.pre-commit-config.yaml

# Pre-commit hooks — catch issues BEFORE they reach CI.
#
# Install (one-time per clone):
#   pip install pre-commit  # or: pip install -e ".[dev]"
#   pre-commit install
#
# Run against the whole tree on demand:
#   pre-commit run --all-files
#
# The hooks mirror the gates in .github/workflows/ci.yml — ruff check +
# ruff format — plus lightweight file hygiene (whitespace, EOF, large
# files, merge-conflict markers, private-key patterns).
#
# CI remains the authoritative gate. Pre-commit is a dev-side convenience
# so you don't discover formatting issues only after pushing.

default_language_version:
  # Pinned to the project's minimum supported version so hook installs
  # work on any contributor box that meets the project's Python floor.
  # CI runs the test matrix on 3.9-3.12; the linters here only need the
  # AST + filesystem tooling, all stable across that range.
  python: python3.9

repos:
  # ── File hygiene ──────────────────────────────────────────────────────
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v5.0.0
    hooks:
      - id: trailing-whitespace
        args: [--markdown-linebreak-ext=md]
      - id: end-of-file-fixer
      - id: check-yaml
        args: [--unsafe]   # allow custom tags in GHA workflows
      - id: check-toml
      - id: check-json
      - id: check-added-large-files
        args: [--maxkb=500]
      - id: check-merge-conflict
      - id: detect-private-key
      - id: mixed-line-ending
        args: [--fix=lf]

  # ── Ruff (lint + format) — mirrors the CI lint job ────────────────────
  # Pinned to match the ruff version shipped with pip install -e ".[dev]".
  # Dependabot tracks ruff-pre-commit; when it opens a PR bumping this rev,
  # also update the ruff version floor in pyproject.toml's dev extras so
  # pre-commit and CI stay aligned and rule selectors don't drift out from
  # under the config (e.g. UP045, which was added in ruff 0.8.x).
  #
  # Scoped to `src/`, `tests/`, and `webapp/` to mirror CI exactly
  # (`.github/workflows/ci.yml` runs `ruff check src/ tests/ webapp/`).
  # scripts/ and .agents/ are excluded — they're developer-only tooling
  # with sys.path shims and other patterns that conflict with ruff defaults.
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.15.11
    hooks:
      - id: ruff
        args: [--fix]
        files: ^(src|tests|webapp)/
      - id: ruff-format
        files: ^(src|tests|webapp)/

  # ── Basic credential-pattern guard ────────────────────────────────────
  # Mirrors the grep patterns in ci.yml's security job so leaks get caught
  # at the `git commit` step, not after push.
  - repo: local
    hooks:
      - id: no-real-credentials
        name: Check for credential patterns
        entry: bash -c 'LEAKS=$(grep -rEn -e "ghp_[A-Za-z0-9]{30,}" -e "github_pat_[A-Za-z0-9_]{60,}" -e "gho_[A-Za-z0-9]{30,}" -e "ghs_[A-Za-z0-9]{30,}" -e "ghu_[A-Za-z0-9]{30,}" -e "ghr_[A-Za-z0-9]{30,}" -e "xoxb-[0-9]{8,}-[0-9]{8,}-[A-Za-z0-9]{20,}" -e "AKIA[A-Z0-9]{16}([^A-Za-z0-9]|$)" -e "sk-ant-api03-[A-Za-z0-9_-]{80,}" -e "sk_live_[A-Za-z0-9]{20,}" -e "sk_test_[A-Za-z0-9]{20,}" -e "rk_(live|test)_[A-Za-z0-9]{20,}" -e "secret_[A-Za-z0-9]{40,}" -e "ntn_[A-Za-z0-9_-]{40,}" -e "lin_api_[A-Za-z0-9]{20,}" -e "ya29\.[A-Za-z0-9_-]{40,}" -e "AIza[A-Za-z0-9_-]{35}" "$@" 2>/dev/null | grep -viE "xxxx|\.\.\.|redacted|<redacted>|example|placeholder|your[_-]?(token|key)"); if [ -n "$LEAKS" ]; then echo "Credential-like pattern detected:"; echo "$LEAKS"; exit 1; fi' --
        language: system
        types: [python]