.pre-commit-config.yaml

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: trailing-whitespace
      - id: end-of-file-fixer
      - id: check-yaml
        exclude: ^charts/.*/templates/.*\.yaml$
      - id: check-added-large-files
      - id: check-merge-conflict

  - repo: local
    hooks:
      - id: cargo-fmt
        name: cargo fmt
        entry: cargo fmt --all --check
        language: system
        types: [rust]
        pass_filenames: false

      - id: cargo-clippy
        name: cargo clippy
        entry: env K8S_OPENAPI_ENABLED_VERSION=1.30 cargo clippy --workspace --all-targets --all-features -- -D warnings
        language: system
        types: [rust]
        pass_filenames: false

      - id: cargo-test
        name: cargo test
        entry: env K8S_OPENAPI_ENABLED_VERSION=1.30 cargo test --workspace --all-features
        language: system
        types: [rust]
        pass_filenames: false
        stages: [pre-push]

      # Security-focused hooks
      - id: cargo-deny
        name: cargo deny (dependency security)
        entry: cargo deny check
        language: system
        files: '(Cargo\.(toml|lock)|deny\.toml)$'
        pass_filenames: false

      - id: cargo-audit
        name: cargo audit (vulnerability scan)
        entry: bash -c 'cargo audit --version >/dev/null 2>&1 || echo "cargo-audit not installed, skipping"; cargo audit || echo "Security advisories found (check .cargo/audit.toml for justified exceptions)"'
        language: system
        files: '(Cargo\.(toml|lock)|\.cargo/audit\.toml)$'
        pass_filenames: false

      - id: check-security-sensitive
        name: Check for security-sensitive content
        entry: bash -c 'if grep -r -n -E "(password|secret|private_key|api_key)\s*=" --include="*.rs" --include="*.toml" --exclude-dir=target .; then echo "Potential hardcoded secrets found - please review"; exit 1; fi'
        language: system
        pass_filenames: false

      - id: check-stale-docs
        name: check stale docs
        entry: cargo run --quiet --bin doc-check --
        language: system
        # Run whenever Rust source, docs, or the coverage config changes.
        files: >-
          (?x)^(
            src/.*\.rs|
            docs/.*\.md|
            doc-coverage\.toml|
            \.doc-hashes\.toml|
            Makefile|
            Cargo\.toml|
            build\.rs|
            charts/.*|
            examples/.*|
            config/.*|
            benchmarks/.*|
            formal_verification/.*|
            tests/.*\.rs
          )$
        pass_filenames: false
        # Only warn locally — CI enforces the hard failure.
        args: ["--warn-only", "status"]

  - repo: https://github.com/adrienverge/yamllint.git
    rev: v1.35.1
    hooks:
      - id: yamllint
        args: [-c=.yamllint.yml]
        exclude: ^charts/.*/templates/.*\.yaml$