repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v5.0.0
hooks:
- id: trailing-whitespace
- id: end-of-file-fixer
- id: check-yaml
args: [--allow-multiple-documents]
- id: check-toml
- id: check-merge-conflict
- id: detect-private-key
- id: mixed-line-ending
args: [--fix=lf]
- id: check-added-large-files
args: [--maxkb=500]
- repo: https://github.com/Yelp/detect-secrets
rev: v1.5.0
hooks:
- id: detect-secrets
args: [--baseline, .secrets.baseline]
exclude: ^\\.github/|deny\\.toml|fuzz/
fail_on_never: false
- repo: https://github.com/conventional-commits/commitlint
rev: v20.0.0
hooks:
- id: commitlint
name: Commitlint
entry: commitlint --edit $@
stages: [commit-msg]
- repo: local
hooks:
- id: just-qa
name: just qa (CI gate)
entry: just qa
language: system
pass_filenames: false
pass_env: [CARGO_TERM_COLOR]
stages: [pre-push]
- id: generate-completions
name: Generate completions & man page
entry: bash -c 'git diff --quiet src/cli.rs Cargo.toml build.rs 2>/dev/null || (cargo build && git add completions/ netspeed-cli.1)'
language: system
pass_filenames: false
pass_env: [GIT_DIR]
- repo: local
hooks:
- id: check-unsafe-code
name: Check for unsafe code
entry: |
if grep -r 'unsafe' src/ --include='*.rs' | grep -v 'allow(unsafe_code)' | grep -v 'allow.unsafe_code.' > /dev/null; then
echo 'Warning: unsafe code found - review recommended'
grep -rn 'unsafe' src/ --include='*.rs' | grep -v 'allow(unsafe_code)' | grep -v 'allow.unsafe_code.'
fi
language: system
pass_filenames: false
types: [rust]
- id: check-hardcoded-secrets
name: Check for hardcoded secrets
entry: |
if grep -rnE 'password|secret|token|api_key' src/ --include='*.rs' | grep -v '//' | grep -v 'example' | grep -v 'placeholder' | grep -v 'None' | grep -v 'Option' | grep -v 'default' | grep -v '.get(' > /dev/null; then
echo 'Warning: Potential hardcoded secrets found - review recommended'
grep -rnE 'password|secret|token|api_key' src/ --include='*.rs' | grep -v '//' | grep -v 'example' | grep -v 'placeholder' | head -10
fi
language: system
pass_filenames: false
types: [rust]
- id: check-file-permissions
name: Check file permissions
entry: |
if ! grep -q 'set_permissions.*0o600' src/ && grep -q 'set_permissions' src/; then
echo 'Warning: set_permissions found but not with 0o600 mode'
fi
language: system
pass_filenames: false
types: [rust]
- id: check-deny-toml
name: Validate deny.toml
entry: "echo 'Note: Full cargo-deny audit runs in CI (weekly schedule)'"
language: system
pass_filenames: false