.pre-commit-config.yaml

minimum_pre_commit_version: "3.7.0"
default_install_hook_types:
  - pre-commit
  - commit-msg

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c
    hooks:
      - id: detect-private-key
      - id: check-added-large-files
      - id: check-json
      - id: check-merge-conflict
      - id: check-symlinks
      - id: check-yaml
      - id: end-of-file-fixer
      - id: trailing-whitespace

  - repo: https://github.com/compilerla/conventional-pre-commit
    rev: 3db014c16a9d31997ab8c07a4d61fcce936c8f0d
    hooks:
      - id: conventional-pre-commit
        stages:
          - commit-msg


  - repo: https://github.com/trussworks/pre-commit-hooks
    rev: f72781be8d6b5e92653232bfb13f3f10cb1fc0c4
    hooks:
      - id: markdown-toc
        files: ^README\.md$

  - repo: https://github.com/DavidAnson/markdownlint-cli2
    rev: 3766ad839ad3a74558031510b3bc9872bb1d9980
    hooks:
      - id: markdownlint-cli2
        files: ^README\.md$

  - repo: https://github.com/codespell-project/codespell
    rev: 2ccb47ff45ad361a21071a7eedda4c37e6ae8c5a
    hooks:
      - id: codespell
        args:
          - --write-changes
          # `vulnerabilit(y|ies)` in go-security.yaml is deliberate — one string
          # covering both singular and plural. codespell sees the bare prefix.
          - --ignore-words-list=vulnerabilit

  - repo: local
    hooks:
      - id: actionlint
        name: actionlint
        # -ignore drops a false positive: `github.job_workflow_sha` is a real
        # context property for reusable workflows, but actionlint v1.7.12's
        # bundled schema doesn't know it. Used by go-lint, semantic-release and
        # semantic-release-preview to pin the shared config to the workflow SHA.
        entry: bash -c 'GOWORK=off go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 -ignore "job_workflow_sha"'
        language: system
        pass_filenames: false
        files: ^\.github/workflows/.*\.ya?ml$

  # Refuse any commit whose STAGED content contains a secret. Added org-wide on
  # 2026-10-06 after three OpenTofu state files carrying a dev SSH private key
  # and a live Cloudflare Access OAuth client secret were committed to
  # kupe-tests (99e0452) and sat in history for 34 days. gitleaks v8.30.1 flags
  # all of them, so this would have blocked that commit.
  #
  # Chosen over GitHub secret scanning because push protection needs the paid
  # Secret Protection product on private repos ($19/committer/month) and only
  # alerts AFTER the push; this refuses before the commit exists.
  - repo: https://github.com/gitleaks/gitleaks
    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e # v8.30.1
    hooks:
      - id: gitleaks