cpp-linter · 2bndy5 · Sep 4, 2025 · Sep 4, 2025 · Sep 4, 2025 · Sep 4, 2025
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -8,15 +8,15 @@ updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     groups:
       actions:
         patterns:
           - "*"
   - package-ecosystem: uv
     directory: /
     schedule:
-      interval: "daily"
+      interval: "monthly"
     groups:
       uv-pip:
         patterns:

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -9,6 +9,10 @@ on:
 
 jobs:
   codeql:
+    permissions:
+      actions: read
+      security-events: write
+      contents: read
     uses: cpp-linter/.github/.github/workflows/codeql.yml@main
     with:
       language: python
diff --git a/.github/workflows/build-docs.yml → .github/workflows/docs.yml b/.github/workflows/build-docs.yml → .github/workflows/docs.yml
@@ -9,10 +9,10 @@ jobs:
       path_to_doc: docs/_build/html
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@557e51de59eb14aaaba2ed9621916900a91d50c6 # v6.6.1
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -21,15 +21,15 @@ jobs:
         run: uvx nox -s docs
 
       - name: Upload docs build as artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ github.event.repository.name }}_docs
           path: ${{ github.workspace }}/${{ env.path_to_doc }}
 
       - name: Upload to github pages
         # only publish doc changes from main branch
         if: github.ref == 'refs/heads/main' && github.repository == 'cpp-linter/cpp-linter'
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./${{ env.path_to_doc }}
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
@@ -7,4 +7,7 @@ on:
 
 jobs:
   draft-release:
+    permissions:
+      contents: write
+      pull-requests: write
     uses: cpp-linter/.github/.github/workflows/release-drafter.yml@main
diff --git a/.github/workflows/run-pre-commit.yml → .github/workflows/pre-commit.yml b/.github/workflows/run-pre-commit.yml → .github/workflows/pre-commit.yml
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -0,0 +1,59 @@
+# This workflow will upload a Python Package using Twine when a release is created
+# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: Upload Python Package
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
+        # use fetch --all for setuptools_scm to work
+        with:
+          fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5.6.0
+        with:
+          python-version: '3.x'
+      - name: Build distributions
+        run: pipx run build -o dist
+      - name: Upload builds as artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          path: dist
+          name: wheels
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: [build]
+    permissions:
+      # needed for trusted publishing
+      id-token: write
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: wheels
+          path: dist
+      - name: Set up Python
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5.6.0
+        with:
+          python-version: '3.x'
+      - name: Check distributions
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+        run: pipx run twine check dist/*
+      - name: Deploy to PyPI
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
diff --git a/.github/workflows/run-dev-tests.yml → .github/workflows/tests.yml b/.github/workflows/run-dev-tests.yml → .github/workflows/tests.yml
@@ -25,18 +25,18 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ['windows-latest', ubuntu-22.04]
-        version: ['20', '19', '18', '17', '16', '15', '14', '13', '12', '11', '10', '9', '8']
+        os: ['windows-latest', 'ubuntu-latest']
+        version: ['21', '20', '19', '18', '17', '16', '15', '14', '13', '12', '11', '10', '9']
     env:
       MAX_PYTHON_VERSION: '3.13'
       # only used when installing for a pre-released python version
       # LIBGIT2_VERSION: '1.9.0'
 
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5.6.0
         with:
           python-version: 3.x
 
@@ -56,7 +56,7 @@ jobs:
       #     sudo cmake --install build
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@557e51de59eb14aaaba2ed9621916900a91d50c6 # v6.6.1
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -95,7 +95,7 @@ jobs:
         run: |-
           from os import environ
           with open(environ["GITHUB_OUTPUT"], mode="a") as gh_out:
-            if ${{ matrix.version }} == 20:
+            if "${{ matrix.version }}" == "21":
                 gh_out.write("args=\n")
             else:
                 gh_out.write("args=-m \"not no_clang\"\n")
@@ -107,7 +107,7 @@ jobs:
         run: uvx nox -s test-all -- ${{ steps.clang-dep.outputs.args }}
 
       - name: Upload coverage data
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage-data-${{ runner.os }}-${{ matrix.version }}
           path: .coverage*
@@ -118,21 +118,21 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           pattern: coverage-data-*
           merge-multiple: true
 
       - name: Setup python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5.6.0
         with:
           python-version: '3.x'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@557e51de59eb14aaaba2ed9621916900a91d50c6 # v6.6.1
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -141,12 +141,12 @@ jobs:
         run: uvx nox -s coverage
 
