[Enhancement] Strengthen pre-commit hooks and replace CPU-only CI

.buildkite/common/scripts/upload_pipeline.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python3
 # SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: Copyright contributors to the AFD plugin project
 """Render and optionally upload Buildkite pipeline YAML with diff-aware logic.
 
 Bootstrap mode (``bootstrap-upload-steps.yml``):
@@ -322,7 +323,7 @@ def _select_e2e_group_steps(steps: list[Any]) -> list[Any]:
     return selected
 
 
-def _render_test_pipeline(
+def render_test_pipeline(
     doc: dict[str, Any],
     changed_files: list[str] | None,
     *,
@@ -364,7 +365,7 @@ def _render_pipeline(
     if not isinstance(doc, dict):
         raise ValueError(f"invalid pipeline YAML: {path}")
 
-    doc = _render_test_pipeline(doc, changed_files, e2e_only=e2e_only)
+    doc = render_test_pipeline(doc, changed_files, e2e_only=e2e_only)
     return yaml.safe_dump(doc, sort_keys=False)
 
 

.github/workflows/pre-commit.yml

@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: Apache-2.0
+name: pre-commit
+
+on:
+  pull_request:
+    branches: [main, master]
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install shellcheck
+        run: sudo apt-get update && sudo apt-get install -y shellcheck
+      - name: Resolve changed-files range
+        id: range
+        shell: bash
+        run: |
+          zero=0000000000000000000000000000000000000000
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            from_ref="${{ github.event.pull_request.base.sha }}"
+            to_ref="${{ github.event.pull_request.head.sha }}"
+          elif [ -n "${{ github.event.before }}" ] && [ "${{ github.event.before }}" != "$zero" ]; then
+            from_ref="${{ github.event.before }}"
+            to_ref="${{ github.sha }}"
+          else
+            from_ref="$(git rev-parse HEAD~1)"
+            to_ref="${{ github.sha }}"
+          fi
+          echo "from_ref=${from_ref}" >> "$GITHUB_OUTPUT"
+          echo "to_ref=${to_ref}" >> "$GITHUB_OUTPUT"
+      # Only check files changed in this push/PR; do not scan the whole tree.
+      - uses: pre-commit/action@v3.0.1
+        with:
+          extra_args: --from-ref ${{ steps.range.outputs.from_ref }} --to-ref ${{ steps.range.outputs.to_ref }}

.markdownlint.yaml

@@ -0,0 +1,17 @@
+# Markdown lint rules for docs and READMEs.
+MD007:
+  indent: 4
+MD013: false
+# GitHub READMEs start with a centered logo, not an H1.
+MD041: false
+MD024:
+  siblings_only: true
+MD025:
+  # Allow front matter title to be different from the first heading in the document.
+  front_matter_title: ""
+MD031:
+  list_items: false
+MD033: false
+MD046: false
+MD052: false
+MD059: false

