From f4567ba099589df28a7f431d3bba2d268d0dcf86 Mon Sep 17 00:00:00 2001
From: Martin Hauser <mhauser@netboxlabs.com>
Date: Fri, 20 Feb 2026 20:38:11 +0100
Subject: [PATCH] chore(ci): Pin Ruff 0.15.2 and run via ruff-action

Pin Ruff to v0.15.2 in CI and pre-commit to avoid breakages from
upstream releases. Run Ruff via astral-sh/ruff-action (pinned by SHA)
instead of installing Ruff via pip.
Document where Ruff is pinned and keep the release checklist/style guide
in sync.

Fixes #21472
Fixes #21497
---
 .github/workflows/ci.yml              | 12 ++++++++----
 .pre-commit-config.yaml               |  2 +-
 docs/development/release-checklist.md |  8 ++++++++
 docs/development/style-guide.md       |  8 ++++++++
 ruff.toml                             |  2 ++
 5 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2fbc48d5a..b5ddfc724 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -55,6 +55,13 @@ jobs:
     - name: Check out repo
       uses: actions/checkout@v4
 
+    - name: Check Python linting & PEP8 compliance
+      uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6 # v3.6.1
+      with:
+        version: "0.15.2"
+        args: "check --output-format=github"
+        src: "netbox/"
+
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v5
       with:
@@ -82,7 +89,7 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         pip install -r requirements.txt
-        pip install ruff coverage tblib
+        pip install coverage tblib
 
     - name: Build documentation
       run: mkdocs build
@@ -93,9 +100,6 @@ jobs:
     - name: Check for missing migrations
       run: python netbox/manage.py makemigrations --check
 
-    - name: Check PEP8 compliance
-      run: ruff check netbox/
-
     - name: Check UI ESLint, TypeScript, and Prettier Compliance
       run: yarn --cwd netbox/project-static validate
     
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 12f2c8172..361dfe72f 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: v0.14.1
+  rev: v0.15.2
   hooks:
     - id: ruff
       name: "Ruff linter"
diff --git a/docs/development/release-checklist.md b/docs/development/release-checklist.md
index eedb4e5a6..eb4001891 100644
--- a/docs/development/release-checklist.md
+++ b/docs/development/release-checklist.md
@@ -168,6 +168,14 @@ Update the static OpenAPI schema definition at `contrib/openapi.json` with the m
 ./manage.py spectacular --format openapi-json > ../contrib/openapi.json
 ```
 
+### Update Development Dependencies
+
+Keep development tooling versions consistent across the project. If you upgrade a dev-only dependency, update all places where it’s pinned so local tooling and CI run the same versions.
+
+* Ruff:
+  * `.pre-commit-config.yaml`
+  * `.github/workflows/ci.yml`
+
 ### Submit a Pull Request
 
 Commit the above changes and submit a pull request titled **"Release vX.Y.Z"** to merge the current release branch (e.g. `release-vX.Y.Z`) into `main`. Copy the documented release notes into the pull request's body.
diff --git a/docs/development/style-guide.md b/docs/development/style-guide.md
index d7a7ad9da..fcd222a65 100644
--- a/docs/development/style-guide.md
+++ b/docs/development/style-guide.md
@@ -47,6 +47,14 @@ Wildcard imports (for example, `from .constants import *`) are acceptable under
 
 The justification for ignoring this rule is the same as F403 above.
 
+##### [RET504](https://docs.astral.sh/ruff/rules/unnecessary-assign/): Unnecessary assign
+
+There are multiple instances where it is more readable and clearer to first assign to a variable and then return it.
+
+##### [UP032](https://docs.astral.sh/ruff/rules/f-string/): f-string
+
+For localizable strings, it is necessary to not use the `f-string` syntax, as Django's translation functions (e.g. `gettext_lazy`) require plain string literals.
+
 ### Introducing New Dependencies
 
 The introduction of a new dependency is best avoided unless it is absolutely necessary. For small features, it's generally preferable to replicate functionality within the NetBox code base rather than to introduce reliance on an external project. This reduces both the burden of tracking new releases and our exposure to outside bugs and supply chain attacks.
diff --git a/ruff.toml b/ruff.toml
index e696c3627..d50d42115 100644
--- a/ruff.toml
+++ b/ruff.toml
@@ -45,6 +45,8 @@ extend-select = [
     "UP",        # pyupgrade: modernize syntax for your target Python (e.g., f-strings, built-in generics, newer stdlib idioms)
     "RUF022",    # ruff: enforce sorted `__all__` lists
 ]
+# If you add a rule to `ignore`, please also update the "Linter Exceptions" section in
+# docs/development/style-guide.md.
 ignore = [
     "F403",      # pyflakes: `from ... import *` used; unable to detect undefined names
     "F405",      # pyflakes: name may be undefined or defined from star imports