Add more pre-commit checks

.github/workflows/build-with-clang.yml

@@ -65,7 +65,7 @@ jobs:
       - name: Build mkl_fft
         run: |
           source ${{ env.ONEAPI_ROOT }}/setvars.sh
-          echo $CMPLR_ROOT
+          echo "$CMPLR_ROOT"
           export CC=$CMPLR_ROOT/bin/icx
           export CFLAGS="${CFLAGS} -fno-fast-math -O2"
           pip install -e . --no-build-isolation --no-deps --verbose

.github/workflows/build_pip.yaml

@@ -57,6 +57,6 @@ jobs:
           pip install --no-cache-dir numpy ${{ matrix.use_pre }}
           echo "CONDA_PREFFIX is '${CONDA_PREFIX}'"
           export MKLROOT=${CONDA_PREFIX}
-          pip install -e .[test] --no-build-isolation --verbose
+          pip install -e ".[test]" --no-build-isolation --verbose
           pip list
           python -m pytest -v mkl_fft/tests

.github/workflows/conda-package-cf.yml

@@ -56,21 +56,21 @@ jobs:
             ${{ runner.os }}-conda-${{ env.CACHE_NUMBER }}-
 
       - name: Add conda to system path
-        run: echo $CONDA/bin >> $GITHUB_PATH
+        run: echo "$CONDA"/bin >> "$GITHUB_PATH"
 
       - name: Install conda-build
         run: conda install conda-build
 
       - name: Build conda package with NumPy 2.x
         run: |
-          CHANNELS="-c conda-forge --override-channels"
-          VERSIONS="--python ${{ matrix.python }} --numpy ${{ matrix.numpy }}"
-          TEST="--no-test"
+          CHANNELS=(-c conda-forge --override-channels)
+          VERSIONS=(--python "${{ matrix.python }}" --numpy "${{ matrix.numpy }}")
+          TEST=(--no-test)
 
           conda build \
-            $TEST \
-            $VERSIONS \
-            $CHANNELS \
+            "${TEST[@]}" \
+            "${VERSIONS[@]}" \
+            "${CHANNELS[@]}" \
             conda-recipe-cf
 
       - name: Upload artifact
@@ -100,23 +100,23 @@ jobs:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python_ver }}
 
       - name: Add conda to system path
-        run: echo $CONDA/bin >> $GITHUB_PATH
+        run: echo "$CONDA"/bin >> "$GITHUB_PATH"
 
       - name: Install conda-build
         run: conda install conda-build
 
       - name: Create conda channel
         run: |
-          mkdir -p $GITHUB_WORKSPACE/channel/linux-64
-          mv ${PACKAGE_NAME}-*.conda $GITHUB_WORKSPACE/channel/linux-64
-          conda index $GITHUB_WORKSPACE/channel
+          mkdir -p "$GITHUB_WORKSPACE"/channel/linux-64
+          mv "$PACKAGE_NAME"-*.conda "$GITHUB_WORKSPACE"/channel/linux-64
+          conda index "$GITHUB_WORKSPACE"/channel
           # Test channel
-          conda search $PACKAGE_NAME -c $GITHUB_WORKSPACE/channel --override-channels
+          conda search "$PACKAGE_NAME" -c "$GITHUB_WORKSPACE"/channel --override-channels
 
       - name: Collect dependencies
         run: |
-          CHANNELS="-c $GITHUB_WORKSPACE/channel ${{ env.CHANNELS }}"
-          conda create -n ${{ env.TEST_ENV_NAME }} $PACKAGE_NAME python=${{ matrix.python_ver }} ${{ matrix.numpy }} $CHANNELS --only-deps --dry-run > lockfile
+          CHANNELS=(-c "$GITHUB_WORKSPACE"/channel ${{ env.CHANNELS }})
+          conda create -n ${{ env.TEST_ENV_NAME }} "$PACKAGE_NAME" python=${{ matrix.python_ver }} ${{ matrix.numpy }} "${CHANNELS[@]}" --only-deps --dry-run > lockfile
 
       - name: Display lockfile
         run: cat lockfile
@@ -139,16 +139,16 @@ jobs:
 
