add stuff

Author: anthony-nhs

.gitallowed

@@ -0,0 +1,6 @@
+id-token: write
+password: \${{secrets\.GITHUB_TOKEN}}
+token: ?"?\$\{\{\s*secrets\.GITHUB_TOKEN\s*\}\}"?
+github-token: ?"?\$\{\{\s*secrets\.GITHUB_TOKEN\s*\}\}"?
+token: ?"?\$\{\{\s*secrets\.DEPENDABOT_TOKEN\s*\}\}"?
+\.gitallowed

.github/dependabot.yml

@@ -38,20 +38,3 @@ updates:
     versioning-strategy: increase
     cooldown:
       default-days: 7
-  ###################################
-  # NPM workspace  ##################
-  ###################################
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "friday"
-      time: "22:00" # UTC
-    open-pull-requests-limit: 20
-    versioning-strategy: increase
-    commit-message:
-      prefix: "Upgrade: [dependabot] - "
-    registries:
-      - npm-github
-    cooldown:
-      default-days: 7

.pre-commit-config.yaml

@@ -0,0 +1,64 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: check-merge-conflict
+        name: Check for merge conflict strings
+
+      - id: end-of-file-fixer
+        name: Fix missing newline at the end of files
+
+      - id: check-shebang-scripts-are-executable
+        name: Check shell scripts are executable
+        files: \.(sh)$
+
+      - id: check-yaml
+        name: Check pipelines configuration
+        files: ^(.github)
+
+  - repo: https://github.com/pycqa/flake8
+    rev: "7ef0350a439c93166bc8ba89fcc3de6a9a664e6c"
+    hooks:
+      - id: flake8
+
+  - repo: local
+    hooks:
+      - id: zizmor-action
+        name: Check action.yml
+        entry: zizmor
+        args: ["action.yml"]
+        language: system
+        files: action.yml
+        pass_filenames: false
+
+      - id: lint-githubactions
+        name: Lint github actions
+        entry: make
+        args: ["actionlint"]
+        language: system
+        files: ^.github
+        types_or: [yaml]
+        pass_filenames: false
+
+      - id: lint-githubaction-scripts
+        name: Lint github action scripts
+        entry: make
+        args: ["shellcheck"]
+        language: system
+        files: ^.github/scripts
+        types_or: [sh, shell]
+        pass_filenames: false
+
+  - repo: local
+    hooks:
+      - id: git-secrets
+        name: Git Secrets
+        description: git-secrets scans commits, commit messages, and --no-ff merges to prevent adding secrets into your git repositories.
+        entry: bash
+        args:
+          - -c
+          - "git-secrets --pre_commit_hook"
+        language: system
+
+fail_fast: true
+default_stages: [pre-commit]

Makefile

@@ -1,8 +1,11 @@
 .PHONY: install install-node compile lint test
-install:
-	echo "Nothing to install"
+install: install-node install-python install-hooks
 install-node:
 	echo "Nothing to install"
+install-python:
+	poetry install
+install-hooks: install-python
+	poetry run pre-commit install --install-hooks --overwrite
 compile:
 	echo "Nothing to compile"
 lint:

poetry.lock

@@ -0,0 +1,3 @@
+[virtualenvs]
+in-project = true
+prefer-active-python = true

poetry.toml

@@ -0,0 +1,24 @@
+
+[project]
+python = "^3.14"
+name = "eps-update-devcontainer"
+
+[tool.poetry]
+name = "eps-update-devcontainer"
+version = "0.0.1-alpha"
+description = "EPS update devcontainer"
+license = "MIT"
+authors = [
+    "EPS"
+]
+readme = "README.md"
+repository = "https://github.com/NHSDigital/eps-update-devcontainer"
+package-mode = false
+
+[tool.poetry.dependencies]
+python = "^3.14"
+
+[tool.poetry.scripts]
+
+[tool.poetry.group.dev.dependencies]
+pre-commit = "^4.5.1"