# Pre-commit hooks for security and code quality
# Install with: pip install pre-commit && pre-commit install
repos:
# Gitleaks - Detect secrets in code
- repo: https://github.com/gitleaks/gitleaks
rev: v8.18.4
hooks:
- id: gitleaks
args: ['--config', '.gitleaks.toml']
# General file fixes and security checks
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v4.5.0
hooks:
- id: trailing-whitespace
- id: end-of-file-fixer
- id: check-yaml
- id: check-json
- id: check-added-large-files
args: ['--maxkb=1000']
- id: check-case-conflict
- id: check-merge-conflict
- id: detect-private-key
- id: mixed-line-ending
args: ['--fix=lf']
# Shell script linting
- repo: https://github.com/shellcheck-py/shellcheck-py
rev: v0.9.0.6
hooks:
- id: shellcheck
args: ['--severity=warning']
# Dockerfile linting
- repo: https://github.com/hadolint/hadolint
rev: v2.12.0
hooks:
- id: hadolint-docker
args: ['--ignore', 'DL3008', '--ignore', 'DL3009']
# JavaScript/JSON formatting
- repo: https://github.com/pre-commit/mirrors-prettier
rev: v3.1.0
hooks:
- id: prettier
types_or: [javascript, json, markdown, yaml]
exclude: '^(package-lock\.json|custom_nodes/)'
# Markdown linting
- repo: https://github.com/igorshubovych/markdownlint-cli
rev: v0.38.0
hooks:
- id: markdownlint
args: ['--fix', '--disable', 'MD013', '--disable', 'MD041']
exclude: '^(custom_nodes/|\.claude/)'
# Local hooks for additional security checks
- repo: local
hooks:
- id: check-env-files
name: Prevent .env file commits
entry: bash -c 'if git diff --cached --name-only | grep -E "^\.env$|^\.env\.[^.]+" | grep -v "\.env\.example"; then echo "ERROR: Attempting to commit .env file!"; exit 1; fi'
language: system
pass_filenames: false
- id: check-secrets-dir
name: Prevent secrets directory commits
entry: bash -c 'if git diff --cached --name-only | grep -E "^secrets/.*\.(txt|key|pem|crt)$"; then echo "ERROR: Attempting to commit secret files!"; exit 1; fi'
language: system
pass_filenames: false
- id: check-git-config-tokens
name: Check for tokens in git config
entry: bash -c 'if git remote get-url origin | grep -E "ghp_|gho_|ghs_|glpat-"; then echo "ERROR: Token detected in git remote URL! Use SSH or credential helper instead."; exit 1; fi'
language: system
pass_filenames: false
- id: docker-compose-check
name: Validate docker-compose.yml
entry: docker-compose -f docker-compose.yml config -q
language: system
files: docker-compose\.yml$
pass_filenames: false
