Mahdis/.pre-commit-config.yaml at main · Amir83Nasr/Mahdis · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
# ── Pre-commit Configuration ─────────────────────────────────────────────
# See https://pre-commit.com for more information.
#
# Install:
#   pre-commit install
#
# Run on all files:
#   pre-commit run --all-files
# ──────────────────────────────────────────────────────────────────────────

repos:
  # ── Generic Repository Hooks ───────────────────────────────────────────
  # File-level hygiene: whitespace, merge markers, syntax validation.
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v5.0.0
    hooks:
      # Remove trailing whitespace from all lines
      - id: trailing-whitespace

      # Ensure every file ends with exactly one newline
      - id: end-of-file-fixer

      # Block commit if unresolved merge conflict markers are present
      - id: check-merge-conflict

      # Validate YAML syntax (pre-commit config, CI files, etc.)
      - id: check-yaml

      # Validate JSON syntax (package.json, tsconfig, etc.)
      - id: check-json

      # Validate TOML syntax (pyproject.toml, etc.)
      - id: check-toml

      # Reject files containing private keys (preliminary — not a replacement
      # for Gitleaks, but catches obvious key files early)
      - id: detect-private-key

      # Normalise all text files to LF line endings
      - id: mixed-line-ending
        args: [--fix=lf]

  # ── Python: Ruff (lint then format) ────────────────────────────────────
  # Fast Python linter and formatter. Config lives in backend/pyproject.toml.
  # Version pinned to match backend/requirements/dev.txt.
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.8.4
    hooks:
      # Safe auto-fixes for lint rules (import sorting, bugbear, etc.).
      # Exits non-zero when fixes are applied so you re-stage and retry.
      - id: ruff
        args: [--fix, --exit-non-zero-on-fix]
        exclude: ^backend/migrations/versions/

      # Format Python code according to project config (line-length=100).
      - id: ruff-format
        exclude: ^backend/migrations/versions/

  # ── Frontend: Prettier ─────────────────────────────────────────────────
  # Uses the project's Prettier via pnpm to ensure plugin compatibility
  # (prettier-plugin-tailwindcss, etc.) and match the .prettierrc config.
  - repo: local
    hooks:
      - id: prettier
        name: Prettier (frontend)
        description: |
          Auto-format frontend JS/TS/JSON/CSS/MD files via the project's
          Prettier installation. Strips the "frontend/" path prefix so the
          .prettierrc and prettier-plugin-tailwindcss resolve correctly.
        entry: scripts/pre-commit/prettier-hook.sh
        language: script
        files: ^frontend/.*\.(js|mjs|cjs|ts|tsx|jsx|json|css|md)$

  # ── Frontend: ESLint ───────────────────────────────────────────────────
  # ESLint 9 flat config with eslint-config-next.
  # Runs via pnpm exec to use the project's exact dependency versions.
  - repo: local
    hooks:
      - id: eslint
        name: ESLint (frontend)
        description: |
          Lint and auto-fix frontend JS/TS files with ESLint 9 flat config.
          Runs from the frontend directory so flat config resolves correctly.
        entry: scripts/pre-commit/eslint-hook.sh
        language: script
        files: ^frontend/.*\.(js|mjs|ts|tsx|jsx)$

  # ── Secret Scanning: Gitleaks ──────────────────────────────────────────
  # Detects hardcoded secrets, API keys, tokens, passwords, and credentials
  # before they can be committed. Runs on the full repo, not just staged files,
  # to catch secrets in unstaged-but-being-committed content.
  #
  # Requires: brew install gitleaks  (or your OS package manager equivalent)
  - repo: local
    hooks:
      - id: gitleaks
        name: Gitleaks (secret scanning)
        description: |
          Scan the entire repository for hardcoded secrets, API keys,
          tokens, passwords, and other credentials using Gitleaks.
          Gracefully skips if Gitleaks is not installed.
        entry: scripts/pre-commit/gitleaks-wrapper.sh
        language: script
        pass_filenames: false
        verbose: false

  # ── Alembic Migration Chain Check ──────────────────────────────────────
  # Lightweight validation of the migration chain. Runs only when files
  # under backend/migrations/ change. Does NOT connect to the database.
  # Validates: single chain (no branches/orphans), no duplicate revisions.
  - repo: local
    hooks:
      - id: check-migrations
        name: Check Alembic migrations
        description: |
          Validate Alembic migration chain consistency without requiring a
          database connection — checks for orphan revisions, multiple heads,
          and duplicate revision IDs.
        entry: python3 scripts/pre-commit/check-migrations.py
        language: system
        files: ^backend/migrations/
        pass_filenames: false