.pre-commit-config.yaml

---
default_language_version:
  # force all unspecified python hooks to run python3
  python: python3

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: check-case-conflict
      - id: check-executables-have-shebangs
      - id: check-json
      - id: check-merge-conflict
      - id: check-toml
      - id: check-xml
      - id: debug-statements
      - id: detect-aws-credentials
        args:
          - --allow-missing-credentials
      - id: detect-private-key
      - id: end-of-file-fixer
        exclude: files/(issue|motd)
      - id: mixed-line-ending
        args:
          - --fix=lf
      - id: pretty-format-json
        args:
          - --autofix
      - id: requirements-txt-fixer
      - id: trailing-whitespace

  # Text file hooks
  - repo: https://github.com/igorshubovych/markdownlint-cli
    rev: v0.39.0
    hooks:
      - id: markdownlint
        args:
          - --config=.mdl_config.yaml
  - repo: https://github.com/pre-commit/mirrors-prettier
    # This is the last version of v3 available from the mirror. We should hold
    # here until v4, which is currently in alpha, is more stable.
    rev: v3.1.0
    hooks:
      - id: prettier
        # This is the latest version of v3 available from NPM. The pre-commit
        # mirror does not pull tags for old major versions once a new major
        # version tag is published.
        additional_dependencies:
          - prettier@3.2.5
  - repo: https://github.com/adrienverge/yamllint
    rev: v1.35.1
    hooks:
      - id: yamllint
        args:
          - --strict

  # GitHub Actions hooks
  - repo: https://github.com/python-jsonschema/check-jsonschema
    rev: 0.28.0
    hooks:
      - id: check-github-actions
      - id: check-github-workflows

  # pre-commit hooks
  - repo: https://github.com/pre-commit/pre-commit
    rev: v3.6.2
    hooks:
      - id: validate_manifest

  # Go hooks
  - repo: https://github.com/TekWizely/pre-commit-golang
    rev: v1.0.0-rc.1
    hooks:
      # Style Checkers
      - id: go-critic
      # StaticCheck
      - id: go-staticcheck-repo-mod
      # Go Build
      - id: go-build-repo-mod
      # Go Mod Tidy
      - id: go-mod-tidy-repo
      # Go Test
      - id: go-test-repo-mod
      # Go Vet
      - id: go-vet-repo-mod
      # GoSec
      - id: go-sec-repo-mod
      # goimports
      - id: go-imports-repo
        args:
          # Write changes to files
          - -w
  # Nix hooks
  - repo: https://github.com/nix-community/nixpkgs-fmt
    rev: v1.3.0
    hooks:
      - id: nixpkgs-fmt

  # Shell script hooks
  - repo: https://github.com/scop/pre-commit-shfmt
    rev: v3.7.0-4
    hooks:
      - id: shfmt
        args:
          # List files that will be formatted
          - --list
          # Write result to file instead of stdout
          - --write
          # Indent by two spaces
          - --indent
          - "2"
          # Binary operators may start a line
          - --binary-next-line
          # Switch cases are indented
          - --case-indent
          # Redirect operators are followed by a space
          - --space-redirects
  - repo: https://github.com/shellcheck-py/shellcheck-py
    rev: v0.9.0.6
    hooks:
      - id: shellcheck

  # Python hooks
  - repo: https://github.com/PyCQA/bandit
    rev: 1.7.7
    hooks:
      - id: bandit
        args:
          - --config=.bandit.yml
  - repo: https://github.com/psf/black-pre-commit-mirror
    rev: 24.2.0
    hooks:
      - id: black
  - repo: https://github.com/PyCQA/flake8
    rev: 7.0.0
    hooks:
      - id: flake8
        additional_dependencies:
          - flake8-docstrings
  - repo: https://github.com/PyCQA/isort
    rev: 5.13.2
    hooks:
      - id: isort
  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: v1.8.0
    hooks:
      - id: mypy
  - repo: https://github.com/asottile/pyupgrade
    rev: v3.15.1
    hooks:
      - id: pyupgrade

  # Ansible hooks
  - repo: https://github.com/ansible/ansible-lint
    rev: v24.2.0
    hooks:
      - id: ansible-lint
        additional_dependencies:
          # TODO: Remove this pin when that becomes possible.  See
          # cisagov/skeleton-ansible-role#178 for more details.
          #
          # Since we pin ansible-core in
          # cisagov/skeleton-ansible-role, we should pin it here too
          # to ensure that ansible-lint is applied consistently across
          # all our repos.  See cisagov/skeleton-ansible-role#178 for
          # more information as to why this pinning is necessary.
          #
          # Note that any changes made to this dependency must also be
          # made in requirements.txt in cisagov/skeleton-packer and
          # requirements-test.txt in cisagov/skeleton-ansible-role.
          - ansible-core<2.16.3

  # Terraform hooks
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.88.0
    hooks:
      - id: terraform_fmt
      - id: terraform_validate

  # Docker hooks
  - repo: https://github.com/IamTheFij/docker-pre-commit
    rev: v3.0.1
    hooks:
      - id: docker-compose-check

  # Packer hooks
  - repo: https://github.com/cisagov/pre-commit-packer
    rev: v0.0.2
    hooks:
      - id: packer_validate
      - id: packer_fmt