Add pre-commit setup and remove unused six dependency

[jconstance-amplify]

Summary

Adds a proper pre-commit configuration mirroring the org's modern reference (eng-guidance-mcp) per DRAFT-032: Pre-commit Standards, plus a GitHub Actions workflow that enforces the hooks in CI. Removes the unused six dependency. All other production-code edits are behavior-preserving cleanups — the CLI invocation surface is byte-identical.

Why

The repo had no pre-commit setup, so style/lint issues only surface in code review (or not at all). Adopting the standard hooks gives us:

• Pre-commit enforcement in CI (pre-commit/action@v3.0.1 with base-branch merge per DRAFT-032).
• Secret scanning at commit time — detect-private-key, detect-aws-credentials, check-added-large-files.
• Auto-formatting — black, isort, yamlfmt, mdformat — so the codebase converges on a single style.
• Static analysis — mypy (scoped to ^oktaawscli/) + pylint, with a permissive but documented pylintrc for the legacy patterns this codebase already uses.

What's in the box

Pre-commit configuration

• .pre-commit-config.yaml, .yamllint.yml, mypy.ini, pylintrc — adapted from the eng-guidance-mcp reference.
• .github/workflows/pre-commit.yml — runs pre-commit/action@v3.0.1 on every PR with --all-files --show-diff-on-failure. Uses ubuntu-latest (this repo is public; org self-hosted runners are disabled for public repos) and Python 3.11 (matches pr_check.yml).

Behavior-preserving cleanups

• Drop unused six import + dependency (requirements.txt, setup.py, oktaawscli/aws_auth.py).
• Refactor setup.py to parse __version__ via regex instead of exec(open(...).read()) — mypy-clean and avoids implicit eval.
• Simplify role_choice >= 0 and role_choice < len(role_info) → 0 <= role_choice < len(role_info) in aws_auth.py.
• Drop unused as ex binding from except ClientError: in aws_auth.py:303.
• Add # type: ignore[name-defined] # noqa: F821 to the py2 raw_input compat shim in okta_auth_config.py:10.
• Remove inline # pylint: disable=... headers from the three oktaawscli/ modules; rules centralized in pylintrc. The E1120 disable/enable pair around click's main() invocation is preserved.

All other diffs are pure auto-formatting from black/isort/yamlfmt/mdformat.

Why these specific hooks

The pylintrc disable list is broad — the codebase has Python 2/3 compat shims (input = input, input = raw_input), %-formatted log strings, mixed exit() vs sys.exit(), and no type annotations. Each disable has a rationale comment. The intent is a permissive baseline for this legacy code so new contributions get caught without forcing a refactoring pass on existing code.

Test plan

• CI checks pass:
  • Pre-commit workflow (new) runs cleanly against the merge result.
  • PR check workflow (existing) runs the 23-test unittest suite under tox.
• Single-process okta-awscli --okta-profile X works unchanged.
• pip install . installs cleanly and reports the expected version (0.4.14).
• python -O setup.py --version reports 0.4.14 (no AssertionError if the regex stripped out).

Related

• DRAFT-032: Pre-commit Standards
• Reference config: amplify-education/eng-guidance-mcp/.pre-commit-config.yaml
• Prior branch work: Lock dotfile writes to support parallel okta-awscli processes #29 (file locking), Remove orphan security.yml workflow that can't run on this public repo #30 (orphan security workflow), Release 0.4.14 #31 (0.4.14 release) — all merged.

🤖 Generated with Claude Code