[MNT] Refactor precommit action for pull request handling

.github/workflows/pr_precommit.yml

@@ -4,66 +4,62 @@ on:
   push:
     branches:
       - main
-  pull_request_target:
-    branches:
-      - main
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
+      - unlabeled
+
+permissions:
+  contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
-
 jobs:
   pre-commit:
     runs-on: ubuntu-24.04
 
     steps:
-      - name: Create app token
-        uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ vars.APP_ID }}
-          private-key: ${{ secrets.APP_KEY }}
-
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          ref: ${{ github.head_ref }}
-          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: false
 
-      - name: Setup Python 3.14
-        uses: actions/setup-python@v5
+      - name: Setup Python 3.12
+        uses: actions/setup-python@v7
         with:
-          python-version: "3.14"
+          python-version: "3.12"
 
       - name: Get changed files
-        uses: tj-actions/changed-files@v45
+        if: ${{ github.event_name == 'pull_request' }}
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96  # v47.0.5
         id: changed-files
 
       - name: List changed files
+        if: ${{ github.event_name == 'pull_request' }}
         run: echo '${{ steps.changed-files.outputs.all_changed_files }}'
 
-      # only check the full repository if PR and correctly labelled
-      - if: ${{ github.event_name != 'pull_request_target' || contains(github.event.pull_request.labels.*.name, 'full pre-commit') }}
-        name: Full pre-commit
+      # Check the full repository on pushes to main
+      - name: Full pre-commit
+        if: ${{ github.event_name == 'push' }}
         uses: pre-commit/action@v3.0.1
         with:
           extra_args: --all-files
-      - if: ${{ github.event_name == 'pull_request_target' && !contains(github.event.pull_request.labels.*.name, 'full pre-commit') }}
-        name: Local pre-commit
+
+      # Check the full repository on PRs that are explicitly labelled
+      - name: Full pre-commit on labelled PR
+        if: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'full pre-commit') }}
         uses: pre-commit/action@v3.0.1
         with:
-          extra_args: --files ${{ steps.changed-files.outputs.all_changed_files }}
+          extra_args: --all-files
 
-      # push fixes if pre-commit fails and PR is eligible
-      - if: ${{ failure() && github.event_name == 'pull_request_target' && !github.event.pull_request.draft && !github.event.pull_request.head.repo.fork && !contains(github.event.pull_request.labels.*.name, 'stop pre-commit fixes') }}
-        name: Push pre-commit fixes
-        uses: stefanzweifel/git-auto-commit-action@v5
+      # Otherwise only check changed files on PRs
+      - name: Local pre-commit
+        if: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'full pre-commit') }}
+        uses: pre-commit/action@v3.0.1
         with:
-          commit_message: Automatic `pre-commit` fixes
-          commit_user_name: ayrna-actions-bot[bot]
-          create_branch: false
-
-      - name: Run version check
-        run: python .github/scripts/check_version_consistency.py
+          extra_args: --files ${{ steps.changed-files.outputs.all_changed_files }}