       - name: Install mkl_fft
         run: |
-          CHANNELS="-c $GITHUB_WORKSPACE/channel ${{ env.CHANNELS }}"
-          conda create -n ${{ env.TEST_ENV_NAME }} python=${{ matrix.python_ver }} ${{ matrix.numpy }} $PACKAGE_NAME pytest scipy $CHANNELS
+          CHANNELS=(-c "$GITHUB_WORKSPACE"/channel ${{ env.CHANNELS }})
+          conda create -n ${{ env.TEST_ENV_NAME }} python=${{ matrix.python_ver }} ${{ matrix.numpy }} "$PACKAGE_NAME" pytest scipy "${CHANNELS[@]}"
           # Test installed packages
           conda list -n ${{ env.TEST_ENV_NAME }}
 
       - name: Run tests
         run: |
-          source $CONDA/etc/profile.d/conda.sh
+          source "$CONDA"/etc/profile.d/conda.sh
           conda activate ${{ env.TEST_ENV_NAME }}
-          pytest -v --pyargs $MODULE_NAME
+          pytest -v --pyargs "$MODULE_NAME"
 
   build_windows:
     runs-on: windows-latest
@@ -208,7 +208,7 @@ jobs:
       - name: Store conda paths as envs
         shell: bash -l {0}
         run: |
-          echo "CONDA_BLD=$CONDA/conda-bld/win-64/" | tr "\\\\" '/' >> $GITHUB_ENV
+          echo "CONDA_BLD=$CONDA/conda-bld/win-64/" | tr "\\\\" '/' >> "$GITHUB_ENV"
 
       - name: Upload artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
@@ -244,7 +244,7 @@ jobs:
         with:
           miniforge-version: latest
           activate-environment: ${{ env.TEST_ENV_NAME }}
-          python-version: ${{ matrix.python }}
+          python-version: ${{ matrix.python_ver }}
           channels: conda-forge
           conda-remove-defaults: 'true'
 
@@ -315,7 +315,7 @@ jobs:
              SET PACKAGE_VERSION=%%F
           )
           SET "TEST_DEPENDENCIES=pytest scipy"
-          conda install -n ${{ env.TEST_ENV_NAME }} ${{ env.PACKAGE_NAME }}=%PACKAGE_VERSION% %TEST_DEPENDENCIES% python=${{ matrix.python }} ${{ matrix.numpy }} -c ${{ env.workdir }}/channel ${{ env.CHANNELS }}
+          conda install -n ${{ env.TEST_ENV_NAME }} ${{ env.PACKAGE_NAME }}=%PACKAGE_VERSION% %TEST_DEPENDENCIES% python=${{ matrix.python_ver }} ${{ matrix.numpy }} -c ${{ env.workdir }}/channel ${{ env.CHANNELS }}
 
       - name: Report content of test environment
         shell: cmd /C CALL {0}

.github/workflows/conda-package.yml

@@ -48,21 +48,21 @@ jobs:
             ${{ runner.os }}-conda-${{ env.CACHE_NUMBER }}-
 
       - name: Add conda to system path
-        run: echo $CONDA/bin >> $GITHUB_PATH
+        run: echo "$CONDA"/bin >> "$GITHUB_PATH"
 
       - name: Install conda-build
         run: conda install conda-build
 
       - name: Build conda package
         run: |
-          CHANNELS="-c https://software.repos.intel.com/python/conda -c conda-forge --override-channels"
-          VERSIONS="--python ${{ matrix.python }}"
-          TEST="--no-test"
+          CHANNELS=(-c https://software.repos.intel.com/python/conda -c conda-forge --override-channels)
+          VERSIONS=(--python "${{ matrix.python }}")
+          TEST=(--no-test)
 
           conda build \
-            $TEST \
-            $VERSIONS \
-            $CHANNELS \
+            "${TEST[@]}" \
+            "${VERSIONS[@]}" \
+            "${CHANNELS[@]}" \
             conda-recipe
 
       - name: Upload artifact
@@ -91,32 +91,34 @@ jobs:
           name: ${{ env.PACKAGE_NAME }} ${{ runner.os }} Python ${{ matrix.python }}
 
       - name: Add conda to system path
-        run: echo $CONDA/bin >> $GITHUB_PATH
+        run: echo "$CONDA"/bin >> "$GITHUB_PATH"
 
       - name: Install conda-build
         run: conda install conda-build
 
       - name: Create conda channel
         run: |
-          mkdir -p $GITHUB_WORKSPACE/channel/linux-64
-          mv ${PACKAGE_NAME}-*.conda $GITHUB_WORKSPACE/channel/linux-64
-          conda index $GITHUB_WORKSPACE/channel
+          mkdir -p "$GITHUB_WORKSPACE"/channel/linux-64
+          mv "$PACKAGE_NAME"-*.conda "$GITHUB_WORKSPACE"/channel/linux-64
+          conda index "$GITHUB_WORKSPACE"/channel
 
