.pre-commit-config.yaml

default_install_hook_types: [pre-commit, pre-push]

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v6.0.0
    hooks:
      - id: trailing-whitespace
      - id: end-of-file-fixer
      - id: check-yaml
      - id: check-added-large-files

  # Terraform static checks - run on every commit via direnv-provided tools
  # (Nix shell at .envrc supplies opentofu, tflint, terraform-docs).
  # Same checks run in CI via .github/workflows/ci-gate.yml as a safety net.
  # terraform_fmt uses the pre-commit-terraform hook directly (no binary lookup).
  # terraform_validate and terraform_tflint need the nix-provided binary, so they
  # are local hooks that use direnv exec to enter the nix shell first.
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.92.0
    hooks:
      - id: terraform_fmt

  # Checkov - Terraform IaC security scanner
  - repo: https://github.com/bridgecrewio/checkov.git
    rev: 3.2.526
    hooks:
      - id: checkov
        args: ['-d', '.', '--framework', 'terraform', '--quiet']
        pass_filenames: false

  # Secret scanning — official gitleaks hook, driven by the committed
  # value-free .gitleaks.toml. The same scan runs in CI (ci-gate.yml).
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.30.1
    hooks:
      - id: gitleaks

  # Local hooks using nix+doppler toolchain
  - repo: local
    hooks:
      - id: terraform-validate
        name: Terraform validate
        entry: direnv exec . bash -c 'tofu init -backend=false -no-color && tofu validate -no-color'
        language: system
        files: '\.(tf|hcl)$'
        pass_filenames: false
      - id: terraform-tflint
        name: Terraform tflint
        entry: direnv exec . bash -c 'tflint --init && tflint --minimum-failure-severity=error --only=terraform_deprecated_interpolation --only=terraform_deprecated_index --only=terraform_unused_declarations --only=terraform_comment_syntax --only=terraform_documented_outputs --only=terraform_documented_variables --only=terraform_typed_variables --only=terraform_module_pinned_source --only=terraform_naming_convention --only=terraform_required_version --only=terraform_required_providers --only=terraform_standard_module_structure'
        language: system
        files: '\.(tf|hcl)$'
        pass_filenames: false
      - id: tofu-test
        name: tofu test (mock providers)
        entry: direnv exec . bash -c 'tofu init -backend=false -no-color && tofu test -no-color && tofu -chdir=modules/proxmox-stack init -backend=false -no-color && tofu -chdir=modules/proxmox-stack test -no-color'
        language: system
        files: '\.(tf|hcl)$'
        pass_filenames: false