flock/.pre-commit-config.yaml at main · whiteducksoftware/flock · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
# Flock Pre-commit Hooks
# Quality gates that run before every commit
#
# Installation:
#   pip install pre-commit
#   pre-commit install
#
# Manual run:
#   pre-commit run --all-files
#
# Skip hooks (emergency only):
#   git commit --no-verify

repos:
  # Ruff - Fast Python linter and formatter
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.13.3
    hooks:
      # Run the linter (only fail on errors, not style suggestions)
      - id: ruff
        name: ruff lint
        args: [--fix, --exit-zero]  # Don't fail the hook, just fix what's possible
        types_or: [python, pyi]

      # Run the formatter
      - id: ruff-format
        name: ruff format
        types_or: [python, pyi]

  # General file checks
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v5.0.0
    hooks:
      - id: trailing-whitespace
        name: trim trailing whitespace
      - id: end-of-file-fixer
        name: fix end of files
      - id: check-yaml
        name: validate yaml files
        args: [--unsafe]  # Allow custom YAML tags (needed for mkdocs.yml)
      - id: check-toml
        name: validate toml files
      - id: check-json
        name: validate json files
        exclude: tsconfig.*\.json$  # Exclude TypeScript config (uses JSON5)
      - id: check-added-large-files
        name: check for large files
        args: [--maxkb=1000]  # 1 MB limit
      - id: check-merge-conflict
        name: check for merge conflicts
      - id: detect-private-key
        name: detect private keys
      - id: mixed-line-ending
        name: fix mixed line endings

  # Security checks
  - repo: local
    hooks:
      - id: bandit
        name: security scan with bandit
        entry: bash -c 'bandit -c pyproject.toml -r src/flock/ -ll || echo "⚠️  Low severity security issues found - please review"'
        language: system
        pass_filenames: false
        files: ^src/flock/

  # Frontend - TypeScript and React checks
  - repo: local
    hooks:
      # TypeScript type checking
      - id: tsc
        name: typescript type check
        entry: bash -c 'cd src/flock/frontend && npm run type-check'
        language: system
        files: \.tsx?$
        pass_filenames: false

      # Frontend build check (ensures no build errors)
      - id: frontend-build
        name: frontend build check
        entry: bash -c 'cd src/flock/frontend && npm run build'
        language: system
        files: ^src/flock/frontend/
        pass_filenames: false
        stages: [pre-push]  # Only on push, not on every commit

  # Backend build check
  - repo: local
    hooks:
      - id: uv-build
        name: backend build check
        entry: bash -c 'uv build'
        language: system
        files: ^(src/|pyproject\.toml|uv\.lock)
        pass_filenames: false
        stages: [pre-push]  # Only on push, not on every commit

  # Version checks (pre-push only)
  - repo: local
    hooks:
      - id: version-check
        name: check if version bump needed
        entry: python scripts/check_version_bump.py
        language: system
        stages: [pre-push]  # Only warn on push
        pass_filenames: false
        verbose: true

# Performance configuration
default_install_hook_types: [pre-commit, pre-push]
default_stages: [pre-commit]

# Faster execution
fail_fast: false