serverless-harness/.pre-commit-config.yaml at main · pdettori/serverless-harness · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v5.0.0
    hooks:
      - id: trailing-whitespace
        exclude: ^(packages/k8s-sandbox/src/gen/|gen/)
      - id: end-of-file-fixer
        exclude: ^(packages/k8s-sandbox/src/gen/|gen/)
      - id: check-yaml
        args: [--allow-multiple-documents]
      - id: check-added-large-files
        args: [--maxkb=500]
      - id: check-merge-conflict

  # Prettier runs from the repo's own pinned devDependency (package.json) instead of
  # pre-commit/mirrors-prettier: that mirror is archived upstream and was pinned to a
  # Prettier 4 pre-release, so it could format differently from `make fmt`. Driving the
  # same binary from both makes them identical by construction. Needs `pnpm install`.
  #
  # `ts`/`tsx` are the identify tags for TypeScript -- there is no `typescript` tag, and
  # naming one silently matched no .ts file and then failed config validation outright.
  #
  # Deliberately no `exclude:`. Prettier applies `.prettierignore` even to paths handed to
  # it explicitly, which is exactly how pre-commit invokes it, so `.prettierignore` is the
  # single source of truth for the ignore set -- one list to keep correct instead of two
  # that must agree. Same reasoning as the single pinned binary above.
  - repo: local
    hooks:
      - id: prettier
        name: prettier
        entry: pnpm exec prettier --write --ignore-unknown
        language: system
        types_or: [javascript, jsx, ts, tsx, json, yaml, markdown]

  # `-S warning` matches the shellcheck gate in .github/workflows/security-scans.yml
  # exactly, so the hook and that job cannot disagree about what fails. The scripts are
  # clean at warning+; the remaining info/style findings include SC1091 false positives
  # (shellcheck runs from the repo root and cannot resolve `source ./lib.sh`). Tightening
  # the severity is a separate change from getting the hooks running at all.
  - repo: https://github.com/shellcheck-py/shellcheck-py
    rev: v0.10.0.1
    hooks:
      - id: shellcheck
        args: [-x, -S, warning]
        files: \.sh$

  # `entry` must stay `<image> hadolint`: this previously overrode it to a bare `hadolint`,
  # which is the entry of upstream's *system* hook, so docker_image resolved an image
  # literally named `hadolint` and every run failed before linting anything. The image is
  # pinned to match `rev` -- upstream's own entry is untagged, i.e. :latest.
  - repo: https://github.com/hadolint/hadolint
    rev: v2.12.0
    hooks:
      - id: hadolint-docker
        entry: ghcr.io/hadolint/hadolint:v2.12.0 hadolint

  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.21.2
    hooks:
      - id: gitleaks