.pre-commit-hooks.yaml

# Configuring our pre-commit hooks to be used with pre-commit: https://pre-commit.com/

# Markdown specific hooks

# https://github.com/tcort/markdown-link-check
- id: markdown-link-check
  name: markdown-link-check
  description: Markdown-link-check checks all of the hyperlinks in a markdown text to determine if they are alive or dead.
  entry: pre_commit_hooks/markdown/markdown-link-check.sh
  language: script
  files: \.md$
  args: []
  exclude: >
    (?x)^(
      .+\.tpl.md$|
      .+\.node_modules\/.*$|
      .+\.cache\/.*$|
      .+\.vendor\/.*$|
      .+\.terraform\/.*$|
    )$
  minimum_pre_commit_version: 0.15.0

# Checkov specific hooks

- id: checkov
  name: Checkov
  description: Runs checkov on Terraform templates.
  entry: pre_commit_hooks/terraform/checkov.sh
  language: script
  pass_filenames: true
  require_serial: true
  always_run: false
  files: \.tf$
  exclude: >
    (?x)^(
      .+\.node_modules\/.*$|
      .+\.vendor\/.*$|
      .+\.terraform\/.*$|
    )$
  minimum_pre_commit_version: 0.15.0

# Terraform specific hooks

- id: terraform-fmt
  name: Terraform fmt
  description: Rewrites all Terraform configuration files to a canonical format.
  entry: pre_commit_hooks/terraform/terraform_fmt.sh
  language: script
  files: (\.tf|\.tfvars)$
  exclude: >
    (?x)^(
      .+\.vendor\/.*$|
      .+\.terraform\/.*$|
    )$
  minimum_pre_commit_version: 0.15.0

- id: terraform-docs
  name: Terraform docs
  description: Inserts input and output documentation into README.md (using terraform-docs).
  entry: pre_commit_hooks/terraform/terraform_docs.sh
  require_serial: true
  language: script
  files: (\.tf|\.tfvars)$
  exclude: >
    (?x)^(
      .+\.vendor\/.*$|
      .+\.terraform\/.*$|
    )$
  minimum_pre_commit_version: 0.15.0

- id: terraform-docs-without-aggregate-type-defaults
  name: Terraform docs (without aggregate type defaults)
  description: Inserts input and output documentation into README.md (using terraform-docs). Identical to terraform_docs.
  require_serial: true
  entry: pre_commit_hooks/terraform/terraform_docs.sh
  language: script
  files: (\.tf)$
  exclude: >
    (?x)^(
      .+\.vendor\/.*$|
      .+\.terraform\/.*$|
    )$
  minimum_pre_commit_version: 0.15.0

- id: terraform-docs-replace
  name: Terraform docs (overwrite README.md)
  description: Overwrite content of README.md with terraform-docs.
  require_serial: true
  entry: pre_commit_hooks/terraform/terraform_docs_replace
  language: python
  files: (\.tf)$
  exclude: >
    (?x)^(
      .+\.vendor\/.*$|
      .+\.terraform\/.*$|
    )$
  minimum_pre_commit_version: 0.15.0

- id: terraform-validate
  name: Terraform validate
  description: Validates all Terraform configuration files.
  require_serial: true
  entry: pre_commit_hooks/terraform/terraform_validate.sh
  language: script
  files: (\.tf|\.tfvars)$
  exclude: >
    (?x)^(
      .+\.vendor\/.*$|
      .+\.terraform\/.*$|
    )$
  minimum_pre_commit_version: 0.15.0

- id: terraform-tflint
  name: Terraform validate with tflint
  description: Validates all Terraform configuration files with TFLint.
  entry: pre_commit_hooks/terraform/terraform_tflint.sh
  require_serial: true
  language: script
  files: (\.tf|\.tfvars)$
  exclude: >
    (?x)^(
      .+\.vendor\/.*$|
      .+\.terraform\/.*$|
    )$
  minimum_pre_commit_version: 0.15.0

- id: terraform-tfsec
  name: Terraform validate with tfsec
  description: Static analysis of Terraform templates to spot potential security issues.
  entry: pre_commit_hooks/terraform/terraform_tfsec.sh
  require_serial: true
  language: script
  pass_filenames: true
  files: \.tf$
  exclude: >
    (?x)^(
      .+\.node_modules\/.*$|
      .+\.vendor\/.*$|
      .+\.terraform\/.*$|
    )$
  minimum_pre_commit_version: 0.15.0

# Terragrunt specific hooks

- id: terragrunt-fmt
  name: Terragrunt fmt
  description: Rewrites all Terragrunt configuration files to a canonical format.
  entry: pre_commit_hooks/terragrunt/terragrunt_fmt.sh
  language: script
  files: (\.hcl)$
  exclude: \.terraform\/.*$
  minimum_pre_commit_version: 0.15.0