       - name: Test conda channel
         run: |
-          conda search $PACKAGE_NAME -c $GITHUB_WORKSPACE/channel --override-channels --info --json > $GITHUB_WORKSPACE/ver.json
-          cat $GITHUB_WORKSPACE/ver.json
+          conda search "$PACKAGE_NAME" -c "$GITHUB_WORKSPACE"/channel --override-channels --info --json > "$GITHUB_WORKSPACE"/ver.json
+          cat "$GITHUB_WORKSPACE"/ver.json
 
       - name: Get package version
         run: |
-          export PACKAGE_VERSION=$(python -c "${{ env.VER_SCRIPT1 }} ${{ env.VER_SCRIPT2 }}")
-          echo PACKAGE_VERSION=${PACKAGE_VERSION}
-          echo "PACKAGE_VERSION=$PACKAGE_VERSION" >> $GITHUB_ENV
+          PACKAGE_VERSION=$(python -c "${{ env.VER_SCRIPT1 }} ${{ env.VER_SCRIPT2 }}")
+          export PACKAGE_VERSION
+
+          echo PACKAGE_VERSION="${PACKAGE_VERSION}"
+          echo "PACKAGE_VERSION=$PACKAGE_VERSION" >> "$GITHUB_ENV"
 
       - name: Collect dependencies
         run: |
-          CHANNELS="-c $GITHUB_WORKSPACE/channel ${{ env.CHANNELS }}"
-          conda create -n ${{ env.TEST_ENV_NAME }} $PACKAGE_NAME python=${{ matrix.python }} $CHANNELS --only-deps --dry-run > lockfile
+          CHANNELS=(-c "$GITHUB_WORKSPACE"/channel ${{ env.CHANNELS }})
+          conda create -n ${{ env.TEST_ENV_NAME }} "$PACKAGE_NAME" python=${{ matrix.python }} "${CHANNELS[@]}" --only-deps --dry-run > lockfile
 
       - name: Display lockfile
         run: cat lockfile
@@ -139,17 +141,17 @@ jobs:
 
       - name: Install mkl_fft
         run: |
-          CHANNELS="-c $GITHUB_WORKSPACE/channel ${{ env.CHANNELS }}"
-          conda create -n ${{ env.TEST_ENV_NAME }} $PACKAGE_NAME=${{ env.PACKAGE_VERSION }} python=${{ matrix.python }} pytest $CHANNELS
-          conda install -n ${{ env.TEST_ENV_NAME }} "scipy>=1.10" $CHANNELS
+          CHANNELS=(-c "$GITHUB_WORKSPACE"/channel ${{ env.CHANNELS }})
+          conda create -n ${{ env.TEST_ENV_NAME }} "$PACKAGE_NAME"=${{ env.PACKAGE_VERSION }} python=${{ matrix.python }} pytest "${CHANNELS[@]}"
+          conda install -n ${{ env.TEST_ENV_NAME }} "scipy>=1.10" "${CHANNELS[@]}"
           # Test installed packages
           conda list -n ${{ env.TEST_ENV_NAME }}
 
       - name: Run tests
         run: |
-          source $CONDA/etc/profile.d/conda.sh
+          source "$CONDA"/etc/profile.d/conda.sh
           conda activate ${{ env.TEST_ENV_NAME }}
-          pytest -v --pyargs $MODULE_NAME
+          pytest -v --pyargs "$MODULE_NAME"
 
   build_windows:
     runs-on: windows-latest
@@ -203,7 +205,7 @@ jobs:
       - name: Store conda paths as envs
         shell: bash -l {0}
         run: |
-          echo "CONDA_BLD=$CONDA/conda-bld/win-64/" | tr "\\\\" '/' >> $GITHUB_ENV
+          echo "CONDA_BLD=$CONDA/conda-bld/win-64/" | tr "\\\\" '/' >> "$GITHUB_ENV"
 
       - name: Upload artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0

.github/workflows/pre-commit.yml

@@ -14,11 +14,14 @@ jobs:
     steps:
     - name: Checkout repo
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        # use commit hash to make "no-commit-to-branch" check passing
+        ref: ${{ github.sha }}
 
     - name: Set up python
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
-        python-version: '3.13'
+        python-version: '3.14'
 
