CI: Add GitHub Actions workflow to run pre-commit checks on push and PR

[Xarlos89]

Context

The repo has a .pre-commit-config.yaml that defines several quality gates, but they only run locally if a developer has pre-commit installed. There is currently no CI to enforce these checks on pushed commits or pull requests, so bad commits can land undetected.

What pre-commit currently checks

Hook	What it does
check-merge-conflict	Fails if merge conflict markers are present
check-shebang-scripts-are-executable	Ensures shebang scripts have execute bit
end-of-file-fixer	Ensures files end with a newline
check-yaml / check-json / check-toml	Validates config file syntax
bandit	Static security analysis for Python
ruff check --fix	Python linting
ruff format	Python formatting

Proposed workflow

Add .github/workflows/ci.yml that triggers on push and pull_request to master:

name: CI

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

jobs:
  pre-commit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - uses: pre-commit/action@v3.0.1

The pre-commit/action action automatically reads .pre-commit-config.yaml and runs all configured hooks — no duplication needed.

Notes

• The ruff --fix and end-of-file-fixer hooks mutate files. In CI they should run in check-only mode (or the workflow should fail rather than auto-commit). The pre-commit/action action runs hooks without committing changes back, so a formatting violation will correctly fail the job.
• Bandit is already pinned to 1.8.6 and Ruff to v0.15.15 in the config — no extra pinning needed in the workflow.