.pre-commit-config.yamlā¢3.61 kB
# Pre-commit hooks configuration
# See https://pre-commit.com for more information
repos:
# Gitleaks - Secret scanning
- repo: https://github.com/gitleaks/gitleaks
rev: v8.27.2
hooks:
- id: gitleaks
name: Gitleaks - Secret Detection
description: Detect hardcoded secrets like passwords and API keys
entry: gitleaks protect --verbose --redact --staged
language: system
pass_filenames: false
# Python code quality (Ruff handles linting, formatting, and import sorting)
- repo: https://github.com/astral-sh/ruff-pre-commit
rev: v0.8.4
hooks:
- id: ruff
name: Ruff - Linter & Import Sorter
args: [--fix, --exit-non-zero-on-fix]
- id: ruff-format
name: Ruff - Formatter
# Type checking (warning mode - errors don't block commits)
- repo: https://github.com/pre-commit/mirrors-mypy
rev: v1.13.0
hooks:
- id: mypy
name: mypy - Type Checker (warnings only)
additional_dependencies:
- types-requests
- pandas-stubs
- pydantic>=2.10.0
- pydantic-settings>=2.0.0
- typer>=0.12.0
- rich>=13.7.0
- httpx>=0.27.0
- python-dotenv>=1.0.0
args:
- --config-file=pyproject.toml
- --no-incremental
- --python-version=3.12
- --warn-unused-ignores
- --no-error-summary
pass_filenames: true
files: ^ib_sec_mcp/(api|core|models|analyzers|reports|utils|cli)/.*\.py$
exclude: ^ib_sec_mcp/mcp/
verbose: true
# Type checking now enabled - core modules are type-safe
# mcp/ directory excluded via pyproject.toml exclude pattern
# General file checks
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v5.0.0
hooks:
- id: trailing-whitespace
name: Trim Trailing Whitespace
- id: end-of-file-fixer
name: Fix End of Files
- id: check-yaml
name: Check YAML Syntax
- id: check-toml
name: Check TOML Syntax
- id: check-json
name: Check JSON Syntax
- id: check-added-large-files
name: Check for Large Files
args: ['--maxkb=1000']
- id: check-merge-conflict
name: Check for Merge Conflicts
- id: detect-private-key
name: Detect Private Keys
- id: mixed-line-ending
name: Fix Mixed Line Endings
args: ['--fix=lf']
# Security checks
- repo: https://github.com/PyCQA/bandit
rev: 1.8.0
hooks:
- id: bandit
name: Bandit - Security Linter
args: ['-c', 'pyproject.toml']
additional_dependencies: ["bandit[toml]"]
# Claude Code configuration validation
- repo: local
hooks:
- id: validate-claude-config
name: Validate Claude Code Configuration
description: Validate sub-agents and slash commands configuration
entry: python3 .claude/scripts/validate_claude_config.py --changed-only
language: system
pass_filenames: false
files: '^\.claude/(agents|commands)/.*\.md$'
verbose: true
# Configuration for specific hooks
default_language_version:
python: python3.12
# Files to exclude from all hooks
exclude: |
(?x)^(
legacy/.*|
\.git/.*|
\.mypy_cache/.*|
\.pytest_cache/.*|
__pycache__/.*|
\.venv/.*|
venv/.*|
build/.*|
dist/.*|
\.claude/scripts/.*|
\.claude/hooks/.*
)$
# Fail fast on first error
fail_fast: false
# Minimum pre-commit version
minimum_pre_commit_version: '3.0.0'