agent-kit/prek.toml at main · mitodl/agent-kit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
# prek.toml — pre-commit hook configuration
# Docs: https://prek.j178.dev
#
# Install hooks:      prek install
# Run on all files:   prek run --all-files
# Update pinned revs: prek auto-update

# ── Built-in: fast Rust-native checks (priority 0) ────────────────────────────
# No network, no environment setup — run first to catch trivial issues cheaply.

[[repos]]
repo = "builtin"

[[repos.hooks]]
id = "trailing-whitespace"
priority = 0

[[repos.hooks]]
id = "end-of-file-fixer"
priority = 0

[[repos.hooks]]
id = "check-merge-conflict"
priority = 0

[[repos.hooks]]
id = "check-case-conflict"
priority = 0

[[repos.hooks]]
id = "check-added-large-files"
priority = 0

[[repos.hooks]]
id = "check-toml"
priority = 0

[[repos.hooks]]
id = "check-yaml"
priority = 0

[[repos.hooks]]
id = "check-json"
priority = 0

[[repos.hooks]]
id = "check-executables-have-shebangs"
priority = 0

[[repos.hooks]]
id = "check-shebang-scripts-are-executable"
priority = 0

[[repos.hooks]]
id = "detect-private-key"
priority = 0
# The witan scanner's own test fixtures contain a sample PEM header on purpose;
# gitleaks handles them via inline `# gitleaks:allow`, but detect-private-key has
# no inline pragma, so exclude that one fixture file here.
exclude = "^mcp/servers/witan/tests/test_detectors\\.py$"

# ── Shell: shellcheck (priority 10) ───────────────────────────────────────────

[[repos]]
repo = "https://github.com/shellcheck-py/shellcheck-py"
rev = "v0.11.0.1"
hooks = [{ id = "shellcheck", priority = 10 }]

# ── GitHub Actions: actionlint (priority 10, parallel with shellcheck) ────────

[[repos]]
repo = "https://github.com/rhysd/actionlint"
rev = "v1.7.12"

[[repos.hooks]]
id = "actionlint"
priority = 10
files = "^\\.github/workflows/.*\\.ya?ml$"

# ── GitHub Actions: zizmor (priority 10, parallel with shellcheck) ────────────

[[repos]]
repo = "https://github.com/zizmorcore/zizmor-pre-commit"
rev = "v1.29.0"

[[repos.hooks]]
id = "zizmor"
priority = 10
args = ["--no-progress", "--min-severity=high", "--min-confidence=medium"]

# ── Secrets: gitleaks (priority 10, parallel with shellcheck) ─────────────────
# Comprehensive secret scanning; complements the builtin detect-private-key.
# Checks staged changes only (gitleaks protect).

[[repos]]
repo = "https://github.com/gitleaks/gitleaks"
rev = "v8.30.1"
hooks = [{ id = "gitleaks", priority = 10 }]

# ── Markdown: markdownlint (priority 10, parallel) ────────────────────────────
# MD013 disabled — code blocks in skill files have long lines by necessity.
# MD033 disabled — issue/PR template skills contain HTML comments as placeholders.

[[repos]]
repo = "https://github.com/igorshubovych/markdownlint-cli"
rev = "v0.48.0"
hooks = [
  { id = "markdownlint", priority = 10, args = [
    "--disable",
    "MD013",
    "MD033",
  ] },
]

# ── Python: ruff (priority 20 format → 30 lint) ───────────────────────────────
# Format runs first (priority 20); lint runs after (priority 30) so ruff check
# always sees already-formatted code and avoids spurious format-related findings.
# Covers Python added for the planned witan MCP server.

[[repos]]
repo = "https://github.com/astral-sh/ruff-pre-commit"
rev = "v0.15.15"

[[repos.hooks]]
id = "ruff-format"
priority = 20

[[repos.hooks]]
id = "ruff"
priority = 30

# ── TypeScript / JS / JSON: biome (priority 20, parallel with ruff-format) ────
# biome-check runs format + lint in one pass with --write (auto-fixes what it
# can; unfixable issues fail the commit). Safe to run parallel with ruff-format
# since the two tools operate on disjoint file types (.py vs .ts/.tsx/.json).
# Covers TypeScript for planned pi extensions and JSON config snippets.

[[repos]]
repo = "https://github.com/biomejs/pre-commit"
rev = "v2.4.16"
hooks = [{ id = "biome-check", priority = 20 }]