- id: terragrunt-validate
  name: Terragrunt validate
  description: Validates all Terragrunt configuration files.
  entry: pre_commit_hooks/terragrunt/terragrunt_validate.sh
  language: script
  files: (\.hcl)$
  exclude: >
    (?x)^(
      .+\.tflint.hcl$|
      .+\vendor\/.*$|
      .+\.terraform\/.*$|
    )$
  minimum_pre_commit_version: 0.15.0

# bash

- id: shellcheck
  name: shellcheck
  description: Test shell scripts with shellcheck
  entry: pre_commit_hooks/shell/shellcheck.sh
  language: script
  types: [shell]
  require_serial: true # shellcheck can detect sourcing this way

# go

- id: go-fmt
  name: 'go fmt'
  description: Test go files with `gofmt`
  entry: pre_commit_hooks/go/go-fmt.sh
  files: '\.go$'
  language: 'script'

- id: go-imports
  name: 'go imports'
  description: Tests go files with `goimports`
  entry: pre_commit_hooks/go/go-imports.sh
  files: '\.go$'
  language: 'script'

- id: go-vet
  name: 'go vet'
  description: Tests go files with `go vet`
  entry: pre_commit_hooks/go/go-vet.sh
  files: '\.go$'
  language: 'script'

- id: golint
  name: 'go lint'
  description: Tests go files with `golint`
  entry: pre_commit_hooks/go/golint.sh
  files: '\.go$'
  language: 'script'

- id: gocyclo
  name: 'gocyclo'
  description: Tests go files with `gocyclo`
  entry: pre_commit_hooks/go/gocyclo.sh
  files: '\.go$'
  language: 'script'
  args: [-over=15]

- id: validate-toml
  name: 'validate toml'
  description: >
    Runs `tomlv`, requires https://github.com/BurntSushi/toml/tree/master/cmd/tomlv"
  entry: 'tomlv'
  files: '\.toml$'
  language: 'system'

- id: no-go-testing
  name: "Check files aren't using go's testing package"
  description: >
    Checks that no files are using `testing.T`, if you want developers to use
    a different testing framework
  entry: 'testing\.T'
  files: 'test_.*\.go$'
  language: pygrep

- id: golangci-lint
  name: 'golangci-lint'
  description: Tests go files with `golangci-lint`
  entry: pre_commit_hooks/go/golangci-lint.sh
  require_serial: false
  files: '\.go$'
  language: 'script'

- id: go-critic
  name: 'go-critic'
  description: Tests go files with `go-critic`
  entry: pre_commit_hooks/go/go-critic.sh
  files: '\.go$'
  language: 'script'

- id: go-unit-tests
  name: 'go-unit-tests'
  entry: pre_commit_hooks/go/go-unit-tests.sh
  files: '\.go$'
  language: 'script'
  description: 'Runs `go test`'

- id: go-build
  name: 'go-build'
  entry: pre_commit_hooks/go/go-build.sh
  files: '\.go$'
  language: 'script'
  description: 'Runs `go build`, requires golang'

- id: go-mod-tidy
  name: 'go-mod-tidy'
  entry: pre_commit_hooks/go/go-mod-tidy.sh
  files: '\.go$'
  language: 'script'
  exclude: >
    (?x)^(
      .+\.terraform\/.*$|
    )$
  description: 'Runs `go mod tidy -v`, requires golang'

- id: go-mod-vendor
  name: 'go-mod-vendor'
  entry: pre_commit_hooks/go/go-mod-vendor.sh
  files: '\.go$'
  language: 'script'
  exclude: >
    (?x)^(
      .+\.terraform\/.*$|
    )$
  description: 'Runs `go mod vendor`, requires golang'

# todocheck specific hooks

- id: todocheck
  name: todo check
  description: Tests files with todocheck.
  entry: pre_commit_hooks/check/todocheck.sh
  language: 'script'
  always_run: true
  pass_filenames: false
  minimum_pre_commit_version: 0.15.0

# grep
- id: do-not-commit
  name: Block if "DO NOT COMMIT" is found
  entry: DO NOT COMMIT
  language: pygrep

# docker
- id: hadolint
  name: hadolint
  description: Tests files Dockerfiles with hadolint
  entry: pre_commit_hooks/docker/hadolint.sh
  language: 'script'
  types: [file]
  files: Dockerfile(.*)

- id: docker-compose-check
  name: Validate docker-compose files
  description: Checks that docker-compose files are valid
  language: 'script'
  entry: pre_commit_hooks/docker/docker-compose.sh
  files: docker-compose.y[a]{0,1}ml$

# leaks

- id: gitleaks
  name: gitleaks validate commits
  description: Validates all commits with gitleaks.
  entry: pre_commit_hooks/git/gitleaks.sh
  pass_filenames: false
  language: script
  minimum_pre_commit_version: 0.15.0

# git
- id: prepare-commit-msg
  name: prepare-commit-msg
  entry: pre_commit_hooks/git/hooks/prepare-commit-msg.sh
  language: script
  stages: [prepare-commit-msg]
  minimum_pre_commit_version: 0.15.0
  pass_filenames: false