From 4b8fccaf0254d6d14701159d98e752949436262c Mon Sep 17 00:00:00 2001
From: William Jamieson <wjamieson@stsci.edu>
Date: Fri, 11 Aug 2023 14:41:16 -0400
Subject: [PATCH] Update CI Note the check-style job can be removed once the
 pre-commit.ci bot is enabled

---
 .github/workflows/ci.yml |  1 -
 tox.ini                  | 15 ++++-----------
 2 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4950b5f1..ffc59324 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,6 @@ jobs:
     with:
       envs: |
         - linux: check-style
-        - linux: check-security
         - linux: check-build
   test:
     uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v1
diff --git a/tox.ini b/tox.ini
index 2484e81e..255892a6 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,6 +1,6 @@
 [tox]
 envlist =
-    check-{style,security,build}
+    check-{style,build}
     test{,-warnings,-cov}-xdist
     test-numpy{120,121,122}
     test-{jwst,romancal}-xdist
@@ -19,17 +19,10 @@ envlist =
 description = check code style, e.g. with ruff
 skip_install = true
 deps =
-    ruff
+    pre-commit
 commands =
-    ruff . {posargs}
-
-[testenv:check-security]
-description = run bandit to check security compliance
-skip_install = true
-deps =
-    bandit>=1.7
-commands =
-    bandit stcal -r -x src,tests
+    pre-commit install-hooks
+    pre-commit run {posargs:--color always --all-files --show-diff-on-failure}
 
 [testenv:check-build]
 description = check build sdist/wheel and a strict twine check for metadata