ci: auto-merge Dependabot tooling updates and run pre-commit in CI

.github/dependabot.yml

@@ -1,38 +1,35 @@
 version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
+
+# GitHub Actions and pre-commit hooks arrive as one monthly PR, which
+# dependabot-automerge.yml merges when every update is minor or patch.
+multi-ecosystem-groups:
+  tooling:
     schedule:
       interval: "monthly"
-    groups:
-      monthly-batch:
-        patterns:
-          - "*"
     pull-request-branch-name:
       separator: "/"
     commit-message:
-      prefix: "ci"
+      prefix: "chore"
       include: "scope"
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    patterns:
+      - "*"
+    multi-ecosystem-group: "tooling"
     cooldown:
       default-days: 7
 
-  - package-ecosystem: "bundler"
+  - package-ecosystem: "pre-commit"
     directory: "/"
-    schedule:
-      interval: "monthly"
-    groups:
-      monthly-batch:
-        patterns:
-          - "*"
-    pull-request-branch-name:
-      separator: "/"
-    commit-message:
-      prefix: "bundler"
-      include: "scope"
+    patterns:
+      - "*"
+    multi-ecosystem-group: "tooling"
     cooldown:
       default-days: 7
 
-  - package-ecosystem: "docker"
+  - package-ecosystem: "bundler"
     directory: "/"
     schedule:
       interval: "monthly"
@@ -43,12 +40,12 @@ updates:
     pull-request-branch-name:
       separator: "/"
     commit-message:
-      prefix: "docker"
+      prefix: "bundler"
       include: "scope"
     cooldown:
       default-days: 7
 
-  - package-ecosystem: "pre-commit"
+  - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "monthly"
@@ -59,7 +56,7 @@ updates:
     pull-request-branch-name:
       separator: "/"
     commit-message:
-      prefix: "chore"
+      prefix: "docker"
       include: "scope"
     cooldown:
       default-days: 7

.github/workflows/dependabot-automerge.yml

@@ -0,0 +1,17 @@
+---
+# Auto-merges Dependabot's monthly "tooling" PR (Actions and pre-commit hooks)
+# once required checks pass, when every update is minor or patch.
+name: dependabot-automerge
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependabot-automerge:
+    permissions:
+      contents: write  # merge the PR
+      pull-requests: write  # enable auto-merge
+    uses: chorrell/workflows/.github/workflows/dependabot-automerge.yml@v1

.github/workflows/pre-commit.yml

@@ -0,0 +1,16 @@
+---
+name: pre-commit
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pre-commit:
+    uses: chorrell/workflows/.github/workflows/pre-commit.yml@v1

.pre-commit-config.yaml

@@ -32,7 +32,7 @@ repos:
         language_version: 3.4.7
         args: ['--autocorrect', '--force-exclusion']
 
-  - repo: https://github.com/woodruffw/zizmor-pre-commit
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
     rev: v1.30.1
     hooks:
       - id: zizmor

AGENTS.md

@@ -34,8 +34,8 @@ eval "$(rbenv init - zsh)"  # add to ~/.zshrc for persistence
 bundle install
 
 # Install pre-commit hooks
-brew install pre-commit
-pre-commit install
+brew install prek
+prek install
 
 # Docker BuildKit is enabled by default in Rakefile
 # Verify Docker is running
@@ -115,11 +115,11 @@ To run them manually:
 
 ```bash
 # Run all hooks against all files
-pre-commit run --all-files
+prek run --all-files
 
 # Run a specific hook
-pre-commit run rubocop --all-files
-pre-commit run markdownlint-cli2-docker --all-files
+prek run rubocop --all-files
+prek run markdownlint-cli2-docker --all-files
 ```
 
 **Active hooks**: gitleaks, hadolint, markdownlint-cli2, rubocop, zizmor,
@@ -178,7 +178,7 @@ end
 - Follow existing patterns in spec files
 - Use single quotes for strings (rubocop enforces this)
 - Keep helper methods in `spec_helper.rb`
-- All Ruby files must pass rubocop — run `pre-commit run rubocop --all-files` to check
+- All Ruby files must pass rubocop — run `prek run rubocop --all-files` to check
 - Configuration is in `.rubocop.yml`; Metrics cops are excluded for `spec/`
 
 ### Serverspec Patterns
@@ -223,7 +223,7 @@ Both versions must pass before merge.
 
 - Test all changes locally before committing
 - Run full test suite: `bundle exec rake`
-- Run all pre-commit hooks before pushing: `pre-commit run --all-files`
+- Run all pre-commit hooks before pushing: `prek run --all-files`
 - Keep Node.js versions on LTS releases
 - Update README.md when changing versions
 - Use version pinning in Gemfile (`~>` operator)

README.md

@@ -32,11 +32,11 @@ bundle install
 
 ### Pre-commit Hooks
 
-Install [pre-commit](https://pre-commit.com/) and set up the hooks:
+Install [prek](https://github.com/j178/prek) and set up the hooks:
 
 ```shell
-brew install pre-commit
-pre-commit install
+brew install prek
+prek install
 ```
 
 ## Usage (running the tests)