Fix broken bandit pre-commit hook (Unknown test found in profile)

.pre-commit-config.yaml

@@ -81,13 +81,20 @@ repos:
   #     - id: pip-audit
   #       args: ["--desc", "on"]
 
-  - repo: https://github.com/PyCQA/bandit
-    rev: 1.8.0
+  # Installed from PyPI via a local hook: the upstream PyCQA/bandit pre-commit
+  # repo builds from a shallow git clone where pbr resolves the version to
+  # 0.0.0, which breaks plugin-id registration ("Unknown test found in
+  # profile: B104"). A local python hook pulls a properly built wheel instead.
+  - repo: local
     hooks:
       - id: bandit
+        name: bandit
+        entry: bandit
+        language: python
+        types: [python]
         args: [-c, pyproject.toml, -q]
         exclude: ^tests/
-        additional_dependencies: ["bandit[toml]"]
+        additional_dependencies: ["bandit[toml]==1.9.4"]
 
   # ============================================
   # Type checking