monitoring-plugins/.pre-commit-config.yaml at main · Linuxfabrik/monitoring-plugins · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
repos:
  - repo: 'https://github.com/digitalpulp/pre-commit-php'
    rev: '1.4.0'
    hooks:
      - id: 'php-lint-all'

  - repo: 'https://github.com/gitleaks/gitleaks'
    rev: 'v8.30.0'
    hooks:
      - id: 'gitleaks'

  - repo: 'https://github.com/jumanjihouse/pre-commit-hooks'
    rev: '3.0.0'
    hooks:
      - id: 'shellcheck'

  - repo: 'https://github.com/pre-commit/pre-commit-hooks'
    rev: 'v6.0.0'
    hooks:
      - id: 'check-added-large-files'
      - id: 'check-merge-conflict'
      - id: 'check-yaml'
      # Unit-test fixtures are verbatim captures of what a command, an endpoint or a
      # configuration file really contains, down to a missing trailing newline or a
      # line carrying a single space. Both are what the test asserts on, so neither
      # hook may normalise them. Vendor MIBs are shipped as received for the same
      # reason: a diff against the vendor's own file has to stay empty.
      - id: 'end-of-file-fixer'
        exclude: '/unit-test/(config|fixtures|retc|stderr|stdout|wordpress)/|/device-mibs/'
      - id: 'trailing-whitespace'
        exclude: '/unit-test/(config|fixtures|retc|stderr|stdout|wordpress)/|/device-mibs/'

  - repo: 'https://github.com/astral-sh/ruff-pre-commit'
    rev: 'v0.16.6'
    hooks:
      - id: 'ruff-check'
        args: ['--fix']
      - id: 'ruff-format'

  # pylint is deliberately not run as a hook. Its metric checks (R0912 branches,
  # R0914 locals, R0915 statements) fire on almost every plugin, because a check
  # plugin is one long linear function by design, and C0301 measures against
  # pylint's own 100-character default while the house limit is the 88 characters
  # ruff enforces. The result was a hook that failed on every Python file in the
  # repo. Suppressing that much would leave pylint without a job here, so it stays
  # a manual, per-plugin audit tool - the same reasoning `tools/run-linter-checks`
  # spells out for leaving pylint out of the repo-wide sweep.

  - repo: 'https://github.com/PyCQA/bandit'
    rev: '1.9.4'
    hooks:
      - id: 'bandit'
        args: ['-c', 'pyproject.toml', '--severity-level=low', '--confidence-level=low']
        additional_dependencies: ['bandit[toml]']
        types_or: ['python']

  - repo: 'https://github.com/jendrikseipp/vulture'
    rev: 'v2.16'
    hooks:
      # The upstream hook ships `pass_filenames: false` and expects the scope in
      # `[tool.vulture] paths`, which only works for repos whose Python files carry a
      # `.py` extension. Ours are extension-less shebang scripts, so the staged files
      # are passed explicitly. min_confidence lives in pyproject.toml so a hand-run
      # of `vulture <file>` behaves like the hook.
      - id: 'vulture'
        pass_filenames: true
        types_or: ['python']