Run pre-commit in CI on a lint-only environment

pre-commit has never run in GitHub Actions; only the external
pre-commit.ci service ran it. Now that the formatting hooks are skipped
there, because they need an environment that service does not build,
this job runs them.

It installs the "lint" extra alone, read out of pyproject.toml at run
time so the versions are not restated in the workflow. That needs
neither torch nor the optional dependencies, unlike static-checks, which
installs .[all,testing] before running formatters.

static-checks is left unchanged. Running both routes keeps the copyright
and pyrefly coverage it provides, and makes CI fail if pre-commit and
runtests.sh ever disagree about the same files.

Signed-off-by: Hans Johnson <hans-johnson@uiowa.edu>

Author: hjmjohnson

.github/workflows/cicd_tests.yml

@@ -52,6 +52,26 @@ env:
 # When support is dropped for a version it is important to update these as appropriate.
 
 jobs:
+  pre-commit:  # Run the hooks pre-commit.ci skips, using the tools pyproject.toml pins
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v7
+    - name: Set up Python ${{ env.PYTHON_VER1 }}
+      uses: actions/setup-python@v6
+      with:
+        python-version: ${{ env.PYTHON_VER1 }}
+        cache: 'pip'
+    - name: Install lint tools
+      run: |
+        # the lint extra alone, so this job needs neither torch nor the optional dependencies
+        python -m pip install --upgrade pip
+        python -c "import tomllib; print('\n'.join(tomllib.load(open('pyproject.toml','rb'))['project']['optional-dependencies']['lint']))" > lint-requirements.txt
+        cat lint-requirements.txt
+        python -m pip install -r lint-requirements.txt
+        rm lint-requirements.txt
+    - name: Run pre-commit
+      run: python -m pre_commit run --all-files --show-diff-on-failure
+
   static-checks:  # Perform static type and other checks using runtests.sh
     runs-on: ubuntu-latest
     strategy: