pre-commit-config.yaml

repos:
  # Standard pre-commit hooks
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b #v5.0.0
    hooks:
      - id: check-added-large-files
        args: [--maxkb=36000]
      - id: check-json
      - id: check-yaml
      - id: trailing-whitespace

  # Github actions
  - repo: https://github.com/rhysd/actionlint
    rev: 5db9d9cde2f3deb5035dea3e45f0a9fff2f29448
    hooks:
      - id: actionlint
        name: Check Github Actions

  # Secrets detection
  - repo: https://github.com/Yelp/detect-secrets
    rev: 01886c8a910c64595c47f186ca1ffc0b77fa5458
    hooks:
      - id: detect-secrets

  - repo: local
    hooks:
      # Ensure GH actions are pinned to a specific hash
      - id: check-github-actions
        name: Check GitHub Actions for Pinned Dependencies
        entry: python .scripts/check_pinned_hash_dependencies.py
        language: python
        files: \.github/.*\.yml$