.pre-commit-config.yaml

# See https://pre-commit.com for more information
# See https://pre-commit.com/hooks.html for more hooks
repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.4.0
    hooks:
      - id: check-added-large-files
        name: Check for files larger than 5 MB
        args: [ --maxkb=5120 ]
      - id: end-of-file-fixer
        name: Check for a blank line at the end of scripts (auto-fixes)
        exclude: '\.Rd'
      - id: trailing-whitespace
        name: Check for trailing whitespaces (auto-fixes)

  - repo: https://github.com/astral-sh/ruff-pre-commit
    # Ruff version.
    rev: v0.2.1
    hooks:
      # Run the linter.
      - id: ruff
        types_or: [ python ]
        args: [ --fix ]
      # Run the formatter.
      - id: ruff-format
        types_or: [ python, pyi, jupyter ]

  - repo: https://github.com/PyCQA/bandit
    rev: 1.7.6
    hooks:
    -   id: bandit
        args: [
          -c, pyproject.toml,
          -ll,
          -r, .
        ]
        additional_dependencies: [ "bandit[toml]" ]

  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: v1.8.0
    hooks:
    -   id: mypy
        args: [
          --config-file, pyproject.toml
        ]
        # Use installed environment rather than fresh one to match command line use
        # https://github.com/pre-commit/pre-commit/issues/1580
        language: system
        types: [ python ]
        exclude: tests/

  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
    -   id: detect-secrets
        exclude: poetry.lock
        args: [
          --baseline, .secrets.baseline
        ]

  - repo: local
    hooks:
    -   id: detect-ip
        name: Detect IP addresses
        entry: '^(?!0\.0\.0\.0$)(?!127\.0\.0\.1$)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
        language: pygrep
        exclude: '^static/|\.lock'
        files: .

  - repo: local
    hooks:
    -   id: detect-aws-account
        name: Detect AWS account numbers
        language: pygrep
        entry: ':\d{12}:'

  - repo: https://github.com/mxab/pre-commit-trivy.git
    rev: v0.3.0
    hooks:
      - id: trivyfs-docker
        args: [
          --skip-dirs, ./tests
          --ignore-unfixed, . # last arg indicates the path/file to scan
        ]