       - name: Upload comprehensive coverage HTML report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage-report
           path: htmlcov/
 
-      - uses: codecov/codecov-action@v5
+      - uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
         env:
           CODECOV_TOKEN: ${{secrets.CODECOV_TOKEN}}
         with:

diff --git a/.gitignore b/.gitignore
@@ -179,3 +179,6 @@ cmake_install.cmake
 
 # generated doc pages
 docs/cli_args.rst
+
+# generated version info (via setuptools_scm)
+cpp_linter/_version.py
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -3,7 +3,7 @@ ci:
 
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: trailing-whitespace
         exclude: ^tests/.*\.(?:patch|diff)$
@@ -18,14 +18,14 @@ repos:
         args: ["--fix=lf"]
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.12.2
+    rev: v0.12.11
     hooks:
       # Run the linter.
-      - id: ruff
+      - id: ruff-check
       # Run the formatter.
       - id: ruff-format
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 'v1.16.1'
+    rev: 'v1.17.1'
     hooks:
       - id: mypy
         additional_dependencies:
@@ -36,6 +36,6 @@ repos:
           - requests-mock
           - '.'
   - repo: https://github.com/streetsidesoftware/cspell-cli
-    rev: v9.0.1
+    rev: v9.2.0
     hooks:
       - id: cspell
diff --git a/cpp_linter/__init__.py b/cpp_linter/__init__.py
@@ -9,13 +9,18 @@
 from .clang_tools import capture_clang_tools_output
 from .cli import get_cli_parser, Args
 from .rest_api.github_api import GithubApiClient
+from ._version import version
 
 
 def main():
     """The main script."""
 
     # The parsed CLI args
-    args = get_cli_parser().parse_args(namespace=Args())
+    cli_parser = get_cli_parser()
+    args = cli_parser.parse_args(namespace=Args())
+    if args.command == "version":
+        print(version)
+        return
 
     #  force files-changed-only to reflect value of lines-changed-only
     if args.lines_changed_only:

diff --git a/cpp_linter/cli.py b/cpp_linter/cli.py
@@ -69,6 +69,8 @@ class Args(UserDict):
     ignore_format: str = ""
     #: See :std:option:`--passive-reviews`.
     passive_reviews: bool = False
+    #: A subcommand if provided
+    command: Optional[str] = None
 
 
 _parser_args: Dict[Sequence[str], Any] = {}
@@ -395,4 +397,9 @@ def get_cli_parser() -> argparse.ArgumentParser:
     )
     for switches, kwargs in _parser_args.items():
         cli_parser.add_argument(*switches, **kwargs)
+    sub_parser = cli_parser.add_subparsers(
+        description="Subcommands for special behavior", dest="command"
+    )
+    version_help = "Show the cpp-linter version and exit"
+    sub_parser.add_parser("version", description=version_help, help=version_help)
     return cli_parser
diff --git a/cpp_linter/rest_api/__init__.py b/cpp_linter/rest_api/__init__.py
@@ -13,13 +13,14 @@
 from ..cli import Args
 from ..loggers import logger, log_response_msg
 from ..clang_tools import ClangVersions
-
+from .._version import version
 
 USER_OUTREACH = (
     "\n\nHave any feedback or feature suggestions? [Share it here.]"
     + "(https://github.com/cpp-linter/cpp-linter-action/issues)"
 )
 COMMENT_MARKER = "<!-- cpp linter action -->\n"
+USER_AGENT = f"cpp-linter/{version}"
 
 
 class RateLimitHeaders(NamedTuple):

diff --git a/cpp_linter/rest_api/github_api.py b/cpp_linter/rest_api/github_api.py
@@ -29,7 +29,7 @@
 from ..cli import Args
 from ..loggers import logger, log_commander
 from ..git import parse_diff, get_diff
-from . import RestApiClient, USER_OUTREACH, COMMENT_MARKER, RateLimitHeaders
+from . import RestApiClient, USER_AGENT, USER_OUTREACH, COMMENT_MARKER, RateLimitHeaders
 
 RATE_LIMIT_HEADERS = RateLimitHeaders(
     reset="x-ratelimit-reset",
@@ -203,6 +203,7 @@ def make_headers(self, use_diff: bool = False) -> Dict[str, str]:
         gh_token = environ.get("GITHUB_TOKEN", "")
         if gh_token:
             headers["Authorization"] = f"token {gh_token}"
+        headers["User-Agent"] = USER_AGENT
         return headers
 
     def post_feedback(