.pre-commit-config.yaml

---
# Pre-requisites:
# pip install pre-commit conventional-pre-commit
# pre-commit install
# pre-commit install --install-hooks -t commit-msg
# pre-commit autoupdate

# See https://pre-commit.com for more information
# See https://pre-commit.com/hooks.html for more hooks
fail_fast: true
exclude: documentation/pandoc|documentation/overrides|crate/server/src/tests/test_utils.rs|.pre-commit-config.yaml|crate/server/src/routes/google_cse/jwt.rs|crate/server/src/routes/google_cse/python/openssl|documentation/docs/google_cse|crate/pkcs11/sys|documentation/docs/drawings|test_data|documentation/docs/benchmarks.md|crate/hsm/proteccio/driver|crate/server/ui|kmip/|crate/server_database/src/tests/migrate/postgre-4.20.dump.sql|crate/kmip/src/ttlv/tests/pykmip/|crate/server/documentation/swagger-ui/swagger-ui-bundle.js|crate/server/documentation/swagger-ui/swagger-ui.css
repos:
  - repo: https://github.com/compilerla/conventional-pre-commit
    rev: v4.0.0
    hooks:
      - id: conventional-pre-commit
        stages: [commit-msg]
        args: [] # optional: list of Conventional Commits types to allow e.g. [feat, fix, ci, chore, test]

  - repo: https://github.com/igorshubovych/markdownlint-cli
    rev: v0.44.0
    hooks:
      - id: markdownlint-fix
        args:
          [
            --config=.github/.markdownlint.yaml,
            --disable=MD013,
            --disable=MD033,
            --disable=MD041,
            --disable=MD046,
            --fix,
          ]
        exclude: cli_documentation/docs/cli/main_commands.md|documentation/docs/certifications_and_compliance/audit/crypto_inventory\.md

  - repo: https://github.com/jumanjihouse/pre-commit-hook-yamlfmt
    rev: 0.2.3
    hooks:
      - id: yamlfmt
        args: [--mapping, "2", --sequence, "4", --offset, "2"]
        exclude: ansible|ui/pnpm-lock.yaml

  - repo: https://github.com/crate-ci/typos
    rev: v1.31.1
    hooks:
      - id: typos
        exclude: documentation/docs/images/google_cse.drawio.svg|crate/test_server/src/test_jwt.rs|crate/pkcs11/documentation/veracrypt_ckms.svg|crate/server/src/tests/google_cse/|documentation/docs/pkcs11/images|documentation/docs/kms_clients/pkcs11/images|crate/server/resources|documentation/docs/algorithms.md|crate/server/src/tests/certificates/chain/root/ca/|documentation/docs/pki/smime.md|documentation/docs/hsms/proteccio.md|crate/crypto/src/crypto/rsa/ckm_rsa_aes_key_wrap.rs|crate/clients/ckms/src/tests/shared/export_import.rs|ui/src/Locate.tsx|kmip/|.mise/scripts/oracle/README_HSM.md|crate/pkcs11/documentation/veracrypt_ckms.svg|documentation/docs/pkcs11/images|nix/signing-keys/cosmian-kms-public.asc|sbom/|documentation/docs/certifications_and_compliance/cryptographic_algorithms/benchmarks/|crate/clients/clap/src/tests/shared/export_import.rs|crate/crypto/src/crypto/fpe/ff1.rs|docs.instructions.md

  - repo: https://github.com/Lucas-C/pre-commit-hooks
    rev: v1.5.5
    hooks:
      - id: remove-crlf
      - id: forbid-crlf
      - id: remove-tabs
        exclude: ^.git/|crate/server/src/tests/certificates/chain/root/ca
      - id: forbid-tabs
        exclude: ^.git/|crate/server/src/tests/certificates/chain/root/ca

  - repo: https://github.com/sirosen/texthooks
    rev: 0.6.8
    hooks:
      - id: fix-smartquotes
      - id: fix-ligatures
      - id: fix-spaces
        exclude: documentation/docs/images/google_cse.drawio.svg
      - id: forbid-bidi-controls
      - id: macro-expand

  - repo: https://github.com/jumanjihouse/pre-commit-hooks
    rev: 3.0.0
    hooks:
      - id: shellcheck

