.pre-commit-config.yaml

repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: "v8.28.0"
    hooks:
      - id: gitleaks
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v5.0.0
    hooks:
      - id: check-merge-conflict
      - id: detect-private-key
      - id: detect-aws-credentials
        args:
          - --allow-missing-credentials
      - id: end-of-file-fixer
      - id: trailing-whitespace
  - repo: https://github.com/bridgecrewio/checkov
    rev: "3.2.457"
    hooks:
      - id: checkov
        args: ["--config-file", ".config/.checkov.yml", "--quiet"]
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: "v1.99.5"
    hooks:
      - id: terraform_docs
        args:
          # Uses antonbabenko/pre-commit-terraform (supports monorepo with multiple modules)
          # --hook-config: antonbabenko wrapper settings for file handling
          - --hook-config=--add-to-existing-file=true # Update existing README.md files (requires BOTH <!-- BEGIN_TF_DOCS --> and <!-- END_TF_DOCS --> markers)
          - --hook-config=--create-file-if-not-exist=false # Don't create new README.md files
          # --args: terraform-docs binary arguments
          - --args=--config=.config/.terraform-docs.yml # Use our terraform-docs config file
          - --args=--lockfile=false # Ignore .terraform.lock.hcl, use versions.tf instead (fixes version mismatches)
      - id: terraform_validate
        args:
          - --tf-init-args=-upgrade # Always upgrade to match versions.tf (source of truth)
          - --hook-config=--retry-once-with-cleanup=true # If validation fails, delete corrupted .terraform dirs and retry
          - --args=-no-color # Cleaner output
      - id: terraform_fmt
      - id: terraform_tflint
  - repo: https://github.com/lycheeverse/lychee
    rev: "v0.15.1"
    hooks:
      - id: lychee
        name: Check links in staged markdown files
        args: ["--config", ".config/lychee.toml", "--no-progress"]
        types: [markdown]
  - repo: https://github.com/DavidAnson/markdownlint-cli2
    rev: "v0.14.0"
    hooks:
      - id: markdownlint-cli2
        name: Lint staged markdown files
        args: ["--config", ".config/.markdownlint-cli2.jsonc", "--fix"]
        types: [markdown]
  - repo: https://github.com/jumanjihouse/pre-commit-hooks
    rev: 3.0.0
    hooks:
      - id: shellcheck
  - repo: https://github.com/pylint-dev/pylint
    rev: v3.3.2
    hooks:
      - id: pylint
        exclude: ^assets/packer/ # Exclude legacy packer scripts from linting