verity/.pre-commit-config.yaml at main · verity-org/verity · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
# All tools are managed by mise — use `language: system` everywhere to avoid
# version conflicts. Run `mise install` before enabling these hooks.
#
# Setup:  pre-commit install
# Manual: pre-commit run --all-files

repos:
  # ── Basic file hygiene ────────────────────────────────────────────────────
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v5.0.0
    hooks:
      - id: trailing-whitespace
      - id: end-of-file-fixer
      - id: mixed-line-ending
        args: [--fix=lf]
      - id: check-merge-conflict
      - id: check-yaml
        # Exclude GitHub Actions workflows — yamllint covers those with
        # context-aware rules; check-yaml can trip on ${{ }} expressions.
        exclude: ^\.github/workflows/
      - id: check-json
      - id: check-added-large-files
        args: [--maxkb=500]
      - id: detect-private-key

  # ── Go ────────────────────────────────────────────────────────────────────
  - repo: local
    hooks:
      - id: golangci-lint
        name: golangci-lint
        language: system
        entry: golangci-lint run --fix --timeout=5m
        types: [go]
        pass_filenames: false

  # ── YAML ─────────────────────────────────────────────────────────────────
  - repo: local
    hooks:
      - id: yamllint
        name: yamllint
        language: system
        entry: yamllint -c .yamllint.yml
        types: [yaml]

  # ── GitHub Actions ────────────────────────────────────────────────────────
  - repo: local
    hooks:
      - id: actionlint
        name: actionlint
        language: system
        entry: actionlint
        files: ^\.github/workflows/.*\.ya?ml$
        pass_filenames: false

  # ── Shell ─────────────────────────────────────────────────────────────────
  - repo: local
    hooks:
      - id: shellcheck
        name: shellcheck
        language: system
        entry: shellcheck
        files: ^\.github/scripts/.*\.sh$

  # ── Image configs ─────────────────────────────────────────────────────────
  - repo: local
    hooks:
      - id: integer-validate
        name: integer validate
        language: system
        entry: make integer-validate
        files: ^(images/.*\.ya?ml|integer.yaml)$
        pass_filenames: false

  # ── Security ──────────────────────────────────────────────────────────────
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.16.3
    hooks:
      - id: gitleaks
  - repo: https://github.com/pre-commit/mirrors-eslint
    rev: v8.38.0
    hooks:
      - id: eslint