lfops/.pre-commit-config.yaml at main · Linuxfabrik/lfops · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
repos:
  - repo: 'https://github.com/adrienverge/yamllint'
    rev: 'v1.38.0'
    hooks:
      - id: 'yamllint'
        args: ['-c=.yamllint.yml']
        files: '\.(yaml|yml)$'
        types: ['file', 'yaml']
        entry: 'yamllint'

  - repo: 'https://github.com/pre-commit/pre-commit-hooks'
    rev: 'v6.0.0'
    hooks:
      - id: 'check-added-large-files'
      - id: 'check-ast'
      - id: 'fix-byte-order-marker'
      - id: 'check-case-conflict'
      - id: 'check-executables-have-shebangs'
      - id: 'check-json'
      - id: 'check-merge-conflict'
      - id: 'check-yaml'
        args: ['--unsafe']
      - id: 'debug-statements'
      - id: 'detect-private-key'
        # gpg_key returns ASCII-armored exports; the RETURN sample contains
        # the literal PGP private key block header for documentation, which
        # the hook regex-matches as if it were a real key.
        exclude: '^plugins/modules/gpg_key\.py$'
      - id: 'end-of-file-fixer'
      - id: 'mixed-line-ending'
      - id: 'trailing-whitespace'

  - repo: 'https://github.com/astral-sh/ruff-pre-commit'
    rev: 'v0.16.6'
    hooks:
      - id: 'ruff-check'
        args: ['--fix']
      - id: 'ruff-format'

  - repo: 'https://github.com/PyCQA/bandit'
    rev: '1.9.4'
    hooks:
      - id: 'bandit'
        args: ['-c', 'pyproject.toml', '--severity-level=low', '--confidence-level=low']
        additional_dependencies: ['bandit[toml]']
        # `plugins/modules/ipa*.py` is vendored ansible-freeipa code; bandit
        # false-positives on the project's own code style (`shell=dict(...)`
        # in argument_spec triggers B604, the literal `'on_create'` sentinel
        # triggers B105). Out of scope for in-tree review.
        # `plugins/module_utils/gnupg.py` is vendored python-gnupg kept
        # byte-identical with upstream; bandit flags its (expected) subprocess
        # use (B404/B603) and asserts (B101), which we do not patch out.
        # `tests/` holds unit tests whose fixtures use throwaway passwords
        # (B105/B106); scanning test fixtures for hardcoded secrets is noise.
        exclude: '^(plugins/modules/ipa.*|plugins/module_utils/gnupg|tests/.*)\.py$'
        types_or: ['python']

  - repo: 'https://github.com/jendrikseipp/vulture'
    rev: 'v2.16'
    hooks:
      - id: 'vulture'
        args: ['--min-confidence=80']
        types_or: ['python']

  - repo: 'local'
    hooks:
      - id: 'pytest-unit'
        name: 'pytest (plugin unit tests)'
        # Fast single-interpreter run of the controller-plugin unit tests on
        # every commit. The full Python x ansible-core matrix runs in CI via
        # tox; see tests/README.md.
        entry: 'pytest tests/unit'
        language: 'python'
        additional_dependencies: ['ansible-core', 'pytest', 'pyyaml']
        pass_filenames: false
        files: '^(plugins/|tests/unit/)'
        types_or: ['python']