  - repo: local
    hooks:
      - id: shfmt
        name: shfmt (shell formatter)
        entry: shfmt
        args: [-w, -i, "2", -ci]
        language: system
        types: [shell]

  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v5.0.0
    hooks:
      - id: check-added-large-files
        exclude: ui/public|cli_documentation/docs/pkcs11/images
      - id: check-ast
      - id: check-byte-order-marker
      - id: check-builtin-literals
      - id: check-case-conflict
      - id: check-docstring-first
      - id: check-json
        exclude: ui
      - id: check-merge-conflict
      - id: check-symlinks
      - id: check-toml
      - id: check-vcs-permalinks
        exclude: crate/kmip/src/ttlv/kmip_ttlv_deserializer
      - id: check-xml
        exclude: crate/server/resources/production.drawio.svg
      - id: check-yaml
        exclude: monitoring
      - id: debug-statements
      - id: destroyed-symlinks
      - id: detect-private-key
        exclude: test_data|documentation/docs|crate/clients/clap/src/tests/google_cmd/identities.rs|crate/clients/ckms/src/tests/google_cmd/identities.rs|crate/server/src/tests|crate/clients/clap/src/tests/shared/export_import.rs|crate/clients/ckms/src/tests/shared/export_import.rs|crate/crypto/src/crypto/rsa/ckm_rsa_aes_key_wrap.rs|crate/clients/cng/src/key.rs

      - id: double-quote-string-fixer
      - id: end-of-file-fixer
        exclude: documentation/docs/cli/main_commands.md|documentation/docs
      - id: file-contents-sorter
      - id: fix-byte-order-marker
      - id: fix-encoding-pragma
      - id: mixed-line-ending
        args: [--fix=lf]
      - id: name-tests-test
      - id: requirements-txt-fixer
      - id: sort-simple-yaml
      - id: trailing-whitespace
        exclude: crate/crypto/src/openssl/x509_extensions.rs|documentation/docs/cli/main_commands.md|documentation/docs/configuration/server_cli.md

  - repo: https://github.com/psf/black
    rev: 25.1.0
    hooks:
      - id: black
        # avoid clash with `double-quote-string-fixer`
        args: [--skip-string-normalization]

  - repo: local
    hooks:
      - id: nixfmt
        name: nixfmt
        entry: nixfmt
        language: system
        files: \.nix$
        pass_filenames: true

  - repo: https://github.com/astro/deadnix
    rev: v1.2.1
    hooks:
      - id: deadnix
        args: [--edit]

  - repo: local
    hooks:
      - id: statix
        name: statix check
        entry: bash -c 'for f in "$@"; do statix fix "$f"; done' --
        language: system
        files: \.nix$
        pass_filenames: true

  - repo: https://github.com/Cosmian/git-hooks.git
    rev: v1.0.42
    hooks:
      - id: nightly-cargo-format
      - id: cargo-machete

  - repo: local
    hooks:
      - id: cargo-deny
        name: cargo deny check
        entry: cargo deny check
        language: system
        pass_filenames: false
        always_run: true

  - repo: https://github.com/Cosmian/git-hooks.git
    rev: v1.0.42
    hooks:
      - id: docker-compose-up
      - id: clippy-all-targets-all-features
      - id: clippy-all-targets

  - repo: local
    hooks:
      - id: generate-docs
        name: Regenerate all documentation
        description: |
          Master doc-generation script. Runs all steps that are triggered by Rust
          source changes:
            1. server_cli.md + server_configuration_file.md (from --help / --print-default-config)
            2. cli_documentation/docs/cli/main_commands.md + usage.md (from ckms markdown)
            3. KMIP support tables (README.md + kmip_support/support.md)
            4. crypto_inventory.md (cryptographic asset sensor, no network)
          CBOM generation (step 5) is skipped on every commit (manual stage only —
          it requires cdxgen and network access).
        entry: mise run docs:generate -- --skip-cbom
        language: system
        types: [rust]
        pass_filenames: false
        stages: [manual]

