score: 4/5

Safe to merge with a non-blocking maintenance-script usability issue; direct execution of the affected script will fail until its interpreter line is corrected or its executable bit is removed.

The direct executable path was exercised and consistently failed before the Python program started. No higher-impact failures were established.

Files Needing Attention: Utilities/Maintenance/VCL_ModernizeNaming.py

T-Rex Logs

What T-Rex did

• T-Rex produced a proof for a posted P2 finding and attached the shell-script artifact used to generate it.
• T-Rex reviewed the P2 finding proof and checked the accompanying log with a URL to the related artifacts.
• T-Rex attempted to validate the VCL_ModernizeNaming.py call, observed ENOENT when invoking the script, and referenced the uploaded validation script trex-artifacts/vcl-modernize-naming-validation.sh and its post-run log.

_{Ran code and verified through T-Rex}

Comments Outside Diff (2)

1. Utilities/Maintenance/VCL_ModernizeNaming.py, line 1 (link)

   Fix executable script

   This file is now executable, but its #!python interpreter line cannot resolve an interpreter for direct POSIX execution. Running ./Utilities/Maintenance/VCL_ModernizeNaming.py fails before the script starts, so callers must know to invoke Python explicitly. Use a portable interpreter line, or remove the executable bit if direct execution is not intended. This is non-blocking, but it makes the advertised executable entry point unusable.

   Artifacts

   
   

   Evidence from the check

   • Authored shell validator checks the target's mode and shebang, then performs controlled shell and direct-exec invocations; it is the executed validation source.

   Command output from the check

   • Captured output from executing the validator in `/home/user/repo` shows mode 755, `#!python`, shell exit 127, and direct `execve` ENOENT; the direct executable entry point is broken.

   

   _{Ran code and verified through T-Rex}

2. General comment

   Executable maintenance script has an unresolvable python interpreter

   • Bug
     • The script is executable (755), but direct invocation of ./Utilities/Maintenance/VCL_ModernizeNaming.py fails with exit code 127. A direct kernel-level execve probe returns ENOENT, so the script never reaches its Python logic.
   • Cause
     • Its first line is #!python. The direct-exec shebang interpreter is not resolved through the caller's PATH; python is not an absolute interpreter pathname or a portable resolver invocation.
   • Fix
     • Use a portable executable shebang, such as #!/usr/bin/env python3 (or the project-required absolute Python interpreter path), and retain executable mode only if direct invocation is intended.

   _{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "COMP: Enable the pre-commit-hooks safety..." | Re-trigger Greptile}

[hjmjohnson]

The two P2 greptile findings will be addressed in a set of followup PRs against main and release-5.4