# Security Scanning and Vulnerability Detection Configuration
# Advanced security tooling configuration for Agent Orchestration Platform
# ============================================================================
# Pre-commit Security Hooks Configuration
# ============================================================================
repos:
# Security Analysis
- repo: https://github.com/PyCQA/bandit
rev: '1.7.5'
hooks:
- id: bandit
args: ['-c', 'pyproject.toml']
exclude: ^tests/
- repo: https://github.com/gitguardian/ggshield
rev: v1.24.0
hooks:
- id: ggshield
language: python
stages: [commit]
- repo: https://github.com/Yelp/detect-secrets
rev: v1.4.0
hooks:
- id: detect-secrets
args: ['--baseline', '.secrets.baseline']
# Dependency Security
- repo: https://github.com/Lucas-C/pre-commit-hooks-safety
rev: v1.3.2
hooks:
- id: python-safety-dependencies-check
files: requirements.*\.txt$
# Code Quality (Security-Adjacent)
- repo: https://github.com/psf/black
rev: 23.7.0
hooks:
- id: black
language_version: python3.11
- repo: https://github.com/pycqa/isort
rev: 5.12.0
hooks:
- id: isort
args: ["--profile", "black"]
- repo: https://github.com/pycqa/flake8
rev: 6.0.0
hooks:
- id: flake8
additional_dependencies: [flake8-secure-coding-standard]
# File Security Checks
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v4.4.0
hooks:
- id: check-merge-conflict
- id: check-yaml
- id: check-json
- id: detect-private-key
- id: check-added-large-files
args: ['--maxkb=1000']
- id: check-case-conflict
- id: check-executables-have-shebangs
- id: check-shebang-scripts-are-executable
# Python Security
- repo: https://github.com/pycqa/pylint
rev: v2.17.4
hooks:
- id: pylint
additional_dependencies: [pylint-secure-coding-standard]
args: ['--disable=all', '--enable=security']
# ============================================================================
# Advanced Security Scanning Configuration
# ============================================================================
ci:
autofix_commit_msg: |
[pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
autofix_prs: true
autoupdate_branch: ''
autoupdate_commit_msg: '[pre-commit.ci] pre-commit autoupdate'
autoupdate_schedule: weekly
skip: [pylint, safety] # Skip expensive checks in CI
submodules: false