.pre-commit-config.yaml

@@ -1,17 +1,130 @@
 # SPDX-License-Identifier: Apache-2.0
+default_install_hook_types:
+  - pre-commit
+  - commit-msg
+exclude: ^(afd_plugin/connectors/npu/bin/.*\.(run|whl))$
 repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: check-yaml
+        args: [--allow-multiple-documents]
+      - id: check-merge-conflict
+      - id: debug-statements
+      - id: end-of-file-fixer
+      - id: mixed-line-ending
+        args: [--fix=lf]
+      - id: trailing-whitespace
+        args: [--markdown-linebreak-ext=md]
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Keep in sync with the ruff version pinned in uv.lock
     rev: v0.15.13
     hooks:
       - id: ruff-check
-        args: [--fix]
+        args: [--output-format, github, --fix]
       - id: ruff-format
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+
+  - repo: https://github.com/crate-ci/typos
+    rev: v1.49.0
     hooks:
-      - id: check-yaml
-        args: [--allow-multiple-documents]
-      - id: end-of-file-fixer
-      - id: trailing-whitespace
-      - id: check-merge-conflict
+      - id: typos
+
+  - repo: https://github.com/rhysd/actionlint
+    # v1.7.8+ sets `go 1.24.0` in go.mod, which older Go toolchains (and most
+    # current CI images) cannot parse. Pin to v1.7.7 until actionlint fixes the
+    # go.mod directive.
+    rev: v1.7.7
+    hooks:
+      - id: actionlint
+        files: ^\.github/workflows/.*\.ya?ml$
+
+  - repo: https://github.com/DavidAnson/markdownlint-cli2
+    rev: v0.23.2
+    hooks:
+      - id: markdownlint-cli2
+        language_version: lts
+        args: [--fix]
+        files: (^docs/|^recipe/|(^|/)README\.md$)
+        # Agent skill docs and CLAUDE.md are not user-facing docs/READMEs.
+        exclude: (^|/)CLAUDE\.md$|^\.claude/|^\.cursor/|^\.agents/
+
+  # Keep `local` last so `suggestion` stays the final hook. Autofix repos
+  # (ruff, typos, markdownlint, trailing-whitespace, etc.) must run first;
+  # otherwise their "files were modified" output displaces the SKIP tip.
+  - repo: local
+    hooks:
+      - id: signoff-commit
+        name: Sign-off Commit
+        entry: bash
+        args:
+          - -c
+          - |
+            if ! grep -q "^Signed-off-by: $(git config user.name) <$(git config user.email)>" "$(git rev-parse --git-path COMMIT_EDITMSG)"; then
+              printf "\nSigned-off-by: $(git config user.name) <$(git config user.email)>\n" >> "$(git rev-parse --git-path COMMIT_EDITMSG)"
+            fi
+        language: system
+        verbose: true
+        stages: [commit-msg]
+
+      # mypy-3.10 runs on git commit / CI for changed files only.
+      # Extra versions are manual-stage only (not in default `pre-commit run`):
+      #   pre-commit run --hook-stage manual mypy-3.12
+      - id: mypy-3.10
+        name: Run mypy for Python 3.10
+        entry: python tools/pre_commit/mypy.py "3.10"
+        <<: &mypy_common
+          language: python
+          types_or: [python, pyi]
+          require_serial: true
+          additional_dependencies:
+            - mypy==1.11.1
+            - regex
+            - types-PyYAML
+            - types-requests
+            - types-setuptools
+      - id: mypy-3.11
+        name: Run mypy for Python 3.11
+        entry: python tools/pre_commit/mypy.py "3.11"
+        <<: *mypy_common
+        stages: [manual]
+      - id: mypy-3.12
+        name: Run mypy for Python 3.12
+        entry: python tools/pre_commit/mypy.py "3.12"
+        <<: *mypy_common
+        stages: [manual]
+      - id: mypy-3.13
+        name: Run mypy for Python 3.13
+        entry: python tools/pre_commit/mypy.py "3.13"
+        <<: *mypy_common
+        stages: [manual]
+
+      - id: shellcheck
+        name: Lint shell scripts
+        # language: script breaks on Windows (shebang path loses slashes).
+        # Invoke the wrapper with bash so Linux CI and Win/Git Bash work.
+        entry: bash
+        args: [tools/pre_commit/shellcheck.sh]
+        language: system
+        types: [shell]
+
+      - id: check-spdx-header
+        name: Check SPDX headers
+        entry: python tools/pre_commit/check_spdx_header.py
+        language: python
+        types_or: [python, pyi, rust, proto, shell]
+        files: \.(py|pyi|rs|proto|sh)$
+
+      - id: check-buildkite
+        name: Validate Buildkite Pipelines
+        entry: python tools/pre_commit/check_buildkite.py
+        language: python
+        files: ^\.buildkite/.*\.ya?ml$
+        additional_dependencies: [pyyaml, check-jsonschema==0.38.0]
+
+      - id: suggestion
+        name: Suggestion
+        entry: bash -c 'echo "To bypass all the pre-commit hooks, add --no-verify to git commit. To skip a specific hook, prefix the commit command with SKIP=<hook-id>."'
+        language: system
+        verbose: true
+        pass_filenames: false

pyproject.toml

@@ -111,6 +111,15 @@ quote-style = "double"
 indent-style = "space"
 docstring-code-format = true
 
+[tool.mypy]
+python_version = "3.10"
+# Silent follow for library code; missing third-party stubs are ignored
+# everywhere (including tests). tests/ still get --follow-imports skip from
+# tools/pre_commit/mypy.py.
+ignore_missing_imports = true
+check_untyped_defs = true
+follow_imports = "silent"
+
 [tool.ty]
 
 [tool.ty.analysis]