pithead/.pre-commit-config.yaml at develop · p2pool-starter-stack/pithead · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# Pre-commit hooks (Wave 7 tooling, #280). Local == CI: these mirror `make lint` + the CI lint
# jobs, so issues are caught before they reach a PR. Set up once with:
#   uv sync --project dashboard --extra dev && uv run --project dashboard pre-commit install
repos:
  # Secret scanning (#282) — stop a key reaching history in the first place. Uses .gitleaks.toml.
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.30.1
    hooks:
      - id: gitleaks

  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v5.0.0
    hooks:
      # Cheap, high-value guards across every surface.
      - id: detect-private-key  # never commit an onion/wallet/SSH private key
      - id: check-added-large-files
      # Skip generated gRPC stubs and vendored/minified third-party assets — not ours to reformat.
      - id: end-of-file-fixer
        exclude: '^dashboard/mining_dashboard/(client/tari/generated/|web/static/vendor/)'
      - id: trailing-whitespace
        # Also skip Markdown — two trailing spaces are a hard line break (see .editorconfig).
        exclude: '(^dashboard/mining_dashboard/(client/tari/generated/|web/static/vendor/)|\.md$)'

  # Per-surface lint/format (#281). These delegate to the Makefile targets so tool versions and file
  # lists stay single-sourced (no drift between local, pre-commit, and CI). They need the relevant
  # tools available (shellcheck, shfmt, node/npx, uv, docker) — see CONTRIBUTING.md.
  - repo: local
    hooks:
      # ruff via the locked dev extra — the pin lives ONLY in dashboard/pyproject.toml, so
      # local, pre-commit, and CI all run one version and Dependabot's uv updates cover it (#415).
      # A pinned ruff-pre-commit `rev` used to drift against the pyproject pin on every release.
      # --force-exclude keeps extend-exclude (generated Tari stubs) effective when pre-commit
      # passes explicit filenames.
      - id: ruff-check
        name: ruff check (locked dev-extra pin)
        entry: uv run --locked --project dashboard --extra dev ruff check --fix --force-exclude
        language: system
        types_or: [python, pyi]
      - id: ruff-format
        name: ruff format (locked dev-extra pin)
        entry: uv run --locked --project dashboard --extra dev ruff format --force-exclude
        language: system
        types_or: [python, pyi]
      - id: lint-sh
        name: shellcheck + shfmt
        entry: make lint-sh
        language: system
        types_or: [shell]
        pass_filenames: false
      - id: lint-js
        name: biome (static frontend)
        entry: make lint-js
        language: system
        files: ^dashboard/mining_dashboard/web/static/.*\.(js|mjs|css)$
        pass_filenames: false
      - id: lint-yaml
        name: yamllint
        entry: make lint-yaml
        language: system
        types: [yaml]
        pass_filenames: false
      - id: lint-md
        name: markdownlint
        entry: make lint-md
        language: system
        types: [markdown]
        pass_filenames: false
      - id: lint-docs-voice
        name: docs voice (banned marketing words)
        entry: make lint-docs-voice
        language: system
        types: [markdown]
        pass_filenames: false
      - id: lint-proto
        name: buf (proto)
        entry: make lint-proto
        language: system
        types: [proto]
        pass_filenames: false
      - id: lint-toml
        name: taplo (toml)
        entry: make lint-toml
        language: system
        types: [toml]
        pass_filenames: false