fixed bug no version detected in pre-commit installation

[daniel-mohr]

cf. #1280

Unfortunately, metadata.version("bandit") does not return a meaningful version (returning the string "0.0.0") when bandit is installed and used via pre-commit.

This PR provides a workaround to ensure bandit functions correctly within the pre-commit environment.

pre-commit does not seem to provide the right environment for version detection. The use of 'latest' ensures compatibility, even if this is more of a workaround than a perfect solution.

[ericwb]

This seems a bit hacky. I'd rather we get to the root cause on why the semver doesn't get into pre-commit.

[sigmavirus24]

I agree. This seems like a bug where this is hiding that bug rather than fixing it.

[sigmavirus24]

My guess is this is a pbr problem. If we switched to a more modern build-system we might not have this bug at all.

[daniel-mohr]

Yes, this is a workaround.

After init_repo follows pre-commit clone_strategy and does something like this:

p="$(mktemp -d --tmpdir "$HOME"/.cache/pre-commit/)"
cd "$p"
git init .
git init
git remote add origin https://github.com/PyCQA/bandit
git fetch origin 1.8.5 --depth=1
git checkout FETCH_HEAD

And the repo has no version info. Neither the working tree nor the .git contains the version. Tags were not fetched.

I think a clean solution here would be to define the version in setup.cfg or setup.py -- or with more modern build systems that would probably be pyproject.toml or so.