use pre-commit to invoke linters

[williballenthin]

adds a pre-commit configuration so that its easy to invoke all of our linter checks w/associated configuration, as well as install the pre-commit and pre-push hooks consistently:

quickstart

do this now @mr-tz @mike-hunhoff @yelhamer @colton-gabertan (FYI)

$ pre-commit install    # now pre-commit hook installed!

or if you want to run all the linters on-demand:

$ pre-commit run --all-files

the PR also introduces some additional plugins (and fixes) for flake8:

• bugbear - find likely bugs, which it did, such as use of str.lstrip("many characters here")
• encodings - enforce text read from files has an explicit encoding
• comprehensions - use list/tuple/set comprehensions where appropriate (and don't, when not appropriate)
• logging-format - don't use format strings in logging calls
• no-implicit-concat - catch potential bugs by disallowing implicit string concatenation, like "foo" "bar" == "foobar"
• print - catch print statements in library code
• todos - enforce TODOs are formatted like TODO(author): message and have an associated link to a tracking github issue

im really excited about some of these lints (like logging format), since we've often had to explain and manually check for these during PR reviews. the other ones enforce better hygiene (imho).

closes #1579
closes #1391

Checklist

• No CHANGELOG update needed

• No new tests needed

• documentation update

[github-actions]

Please add bug fixes, new features, breaking changes and anything else you think is worthwhile mentioning to the master (unreleased) section of CHANGELOG.md. If no CHANGELOG update is needed add the following to the PR description: [x] No CHANGELOG update needed

CHANGELOG updated or no update needed, thanks! 😄

[mr-tz]

looks solid!

[williballenthin]

just getting tests to pass and then i'll open this up for review

[williballenthin]

i have a few more linters in the works (flake8 plugins) so i'll get those hammered out before we merge.

[mr-tz]

Wow, nice improvements. Thanks!

[williballenthin]

@ajnelson-nist check out how we integrated pre-commit here (thanks to your pointer).

specifically, we use a local configuration rather than using the third-party pre-commit hooks. this lets us declare the linter dependencies in setup.py/pyproject.toml and therefore get updated by Dependabot while still getting invoked by pre-commit.

https://github.com/mandiant/capa/blob/f983307c978b82911d823ac291f4e397393f4ba2/.pre-commit-config.yaml

[ajnelson-nist]

@williballenthin And now you've explained something I hadn't quite understood from the examples I'd drawn from. Local configurations! That's how they'd gotten around pinning-vs-range version freshness issues.

This was a fruitful back and forth. Thanks for letting me know what you found!