1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
pre-commit:
parallel: true
commands:
gitleaks:
run: gitleaks protect --staged --redact --verbose --config=.gitleaks.toml
ripsecrets:
glob: "*"
run: ripsecrets --strict-ignore {staged_files}
# fmt/clippy are SCOPED to the crates touched by this commit, not the
# whole workspace. A 100-crate `--workspace` gate makes every commit
# hostage to every other in-progress crate (and serialises the build
# queue). Per-crate scoping is the lint-staged principle: gate what you
# change. clippy uses FOP_BUILD_BACKEND=local (pre-commit MUST be local:
# the commit is not pushed yet, so a remote/Gitea-Actions runner cannot
# check out the staged changes); $PWD is the repo root (lefthook cwd).
# `fop clippy` injects `--all-targets --all-features` — do not repeat those.
fmt:
glob: "*.rs"
# rustfmt --check on the staged files directly. Formatting is a parse,
# not a compile — it needs no build-queue capacity, so it must NOT be
# routed through `nido` (that gated a light check behind a heavy build
# admission and timed out). Deleted paths are filtered out.
#
# Edition MUST match the workspace `Cargo.toml` edition (currently
# 2021); otherwise per-file rustfmt produces import-orderings that
# `cargo fmt --all` (used by the dioxus-app-parity gate) immediately
# reverts. When the workspace bumps to edition 2024, bump this flag.
run: |
files=$(for f in {staged_files}; do [ -f "$f" ] && echo "$f"; done)
[ -z "$files" ] && exit 0
rustfmt --check --edition 2021 $files
clippy:
glob: "crates/*/**/*.rs"
# nido-gui is dropped from the set: it needs webkit2gtk, which
# contributors must not need for a pre-commit hook (it has its own
# gui-release.yml pipeline).
run: |
pkgs=$(printf '%s\n' {staged_files} | sed -n 's#^crates/\([^/]*\)/.*#\1#p' | grep -v '^nido-gui$' | sort -u)
[ -z "$pkgs" ] && exit 0
FOP_CAPACITY_WAIT_SOFT=1 FOP_BUILD_BACKEND=local fop clippy --headless "$PWD" -- $(printf -- '-p %s ' $pkgs) -- -D warnings
pre-push:
commands:
cargo-deny:
# cargo-deny's auto-discovery only finds `deny.toml`. The nido repo has
# kept the descriptive `cargo-deny.toml` filename because nido-ci checks
# reference it by name (crates/nido-ci/src/runner.rs). Pass `--config`
# explicitly so the hook reads our real allow-list instead of falling
# back to cargo-deny defaults (which reject `0BSD`, used by adler2).
run: cargo deny check --config cargo-deny.toml