.pre-commit-config.yaml

# See https://pre-commit.com for more information
# See https://pre-commit.com/hooks.html for more hooks
#
# Exclusions:
#   - Lock files (generated): composer.lock, package-lock.json
#   - Minified files: *.min.js, *.min.css, *-min.js, *-min.css
#   - Source maps: *.js.map, *.css.map
#   - PHPStan baseline files: .phpstan/baseline/ (generated PHP arrays)
#   - Vendored/generated third-party code (alphabetized):
#     - Documentation/EHI_Export/ (SchemaSpy + bower components)
#     - gacl/ (phpGACL library)
#     - interface/forms/eye_mag/js/shortcut.js-2-01-B/ (keyboard shortcut library)
#     - interface/forms/questionnaire_assessments/lforms/ (LHC-Forms library)
#     - interface/modules/custom_modules/oe-module-comlink-telehealth/public/assets/js/dist/ (webpack build)
#     - interface/modules/zend_modules/public/js/lib/ (jQuery + plugins)
#     - interface/modules/zend_modules/public/xsd/ (HL7 CDA schemas)
#     - interface/modules/zend_modules/public/xsl/ (XSL transformations)
#     - interface/super/rules/www/js/cdr-multiselect/ (jQuery multiselect plugins)
#     - library/classes/fpdf/ (FPDF library)
#     - library/fonts/ (Adobe font metrics files)
#     - library/js/{Category,Document}TreeMenu.js, SearchHighlight.js (vendored plugins)
#     - library/smarty_legacy/ (Smarty template engine)
#     - public/assets/modified/ (modified third-party libs)
#     - swagger/ (Swagger UI distribution)
exclude: |
  (?x)^(
    # Lock files (generated)
    (.*/)?(composer\.lock|package-lock\.json)$|
    # Minified files and source maps
    .*[.\-]min\.(js|css)$|
    .*\.(js|css)\.map$|
    # PHPStan baseline files (generated)
    \.phpstan/baseline/|
    # Vendored/generated third-party code (alphabetized)
    Documentation/EHI_Export/|
    gacl/|
    interface/forms/eye_mag/js/shortcut\.js-2-01-B/|
    interface/forms/questionnaire_assessments/lforms/|
    interface/modules/custom_modules/oe-module-comlink-telehealth/public/assets/js/dist/|
    interface/modules/zend_modules/public/js/lib/|
    interface/modules/zend_modules/public/xsd/|
    interface/modules/zend_modules/public/xsl/|
    interface/super/rules/www/js/cdr-multiselect/|
    library/classes/fpdf/|
    library/fonts/|
    library/js/(CategoryTreeMenu|DocumentTreeMenu|SearchHighlight)\.js$|
    library/smarty_legacy/|
    public/assets/modified/|
    swagger/
  )

# Constrain every hook to the pre-commit stage by default. Without this, hooks
# whose upstream definitions omit `stages:` run at every stage (including
# commit-msg), causing the file-content hooks to fire a second time when the
# Conventional Commits hook runs at commit-msg. The conventional-commits hook
# below sets its own `stages: [commit-msg]` which overrides this default.
default_stages: [pre-commit]

repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
  rev: v6.0.0
  hooks:
  - id: trailing-whitespace
  - id: end-of-file-fixer
  - id: check-yaml
    # Strict YAML validation for everything except the two docker-compose
    # files that use the non-standard !override tag. PyYAML rejects
    # unknown tags by default, so those need the relaxed check below.
    exclude: ^(\.github/docker/compose\.yml|ci/inferno/compose\.yml)$
  - id: check-yaml
    # Relaxed YAML validation scoped to the two compose files that use
    # Docker Compose's !override tag for service-extension blocks. The
    # --unsafe flag tells PyYAML to accept user-defined tags as long as
    # the document parses, instead of rejecting unknown tags outright.
    name: check-yaml (docker compose with !override)
    files: ^(\.github/docker/compose\.yml|ci/inferno/compose\.yml)$
    args:
    - --unsafe
  - id: check-added-large-files
  - id: check-merge-conflict
  - id: check-json
  # Two pretty-format-json instances split by ecosystem -- the same pattern
  # check-yaml uses for compose-with-!override files. The split exists
  # because the repo has two coherent JSON-indent cultures that one global
  # `--indent` setting can never satisfy at once:
  #
  #   2-space: JS/npm packages, JSON Schemas. Matches `npm init` defaults
  #            and the wider npm ecosystem.
  #   4-space: PHP composer modules, OpenEMR data files, healthcare-spec
  #            content. Matches the HL7 FHIR / SDC IG / CMS QRDA / QDM
  #            convention used by most upstream healthcare data the repo
  #            consumes, and the project's PHP 4-space style extended to
  #            non-PHP data.
  #
  # Upstream-derived healthcare data is excluded from both blocks so the
  # repo can re-sync against upstream sources (HL7 FHIR examples, SDC IG
  # questionnaires, CMS QRDA patients, QDM/HQMF OID maps, RFC 7517 JWK
  # samples) without diff noise from our formatter.
  - id: pretty-format-json
    name: pretty-format-json (2-space — JS/npm/JSON-schema)
    # Files paired with the dispatch JSON Schema (which lives at
    # tools/release/contracts/dispatch.schema.json -- itself caught by
    # `.*\.schema\.json$` below) stay in 2-space so the schema and its
    # fixture instances format identically.
    files: |
      (?x)
      (^|/)(package(-lock)?\.json|.*\.schema\.json)$|
      ^tests/Tests/Isolated/Release/fixtures/dispatch/.*\.json$
    args:
    - --autofix
    - --indent=2
    - --no-sort-keys
  - id: pretty-format-json
    name: pretty-format-json (4-space — PHP/data files)
    args:
    - --autofix
    - --indent=4
    - --no-sort-keys
    exclude: |
      (?x)^(
        composer\.json$|                                          # composer-normalize owns this
        (.*/)?(package(-lock)?\.json|.*\.schema\.json)$|          # covered by 2-space block
        tests/Tests/Isolated/Release/fixtures/dispatch/.*\.json$| # covered by 2-space block
        contrib/portal_templates/assessments/SDC\ FHIR/|          # HL7 SDC IG examples
        src/Cqm/.*\.json$|                                        # QDM/HQMF OID maps from CMS
        tests/Tests/ECQM/|                                        # CMS QRDA/CQM patient fixtures
        tests/Tests/Fixtures/FHIR/|                               # FHIR sample resources
        tests/Tests/data/Services/FHIR/|                          # FHIR IG examples (US Core, SDC)
        tests/Tests/data/Unit/FHIR/SMART/|                        # FHIR SMART IG examples
        tests/Tests/data/Unit/Common/Auth/Grant/|                 # RFC 7517 JWK samples
        tests/Tests/data/single_patient_api_test_run.*\.json$     # Inferno G10 cert test-run outputs
      )
  - id: mixed-line-ending
    args:
    - --fix=lf

- repo: https://github.com/macisamuele/language-formatters-pre-commit-hooks
  rev: v2.16.0
  hooks:
  - id: pretty-format-yaml
    args:
    - --autofix
    - --indent=2
    - --preserve-quotes

- repo: https://github.com/codespell-project/codespell
  rev: v2.4.2
  hooks:
  - id: codespell
    # Configuration in .codespellrc

# actionlint for verifying correct syntax in GitHub Actions workflows.
- repo: https://github.com/rhysd/actionlint
  rev: v1.7.10
  hooks:
  - id: actionlint-docker

# hadolint for Dockerfile linting. Mirrors the CI workflow
# (.github/workflows/docker-lint-hadolint.yml) so devs see the same findings
# locally as CI. Shares .hadolint.yaml with CI.
#
# Uses the AleksaC/hadolint-py shim (vs. upstream hadolint/hadolint's
# hadolint-docker hook) so the hook runs in any env where pre-commit runs --
# including the in-container prek path (no docker socket required). The shim
# downloads the official hadolint binary from the upstream GitHub release
# (SHA256-pinned in its setup.py), so it executes the same hadolint binary
# upstream publishes. CI's docker image (hadolint/hadolint, untagged ->
# floating :latest) and this hook's pinned rev can drift between upstream
# releases, so findings are consistent in steady state but may diverge
# briefly when upstream ships a new version. Dependabot bumps the hook rev
# to close that window.
- repo: https://github.com/AleksaC/hadolint-py
  rev: v2.14.0
  hooks:
  - id: hadolint
    args:
    - --config
    - .hadolint.yaml

- repo: local
  hooks:
  - id: php-syntax-check
    name: PHP Syntax Check
    entry: php -l
    language: system
    files: \.php$

  - id: composer-validate
    name: Validate composer.json
    entry: composer validate --strict
    language: system
    files: ^composer\.json$
    pass_filenames: false

  - id: composer-normalize
    name: Normalize composer.json
    entry: composer normalize
    language: system
    files: ^composer\.json$
    pass_filenames: false

  - id: phpcbf
    name: PHP Code Beautifier and Fixer
    entry: composer phpcbf --
    language: system
    files: \.php$

  - id: phpcs
    name: PHP_CodeSniffer
    entry: composer phpcs --
    language: system
    files: \.php$

  - id: phpstan
    name: PHPStan Static Analysis
    entry: composer phpstan --
    language: system
    files: \.php$
    pass_filenames: false

  - id: rector
    name: Rector
    entry: composer rector-fix --
    language: system
    files: \.php$
    exclude: ^vendor/

  - id: composer-require-checker
    name: Composer Require Checker
    entry: composer require-checker
    language: system
    files: ^(composer\.json|.*\.php)$
    pass_filenames: false

  - id: conventional-commits
    name: Conventional Commits
    entry: bash -c 'composer conventional-commits:check -- "$(<"$1")"' --
    language: system
    stages:
    - commit-msg