Why

This repo carries the ruff hook but no ruff configuration, so it runs whatever ruff's default rule set happens to be. That default is not stable across releases — verified directly:

$ ruff 0.15.22 check --show-settings --isolated
 59 rules across  2 categories (E, F)

$ ruff 0.16.0 check --show-settings --isolated
413 rules across 38 categories
(+ I, UP, SIM, RUF, B, BLE, PIE, EXE, PLW, PLR, S, PTH, TRY, PYI, FURB, …)

A 7× expansion in a patch-level bump. The routine pre-commit autoupdate that crossed it broke 15 repositories in this org simultaneously, on code nobody had touched — 54 lint violations plus 71 lines of autofix, all on files that were 100% clean the day before.

Despite the name, this repo is not currently a Python house-style reference: it contains no pyproject.toml and no ruff config. Given it is where consumers look for the org's Python conventions, it is worth it being one.

What

1. .ruff.toml pinning the rule set

[lint]
select = ["E", "W", "F", "I", "B", "C4", "UP"]
ignore = ["E501", "B008"]

Not invented — this is the de-facto house style, present as a superset in 13 of the 16 org repos that already pin their rules. E501+B008 are ignored in 14 and 13 of those 16 respectively.

A standalone .ruff.toml rather than [tool.ruff] because this repo has no pyproject.toml.

Pinning does not decline the unselected rules. It makes adopting SIM, BLE, PIE and friends a deliberate, reviewed change rather than a side effect of a version bump.

2. line-length and target-version deliberately left unset

Both would change existing behaviour rather than just pinning it — target-version alters which pyupgrade rules fire, and line-length drives the formatter. Ruff's defaults (and its inference from requires-python) continue to apply unchanged. Standardising those is separate work.

3. The files: pattern dropped from both ruff hooks

The inherited pattern was:

files: ^(scripts|tests|custom_components)/.+\.py$

Two defects:

• It omits src/, so any repo in a src layout has its entire package silently unlinted. This is not hypothetical — 9 repos are affected, including project-reporting-tool (81 files), gerrit-clone-action (33) and dependamerge (36). Three repos (aislop-scan-action, sigul-sign-docker, zizmor-scan-action) currently lint nothing at all.
• custom_components/ is a Home Assistant artifact that exists in zero repos in this org, yet has propagated to 103 of them.

The smoking gun: several repos carry per-file-ignores for paths the hook can never reach — gerrit-clone-action has 7 entries for src/gerrit_clone/*.py. Someone wrote config for files ruff was never shown.

Removing files: restores the upstream hook default (types_or: [python, pyi]), i.e. lint all Python.

Validation

• ruff check --show-settings confirms enabled categories drop from 38 to B C E F I UP W
• pre-commit run --all-files → all hooks pass, including reuse lint on the new file
• This repo contains no Python, so the files: change is inert here

Scope

This is step 1 of a sequenced rollout, applied identically to actions-template, workflows-template and python-workflows. Steps 2–3 pin select in the 14 exposed repos that do contain Python and add PLR0917 to the 3 that already select PL. Fixing files: in existing repos is deliberately last, since it surfaces previously-unlinted code and must land after select is pinned.