.pre-commit-config.yaml

# yaml-language-server: $schema=https://json.schemastore.org/pre-commit-config.json

minimum_pre_commit_version: 3.3.3
fail_fast: false
default_stages:
  - commit
default_install_hook_types:
  - pre-commit
  - commit-msg
repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.4.0
    hooks:
      - id: check-added-large-files
      - id: check-case-conflict
      - id: check-executables-have-shebangs
      - id: check-shebang-scripts-are-executable
      - id: check-merge-conflict
      - id: check-symlinks
      - id: detect-private-key
      - id: check-json
      - id: check-toml
      - id: check-xml
      - id: check-yaml
      - id: fix-byte-order-marker
      - id: end-of-file-fixer
        exclude: ^\.idea
      - id: mixed-line-ending
      - id: trailing-whitespace
      - id: pretty-format-json
        args:
          - --autofix
          - --no-sort-keys
  - repo: https://github.com/jumanjihouse/pre-commit-hook-yamlfmt
    rev: 0.2.3
    hooks:
      - id: yamlfmt
        args:
          - --mapping
          - '2'
          - --sequence
          - '4'
          - --offset
          - '2'
          - --width
          - '300'
          - --implicit_start
  - repo: https://github.com/adrienverge/yamllint
    rev: v1.32.0
    hooks:
      - id: yamllint
        name: Lint YAML files
        args:
          - --strict
  - repo: https://github.com/sirosen/check-jsonschema
    rev: 0.23.2
    hooks:
      - id: check-jsonschema
        name: Validate GitHub Workflows
        files: ^\.github/workflows/.*\.yml
        types:
          - yaml
        args:
          - --schemafile
          - https://json.schemastore.org/github-workflow.json
      - id: check-jsonschema
        name: Validate GitHub Actions
        files: >
          (?x)^(
            action.(yml|yaml)|
            \.github/actions/.*
          )$
        types:
          - yaml
        args:
          - --schemafile
          - https://json.schemastore.org/github-action
      - id: check-jsonschema
        name: Validate DependaBot
        files: ^\.github/dependabot\.yml
        types:
          - yaml
        args:
          - --schemafile
          - https://json.schemastore.org/dependabot-2.0.json
      - id: check-jsonschema
        name: Validate MarkdownLint
        files: .*\.markdownlint\.yaml
        types:
          - yaml
        args:
          - --schemafile
          - https://json.schemastore.org/markdownlint.json
      - id: check-jsonschema
        name: Validate Pre-commit
        files: .*.pre-commit-config\.yaml
        types:
          - yaml
        args:
          - --schemafile
          - https://json.schemastore.org/pre-commit-config.json
      - id: check-jsonschema
        name: Validate Docker-Compose
        files: .*docker-compose\.yml
        types:
          - yaml
        args:
          - --schemafile
          - https://raw.githubusercontent.com/compose-spec/compose-spec/master/schema/compose-spec.json
      - id: check-jsonschema
        name: Validate Renovate
        files: ^\.github/renovate\.json
        types:
          - json
        args:
          - --schemafile
          - https://docs.renovatebot.com/renovate-schema.json
      - id: check-jsonschema
        name: Validate Prettier
        files: ^\.prettier(?:rc)?(?:\.(ya?ml|json5?))?$
        types_or:
          - json
          - yaml
        args:
          - --schemafile
          - https://json.schemastore.org/prettierrc
  - repo: https://github.com/commitizen-tools/commitizen
    rev: v2.42.1
    hooks:
      - id: commitizen
        name: Lint commit message
        stages:
          - commit-msg
  - repo: https://github.com/shellcheck-py/shellcheck-py
    rev: v0.8.0.4
    hooks:
      - id: shellcheck
        name: Check sh files (and patch)
        entry: bash -eo pipefail -c 'shellcheck $@ -f diff | patch -p 1' --
      - id: shellcheck
        name: Check sh files (and print violations)
  - repo: meta # https://github.com/pre-commit/pre-commit/tree/master/pre_commit/meta_hooks
    hooks:
      - id: check-hooks-apply
        stages:
          - manual
      - id: check-useless-excludes
      - id: identity
        stages:
          - manual
  - repo: https://github.com/igorshubovych/markdownlint-cli
    rev: v0.35.0
    hooks:
      - id: markdownlint-fix
        name: Lint Markdown files
        exclude: .*/CHANGELOG\.md$
  - repo: https://github.com/maxwinterstein/shfmt-py
    rev: v3.4.3.1
    hooks:
      - id: shfmt
        name: Format sh files
        args:
          - -w
          - -s
          - -i
          - '2'
  - repo: https://github.com/pre-commit/mirrors-prettier
    rev: v2.7.1
    hooks:
      - id: prettier
        additional_dependencies:
          - prettier
        exclude: .*/CHANGELOG\.md$ # managed by semantic-release
        stages:
          - manual
  - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
    rev: v5.0.0
    hooks:
      - id: commitlint
        stages:
          - commit-msg
        additional_dependencies:
          - '@commitlint/config-conventional'
  - repo: local
    hooks:
      - id: markdownlint
        name: Lint Markdown files
        language: docker_image
        entry: 06kellyjac/markdownlint-cli:0.28.1
        args:
          - --fix
        types:
          - markdown
      - id: gitleaks
        name: Protect hardcoded secrets
        language: docker_image
        entry: --user gitleaks:gitleaks zricethezav/gitleaks:v8.17.0
        args:
          - protect
          - --staged
          - --redact
          - --verbose
        pass_filenames: false
        require_serial: true
      - id: gitleaks-ci
        name: Detect hardcoded secrets
        language: docker_image
        entry: --user gitleaks:gitleaks zricethezav/gitleaks:v8.17.0
        stages:
          - manual
        args:
          - detect
          - --redact
          - --verbose
          - --log-opts
          - --left-right --cherry-pick --pretty=format:"%H" remotes/origin/master...
        pass_filenames: false
        require_serial: true