.pre-commit-config.yaml

# Apply to all files without committing:
#   pre-commit run --all-files
# Update this file:
#   pre-commit autoupdate

exclude: |
  (?x)^(
      .*\{\{.*\}\}.*|     # Exclude any files with cookiecutter variables
      docs/site/.*|       # Exclude mkdocs compiled files
      \.history/.*|       # Exclude history files
      .*cache.*/.*|       # Exclude cache directories
      .*venv.*/.*|        # Exclude virtual environment directories
      .*/versioneer\.py|
      .*/_version\.py|
      .*/.*\.svg
  )$

fail_fast: true

default_install_hook_types:
  - pre-commit
  - commit-msg

default_language_version:
  python: python3

ci:
    autofix_commit_msg: |
        [pre-commit.ci] auto fixes from pre-commit.com hooks

        for more information, see https://pre-commit.ci
    autofix_prs: true
    autoupdate_branch: ''
    autoupdate_commit_msg: '[pre-commit.ci] pre-commit autoupdate'
    autoupdate_schedule: weekly
    skip: []
    submodules: false

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v6.0.0
    hooks:
      # Python-specific checks
      - id: check-ast
        name: "🐍 python · Validate syntax"
      - id: check-builtin-literals
        name: "🐍 python · Use literal syntax"
      - id: check-docstring-first
        name: "🐍 python · Validate docstring placement"
      - id: debug-statements
        name: "🐍 python · Detect debug statements"
        language_version: python3

      # Git workflow protection
      - id: check-added-large-files
        name: "🌳 git · Block large files"
        args: ['--maxkb=500']
      - id: check-merge-conflict
        name: "🌳 git · Detect conflict markers"
      - id: forbid-new-submodules
        name: "🌳 git · Prevent submodules"
      - id: no-commit-to-branch
        name: "🌳 git · Protect main branches"
        args: ["--branch", "main", "--branch", "master"]
      - id: check-vcs-permalinks
        name: "🌳 git · Validate VCS links"

      # Filesystem and naming validation
      - id: check-case-conflict
        name: "📁 filesystem · Check case sensitivity"
      - id: check-illegal-windows-names
        name: "📁 filesystem · Validate Windows names"
      - id: check-symlinks
        name: "📁 filesystem · Check symlink validity"
      - id: destroyed-symlinks
        name: "📁 filesystem · Detect broken symlinks"

      # File format validation
      - id: check-toml
        name: "📋 format · Validate TOML"
      - id: check-yaml
        name: "📋 format · Validate YAML"
        exclude: conda.recipe/meta.yaml

      # File content fixes
      - id: fix-byte-order-marker
        name: "✨ fix · Remove BOM markers"
      - id: end-of-file-fixer
        name: "✨ fix · Ensure final newline"
      - id: mixed-line-ending
        name: "✨ fix · Normalize line endings"
      - id: trailing-whitespace
        name: "✨ fix · Trim trailing whitespace"
        args: [--markdown-linebreak-ext=md]
      - id: requirements-txt-fixer
        name: "✨ fix · Sort requirements"

      # Security checks
      - id: detect-private-key
        name: "🔒 security · Detect private keys"

  # Git commit quality
  - repo: https://github.com/commitizen-tools/commitizen
    rev: v4.13.10
    hooks:
      - id: commitizen
        name: "🌳 git · Validate commit message"
        stages: [commit-msg]

  # Security scanning (grouped together)
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.5.0
    hooks:
      - id: detect-secrets
        name: "🔒 security · Detect committed secrets"

  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.30.0
    hooks:
      - id: gitleaks
        name: "🔒 security · Scan for hardcoded secrets"

  - repo: https://github.com/PyCQA/bandit
    rev: 1.9.4
    hooks:
      - id: bandit
        name: "🔒 security · Check Python vulnerabilities"
        args: ["-c", "pyproject.toml", "-r", "."]
        exclude: ^tests/
        additional_dependencies: [".[toml]"]

