Nest/.pre-commit-config.yaml at main · OWASP/Nest · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
repos:
  - repo: https://github.com/AleksaC/hadolint-py
    rev: 458cb25edf664682e3e856a53a2f9af33e068297  # v2.14.0
    hooks:
      - id: hadolint
        args:
          - --failure-threshold=warning
        name: hadolint

  - repo: https://github.com/EbodShojaei/bake
    rev: a39df91c8e2c8ee584f81ff8d7d00f137a5fc160  # v1.4.6
    hooks:
      - id: mbake-format
        args:
          - --config
          - .bake.toml
      - id: mbake-validate
        args:
          - --config
          - .bake.toml
        # Component Makefiles use root-relative includes and call shared targets; mbake
        # validates each file in isolation from its own directory, so only the root
        # Makefile can be checked.
        exclude: ^(backend|cspell|docs|e2e|frontend|infrastructure|make|tools)/

  - repo: https://github.com/adrienverge/yamllint.git
    rev: cba56bcde1fdd01c1deb3f945e69764c291a6530  # v1.38.0
    hooks:
      - id: yamllint
        args:
          - --format
          - parsable
          - --strict
        exclude: pnpm-lock.yaml

  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: 05fd71a57a467ccf5598f7e836d3af4cf9225abb  # v1.108.0
    hooks:
      - id: terraform_providers_lock
        args:
          - --args=-platform=darwin_arm64
          - --args=-platform=linux_amd64
          - --args=-platform=linux_arm64
          - --hook-config=--mode=regenerate-lockfile-if-some-platform-missed
        files: .terraform.lock.hcl
        name: Lock Terraform providers
      - id: terraform_fmt
        files: ^infrastructure/.*\.(tf|tftest\.hcl)$
      - id: terraform_tflint
        files: ^infrastructure/.*\.tf$
        args:
          - --args=--config=__GIT_WORKING_DIR__/infrastructure/.tflint.hcl

  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: c59bba8fb259db0fec2bbb77ad8ba51ea7341b56  # v0.15.20
    hooks:
      - id: ruff-check
        args:
          - --config
          - ruff.toml
          - --fix
      - id: ruff-format
        args:
          - --config
          - ruff.toml

  - repo: https://github.com/djlint/djLint
    rev: df39c89b663e0ef6292e461bb5fb283ddd0680dd  # v1.40.3
    hooks:
      - id: djlint-reformat-django
        files: templates/.*.html
        entry: djlint --reformat
        types:
          - html

  - repo: https://github.com/igorshubovych/markdownlint-cli
    rev: a4d5d37e66ebcd6b3705204a1d6dbb56dea66338  # v0.49.0
    hooks:
      - id: markdownlint
        args:
          - --fix
        files: \.md$

  - repo: https://github.com/jumanjihouse/pre-commit-hook-yamlfmt
    rev: 8d1b9cadaf854cb25bb0b0f5870e1cc66a083d6b  # 0.2.3
    hooks:
      - id: yamlfmt
        args:
          - --implicit_start
          - --mapping=2
          - --offset=2
          - --sequence=4
        exclude: (pnpm-lock.yaml|\.yamllint)

  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: d2823d321df3af8f878f7ee3414dc94d037145b9  # v2.1.0
    hooks:
      - id: mypy
        additional_dependencies:
          - strawberry-graphql==0.320.1
          - strawberry-graphql-django==0.86.4
          - types-lxml==2026.2.16
          - types-python-dateutil==2.9.0.20260518
          - types-PyYAML==6.0.12.20260518
          - types-requests==2.33.0.20260518
        entry: bash -c 'cd backend && mypy --config-file pyproject.toml src tests'

  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # v6.0.0
    hooks:
      - id: check-ast
      - id: check-builtin-literals
      - id: fix-byte-order-marker
      - id: check-case-conflict
      - id: check-executables-have-shebangs
      - id: check-json
        # tsconfig.json uses JSONC (comments).
        # Matches frontend/tsconfig.json and frontend/**/tsconfig.json
        exclude: ^frontend/(?:[^/]+/)*tsconfig\.json$
      - id: check-merge-conflict
      - id: check-toml
      - id: check-yaml
        exclude: pnpm-lock\.yaml$
      - id: detect-private-key
      - id: end-of-file-fixer
        exclude: frontend/src/types/__generated__
        exclude_types:
          - svg
      - id: file-contents-sorter
        args:
          - --unique
        files: (.github/check-contribution-skip-usernames.txt|cspell/custom-dict.txt)
      - id: mixed-line-ending
        args:
          - --fix=lf
      - id: name-tests-test
        args:
          - --pytest
        exclude: backend/tests/(cluster-fuzz-lite|data)
        files: backend/tests
      - id: trailing-whitespace
        exclude: pnpm-lock.yaml

  - repo: https://github.com/rhysd/actionlint
    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca  # v1.7.12
    hooks:
      - id: actionlint-docker

  - repo: https://github.com/terraform-docs/terraform-docs
    rev: 9d4455198941806aa02ec14369de030cda2c2b59  # v0.24.0
    hooks:
      - id: terraform-docs-go
        args:
          - infrastructure/
        files: ^infrastructure/.*\.tf$|^infrastructure/\.terraform-docs\.ya?ml$

  - repo: https://github.com/tox-dev/pyproject-fmt
    rev: 0c8c15d8fe996493035be407c5cf4a288cf6bf8e  # v2.25.1
    hooks:
      - id: pyproject-fmt
        additional_dependencies:
          - toml-fmt-common<1.3.3

  - repo: https://github.com/zizmorcore/zizmor-pre-commit
    rev: e3eebf65325ccc992422292cb7a4baee967cf815  # v1.26.1
    hooks:
      - id: zizmor
        args:
          - --min-severity=low