agentium-os/.pre-commit-config.yaml at main · semiotic-agentium/agentium-os · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
# Pre-commit hooks for Rust project
# Install pre-commit: pip install pre-commit
# Then run: pre-commit install

repos:
  # Secret scanning — block commits that introduce credentials. Honours the
  # committed .gitleaks.toml allowlist (placeholder tokens, test fixtures).
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.30.1
    hooks:
      - id: gitleaks

  # General file checks
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: trailing-whitespace
        exclude: ^models/fastembed/
      - id: end-of-file-fixer
        # HF hub layout: refs/main must be raw revision bytes (no trailing newline);
        # tokenizer/config blobs must not be rewritten by EOF normalization.
        exclude: ^models/fastembed/
      - id: check-yaml
        exclude: ^deploy/helm/
      - id: check-json
      - id: check-toml
      - id: check-added-large-files
        args: ['--maxkb=1000']
        exclude: ^models/
      - id: check-merge-conflict
      - id: check-case-conflict

  # Rust formatting and clippy (language: system respects rust-toolchain.toml)
  - repo: local
    hooks:
      - id: fmt
        name: cargo fmt
        entry: cargo fmt -- --check
        language: system
        pass_filenames: false
        types: [rust]
      - id: clippy
        name: cargo clippy
        entry: cargo clippy --all-targets --all-features -- -D warnings
        language: system
        pass_filenames: false
        types: [rust]

      # After clippy warms the same builder/tool graph, ensure committed
      # _baml_runtime.baml / baml-runtime.d.ts match the generator when
      # builder, tools, or agent trees change. Skip: SKIP=regen-fixtures git commit
      - id: regen-fixtures
        name: regen fixtures (agents + test fixtures)
        entry: bash scripts/pre-commit-regen-fixtures.sh
        language: system
        pass_filenames: true
        files: |
          (?x)^(
            Cargo\.lock|
            Cargo\.toml|
            crates/baml-derive-core/.*|
            crates/baml-derive/.*|
            crates/baml-rt-builder/.*|
            crates/baml-rt-tools/.*|
            crates/baml-tool-derive/.*|
            crates/tools/.*|
            agents/.*|
            tests/fixtures/agents/.*
          )$

      # BAML: disallowed (message|msg).<prop> in Jinja lines (allowlist: role, content, citations)
      - id: baml-conversation-history
        name: baml conversation_history Jinja check
        entry: bash scripts/check-baml-conversation-history.sh
        language: system
        pass_filenames: true
        files: ^(agents|tests/fixtures/agents)/.+\.baml$

      # Helm: assert the runner StatefulSet probes render with the documented
      # defaults and that overrides are honoured. Cheap (helm template runs
      # in well under a second). Triggered only on chart files that affect
      # the contract or the test itself.
      - id: helm-runner-probes-render
        name: helm runner probes render check
        entry: bash scripts/test-helm-runner-probes.sh
        language: system
        pass_filenames: false
        files: |
          (?x)^(
            deploy/helm/agentium-os/templates/runner-statefulset\.yaml|
            deploy/helm/agentium-os/values\.yaml|
            scripts/test-helm-runner-probes\.sh
          )$

  # Typos - spell checker for code
  - repo: https://github.com/crate-ci/typos
    rev: v1.28.1
    hooks:
      - id: typos
        # Exclude generated files and common false positives
        exclude: |
          (?x)^(
            target/|
            Cargo.lock|
            \.snap$|
            \.tar\.gz$|
            node_modules/|
            dist/|
            models/fastembed/
          )

  # Cargo deny - disabled (license/source config not fully aligned with git deps)
  # - repo: local
  #   hooks:
  #     - id: cargo-deny
  #       name: cargo deny
  #       entry: cargo deny check
  #       language: system
  #       pass_filenames: false
  #       always_run: true
  #       types: [rust]

  # Cargo machete - disabled (reports many false positives for workspace)
  # - repo: local
  #   hooks:
  #     - id: cargo-machete
  #       name: cargo machete
  #       entry: cargo machete
  #       language: system
  #       pass_filenames: false
  #       always_run: true
  #       types: [rust]

  # Cargo outdated - disabled
  # - repo: local
  #   hooks:
  #     - id: cargo-outdated
  #       name: cargo outdated
  #       entry: cargo outdated --exit-code 1
  #       language: system
  #       pass_filenames: false
  #       always_run: true
  #       types: [rust]

  # Cargo check - basic compilation check
  - repo: local
    hooks:
      - id: cargo-check
        name: cargo check
        entry: cargo check --all-targets
        language: system
        pass_filenames: false
        always_run: true
        types: [rust]