      - id: update-log-index
        name: Update log call-site index (log-reference.md)
        description: |
          Syncs documentation/docs/configuration/log-reference.md against the
          actual log call-sites in Rust and TypeScript source files.
          Flags stale entries with [REMOVED], appends new entries, and updates
          ×N multiplicity counts. Exits 1 when any change is made so the commit
          is blocked until the updated file is reviewed and re-staged.
        entry: python3 scripts/update_log_index.py --non-interactive --no-color
        language: system
        pass_filenames: false
        files: \.(rs|ts|tsx)$

      - id: cargo-deny-licenses
        name: Release - generate SBOM licenses list
        entry: bash -c 'cargo deny list -l crate > sbom/licenses.txt'
        language: system
        pass_filenames: false
        always_run: true
        stages: [manual]

      - id: cbom
        name: Release - generate CBOM
        entry: python3 .mise/scripts/sbom/generate_cbom.py
        language: system
        pass_filenames: false
        always_run: true
        stages: [manual]

      - id: release-update-readme-kmip
        name: Release - update README KMIP table
        entry: python3 .mise/scripts/docs/update_readme_kmip.py
        language: system
        pass_filenames: false
        always_run: true
        stages: [manual]

      - id: release-git-cliff
        name: Release - update CHANGELOG with git cliff
        entry: mise run release:changelog
        language: system
        pass_filenames: false
        always_run: true
        stages: [manual]

      # # Remove folders result*
      # - id: clean-result-folders
      #   name: Clean result* folders
      #   entry: bash .mise/scripts/release/clean_result.sh
      #   language: system
      #   types: [rust]
      #   pass_filenames: false
      #   stages: [manual]

      - id: pnpm-ui-format
        name: pnpm ui format
        entry: pnpm -C ui check:format
        language: system
        pass_filenames: false
        types_or: [javascript, jsx, ts, tsx]

      - id: pnpm-ui-lint
        name: pnpm ui check:lint
        entry: pnpm -C ui check:lint
        language: system
        pass_filenames: false
        types_or: [javascript, jsx, ts, tsx]

      - id: ui-wasm-react-unit-tests
        name: UI wasm + React tests (incl. integration if Docker)
        entry: mise run test:wasm
        language: system
        pass_filenames: false
        types_or: [javascript, jsx, ts, tsx]

      - id: ui-e2e
        name: UI end-to-end
        entry: mise run test:ui
        language: system
        pass_filenames: false
        types_or: [javascript, jsx, ts, tsx]

      - id: cargo-test-fips
        name: cargo test (sqlite fips)
        entry: mise run test:sqlite -- --variant fips
        language: system
        types: [rust]
        pass_filenames: false
        stages: [manual]

      - id: cargo-test-non-fips
        name: cargo test (sqlite non-fips)
        entry: mise run test:sqlite -- --variant non-fips
        language: system
        types: [rust]
        pass_filenames: false

      - id: redis-cargo-test-non-fips
        name: Redis and cargo test (non-fips)
        entry: mise run test:redis -- --variant non-fips
        language: system
        types: [rust]
        pass_filenames: false

      - id: nix-build-all
        name: Nix build all derivations (ui → cli → server)
        entry: mise run release:nix-update-hashes
        language: system
        pass_filenames: false
        always_run: true
        stages: [manual]

      - id: release-docker-build-ui
        name: Release - docker compose up + build UI + docker compose down
        entry: mise run build:ui
        language: system
        pass_filenames: false
        always_run: true
        stages: [manual]

  - repo: https://github.com/Cosmian/git-hooks.git
    rev: v1.0.42
    hooks:
      - id: nightly-clippy-autofix-unreachable-pub
      - id: nightly-clippy-autofix-all-targets-all-features
      - id: nightly-clippy-autofix-all-targets

      - id: dprint-toml-fix
        stages: [manual]
      - id: cargo-upgrade
        stages: [manual]
      - id: cargo-update
        stages: [manual]
      - id: cargo-format # in last du to clippy fixes
      - id: docker-compose-down

  - repo: https://github.com/tcort/markdown-link-check
    rev: v3.13.7
    hooks:
      - id: markdown-link-check
        args: [-q, --config, ./.github/.markdown-link-check.json]
        exclude: .github/copilot-instructions.md