ci: standardise pre-commit, lint and release tooling

.github/workflows/linter.yml

@@ -1,4 +1,3 @@
-
 name: Linters
 
 on:
@@ -9,51 +8,55 @@ permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: linters-csf_tz-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
-  linter:
-    name: 'Frappe Linter'
+  semgrep:
+    name: Frappe Linter
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
 
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
+          python-version: "3.11"
           cache: pip
-      - name: Install pre-commit
-        run: pip install pre-commit
-      - name: Run pre-commit on changed files
-        run: |
-          pre-commit run \
-            --show-diff-on-failure \
-            --color=always \
-            --from-ref origin/${{ github.base_ref }} \
-            --to-ref HEAD
 
       - name: Download Semgrep rules
         run: git clone --depth 1 https://github.com/frappe/semgrep-rules.git frappe-semgrep-rules
 
+      - name: Install Semgrep
+        run: pip install semgrep
+
+      # Blocking: real bugs and security issues only
       - name: Run Semgrep rules
         run: |
-          pip install semgrep
-          semgrep ci --config ./frappe-semgrep-rules/rules --config r/python.lang.correctness
+          semgrep scan --config ./frappe-semgrep-rules/rules \
+            --config r/python.lang.security \
+            --severity=ERROR --error csf_tz
+
+      # Informational: style and i18n warnings, never fails the build
+      - name: Semgrep warnings (non-blocking)
+        if: always()
+        run: |
+          semgrep scan --config ./frappe-semgrep-rules/rules \
+            --config r/python.lang.security \
+            --severity=WARNING csf_tz || true
 
   deps-vulnerable-check:
-    name: 'Vulnerable Dependency Check'
+    name: Vulnerable Dependency Check
     runs-on: ubuntu-latest
 
     steps:
+      - uses: actions/checkout@v4
+
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
-
-      - uses: actions/checkout@v4
+          python-version: "3.11"
 
       - name: Cache pip
         uses: actions/cache@v4
@@ -67,5 +70,4 @@ jobs:
       - name: Install and run pip-audit
         run: |
           pip install pip-audit
-          cd ${GITHUB_WORKSPACE}
           pip-audit --desc on .

.github/workflows/modernize-frappe.yml

@@ -0,0 +1,12 @@
+name: Modernize Frappe Packaging
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  modernize:
+    uses: Aakvatech-Limited/frappe-maintenance/.github/workflows/modernize-frappe-reusable.yml@main

.github/workflows/pre-commit.yml

@@ -0,0 +1,31 @@
+name: Pre-commit
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: precommit-csf_tz-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pre-commit:
+    name: pre-commit
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - uses: pre-commit/action@v3.0.1

.github/workflows/semantic-commits.yml

@@ -14,6 +14,7 @@ jobs:
   commitlint:
     name: Check Commit Messages
     runs-on: ubuntu-latest
+
     steps:
       - uses: actions/checkout@v4
         with:

.gitignore

@@ -59,3 +59,6 @@ build/
 coverage/
 *.lcov
 .nyc_output
+
+# Semgrep rules cloned by pre-commit / CI
+frappe-semgrep-rules/