     - name: Set up pip packages
       uses: BSFishy/pip-action@8f2d471d809dc20b6ada98c91910b6ae6243f318 # v1
@@ -29,9 +32,9 @@ jobs:
 
     - name: Set up clang-format
       run: |
-        sudo apt-get install -y clang-format-14
+        sudo apt-get install -y clang-format-15
         sudo unlink /usr/bin/clang-format
-        sudo ln -s /usr/bin/clang-format-14 /usr/bin/clang-format
+        sudo ln -s /usr/bin/clang-format-15 /usr/bin/clang-format
         clang-format --version
 
     - name: Run pre-commit checks

.pre-commit-config.yaml

@@ -2,6 +2,14 @@ repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
   rev: v6.0.0
   hooks:
+  # Git
+    - id: check-added-large-files
+    - id: no-commit-to-branch
+      name: "ensure no direct commit to master/maintenance branches"
+      args: [--branch, "master", --pattern, "maintenance/.*"]
+    - id: check-case-conflict
+    - id: check-illegal-windows-names
+  # Contents
     - id: check-ast
     - id: check-builtin-literals
     - id: check-case-conflict
@@ -15,19 +23,19 @@ repos:
     - id: mixed-line-ending
     - id: trailing-whitespace
 
--   repo: https://github.com/pre-commit/pygrep-hooks
-    rev: v1.10.0
-    hooks:
-    -   id: python-check-blanket-noqa
-    -   id: python-check-blanket-type-ignore
-    -   id: python-check-mock-methods
-    -   id: python-no-eval
-    -   id: python-no-log-warn
-    -   id: python-use-type-annotations
-    -   id: rst-backticks
-    -   id: rst-directive-colons
-    -   id: rst-inline-touching-normal
-    -   id: text-unicode-replacement-char
+- repo: https://github.com/pre-commit/pygrep-hooks
+  rev: v1.10.0
+  hooks:
+    - id: python-check-blanket-noqa
+    - id: python-check-blanket-type-ignore
+    - id: python-check-mock-methods
+    - id: python-no-eval
+    - id: python-no-log-warn
+    - id: python-use-type-annotations
+    - id: rst-backticks
+    - id: rst-directive-colons
+    - id: rst-inline-touching-normal
+    - id: text-unicode-replacement-char
 
 - repo: https://github.com/codespell-project/codespell
   rev: v2.4.1
@@ -62,7 +70,7 @@ repos:
     args: ["--config=.flake8"]
     additional_dependencies:
       - flake8-docstrings==1.7.0
-      - flake8-bugbear==24.4.26
+      - flake8-bugbear==25.11.29
 
 - repo: https://github.com/pycqa/isort
   rev: 8.0.0
@@ -102,3 +110,14 @@ repos:
   rev: 3.0.0
   hooks:
   - id: shellcheck
+
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.30.0
+  hooks:
+  - id: gitleaks
+
+- repo: https://github.com/rhysd/actionlint
+  rev: v1.7.11
+  hooks:
+  - id: actionlint
+    args: ["-ignore", "SC2317"]

mkl_fft/interfaces/_scipy_fft.py

@@ -86,21 +86,31 @@ def workers(self):
 
     @workers.setter
     def workers(self, workers_val):
-        self.workerks_ = operator.index(workers_val)
+        self.workers_ = operator.index(workers_val)
 
 
+# Use an immutable default (i.e. None) and create the object when needed
 _workers_global_settings = contextvars.ContextVar(
-    "scipy_backend_workers", default=_workers_data()
+    "scipy_backend_workers", default=None
 )
 
 
+def _get_workers_settings():
+    """Lazy initialization"""
+    value = _workers_global_settings.get()
+    if value is None:
+        value = _workers_data()
+        _workers_global_settings.set(value)
+    return value
+
+
 def _workers_to_num_threads(w):
     """
     Handle conversion of workers to a positive number of threads in the
     same way as scipy.fft._pocketfft.helpers._workers.
     """
     if w is None:
-        return _workers_global_settings.get().workers
+        return _get_workers_settings().workers
     _w = operator.index(w)
     if _w == 0:
         raise ValueError("Number of workers must not be zero")
@@ -707,7 +717,7 @@ def get_workers():
     For full documentation refer to `scipy.fft.get_workers`.
 
     """
-    return _workers_global_settings.get().workers
+    return _get_workers_settings().workers
 
 
 @contextlib.contextmanager