  - repo: https://github.com/semgrep/pre-commit
    rev: 'v1.159.0'
    hooks:
      - id: semgrep
        name: "🔒 security · Static analysis (semgrep)"
        args: [ '--config=auto', '--error' ]

  # Spelling and typos
  - repo: https://github.com/crate-ci/typos
    rev: v1.45.1
    hooks:
      - id: typos
        name: "📝 spelling · Check typos"

  # CI/CD validation
  - repo: https://github.com/python-jsonschema/check-jsonschema
    rev: 0.37.1
    hooks:
      - id: check-dependabot
        name: "🔧 ci/cd · Validate Dependabot config"
      - id: check-github-workflows
        name: "🔧 ci/cd · Validate GitHub workflows"
        files: ^\.github/workflows/.*\.ya?ml$

  - repo: https://github.com/ariebovenberg/slotscheck
    rev: v0.19.1
    hooks:
      - id: slotscheck
        name: "🔍 check · slotscheck"
        additional_dependencies:
          - requests>=2.32.5
          - pytest>=7.0.0
          - typing-extensions>=4.7.1
          - responses

  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.15.11
    hooks:
      - id: ruff-check
        name: "🐍 lint · Check with Ruff"
        args: [--fix, --preview]
      - id: ruff-format
        name: "🐍 format · Format with Ruff"

  - repo: https://github.com/PyCQA/pylint
    rev: v4.0.5
    hooks:
      - id: pylint
        name: "🐍 lint · Check code quality"
        args:
          - --exit-zero

  - repo: https://github.com/econchick/interrogate
    rev: 1.7.0
    hooks:
      - id: interrogate
        name: "📝 docs · Check docstring coverage"
        exclude: ^(tests|.*/samples)$
        pass_filenames: false
        args: [ --verbose, --fail-under=43, --ignore-init-method ]

  # Python type checking
  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: v1.20.1
    hooks:
      - id: mypy
        name: "🐍 types · Check with mypy"
        args: [--config-file=./pyproject.toml]
        additional_dependencies:
          - pytest-order
          - types-requests
        exclude: ^samples/

  - repo: https://github.com/RobertCraigie/pyright-python
    rev: v1.1.408
    hooks:
      - id: pyright
        name: "🐍 types · Check with pyright"

  # Python project configuration
  - repo: https://github.com/abravalheri/validate-pyproject
    rev: v0.25
    hooks:
      - id: validate-pyproject
        name: "🐍 config · Validate pyproject.toml"

  - repo: https://github.com/pre-commit/pygrep-hooks
    rev: v1.10.0
    hooks:
      - id: python-check-blanket-noqa
        name: "🐍 lint · Disallow blanket noqa"
      - id: python-use-type-annotations
        name: "🐍 types · Enforce type annotations"
      - id: python-check-blanket-type-ignore
        name: "🐍 types · Disallow blanket type:ignore"
      - id: python-no-log-warn
        name: "🐍 lint · Use logging.warning not warn"
      - id: text-unicode-replacement-char
        name: "📋 format · Detect unicode replacement char"
      - id: python-no-eval
        name: "🔒 security · Prevent eval() usage"

  # Markdown formatting
  - repo: https://github.com/executablebooks/mdformat
    rev: 1.0.0
    hooks:
      - id: mdformat
        name: "📝 markdown · Format files"

        additional_dependencies:
          - mdformat-gfm
          - mdformat-black
          - mdformat-ruff

# TODO: Enable it for a single check
#  - repo: https://github.com/tcort/markdown-link-check
#    rev: v3.14.2
#    hooks:
#      - id: markdown-link-check
#        name: "📝 docs · Check markdown links"
#
#  # Makefile linting
#  - repo: https://github.com/checkmake/checkmake
#    rev: v0.3.0
#    hooks:
#      - id: checkmake
#        name: "🔧 build · Lint Makefile"