fix(ci): restore actions/checkout SHA pin + ruff format cli.py

- Restore supply-chain security: pin actions/checkout@v4 to
  11d5960a326750d5838078e36cf38b85af677262 (v4.2.2) in ci.yml,
  publish.yml, and cowork-auto-pr.yml
- Apply ruff format to src/deploydiff/cli.py
- Addresses reviewer REQUEST_CHANGES on PR #47

Author: Coding-Dev-Tools

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
         with:
           persist-credentials: false
 

.github/workflows/cowork-auto-pr.yml

@@ -16,7 +16,7 @@ jobs:
       # without this step every run failed with "not a git repository" and no
       # PR was ever opened (fleet-wide defect: 11/11 seeded copies lacked it).
       - name: Check out the pushed branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
         with:
           ref: ${{ github.ref_name }}
           fetch-depth: 0

.github/workflows/publish.yml

@@ -21,7 +21,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
         with:
           persist-credentials: false
 

src/deploydiff/cli.py

@@ -73,17 +73,13 @@ def main(ctx, no_gate, require_license_flag) -> None:
     type=click.Path(exists=True),
     help="Pulumi preview JSON file",
 )
-@click.option(
-    "-v", "--verbose", is_flag=True, help="Show before/after details for each change"
-)
+@click.option("-v", "--verbose", is_flag=True, help="Show before/after details for each change")
 @click.option(
     "--exit-on-destroy",
     is_flag=True,
     help="Exit with code 1 if the plan contains destructive changes (deletes or replaces)",
 )
-def preview(
-    terraform_file, cloudformation_file, pulumi_file, verbose, exit_on_destroy
-) -> None:
+def preview(terraform_file, cloudformation_file, pulumi_file, verbose, exit_on_destroy) -> None:
     """Preview infrastructure changes from a plan file."""
     plan = _load_plan(terraform_file, cloudformation_file, pulumi_file)
     if plan is None:
@@ -131,9 +127,7 @@ def preview(
     default=None,
     help="Exit with code 1 if total monthly cost delta exceeds this value (e.g. 500 for $500)",
 )
-def cost(
-    terraform_file, cloudformation_file, pulumi_file, pricing_file, threshold
-) -> None:
+def cost(terraform_file, cloudformation_file, pulumi_file, pricing_file, threshold) -> None:
     """Estimate monthly cost impact of infrastructure changes. (Pro feature)"""
     if _HAS_RH_LICENSE:
         from revenueholdings_license import require_tier
@@ -203,9 +197,7 @@ def _load_plan(
     if len(provided) == 0:
         return None
     if len(provided) > 1:
-        console.print(
-            "[red]Error: Provide only one source file (--tf, --cfn, or --pulumi)[/red]"
-        )
+        console.print("[red]Error: Provide only one source file (--tf, --cfn, or --pulumi)[/red]")
         raise SystemExit(1)
 
     if terraform_file:
@@ -218,9 +210,7 @@ def _load_plan(
     return None
 
 
-def _render_costs(
-    estimates: list[CostEstimate], plan: DeployPlan, console: Console
-) -> None:
+def _render_costs(estimates: list[CostEstimate], plan: DeployPlan, console: Console) -> None:
     """Render cost estimates to the console."""
     from rich import box
     from rich.table import Table
@@ -253,9 +243,7 @@ def _render_costs(
     if total > 0:
         console.print(f"\n[bold red]Total monthly increase: +${total:.2f}[/bold red]")
     elif total < 0:
-        console.print(
-            f"\n[bold green]Total monthly decrease: -${abs(total):.2f}[/bold green]"
-        )
+        console.print(f"\n[bold green]Total monthly decrease: -${abs(total):.2f}[/bold green]")
     else:
         console.print("\n[bold]Total monthly change: $0.00[/bold]")