1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# See https://pre-commit.com for more information
# Run `pre-commit install` after cloning to enable hooks
# Run `pre-commit autoupdate` periodically to bump versions
minimum_pre_commit_version: "3.2.0"
default_stages:
fail_fast: false
repos:
# ── General hygiene ──────────────────────────────────────────
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v5.0.0
hooks:
- id: trailing-whitespace
exclude: ^\.planning/
- id: end-of-file-fixer
exclude: ^\.planning/
- id: check-yaml
- id: check-toml
- id: check-merge-conflict
- id: check-added-large-files
args:
- id: mixed-line-ending
args:
- id: check-case-conflict
- id: check-symlinks
# ── Secret detection ─────────────────────────────────────────
- repo: https://github.com/gitleaks/gitleaks
rev: v8.24.0
hooks:
- id: gitleaks
exclude: ^\.planning/
# ── Spell checking (Rust-native, fast) ───────────────────────
- repo: https://github.com/crate-ci/typos
rev: v1.32.0
hooks:
- id: typos
# Report, never rewrite. The upstream hook is
# `typos --write-changes --force-exclude` — it EDITS what it flags, and
# for this repo that is the wrong default. Misspellings are the payload
# under test in `schemas/conformance/` (a fixture asserting an UNKNOWN
# fact id warns) and in `src/zone_eval/`, so the auto-fix silently
# rewrote eighteen files into what reads in review as innocuous
# spelling fixes — one of them turning
# `assert!(!is_known_fact_id("aproved_domains"))` into an assertion
# about the known id, contradicting the line above it.
# Dropping `--write-changes` keeps the whole class out: the hook names
# the word and stops the commit, and a human chooses between fixing it
# and pinning it in `_typos.toml`.
args:
exclude: |
(?x)^(
Cargo\.lock|
\.planning/.*|
coverage/.*|
.*\.svg|
.*\.png|
.*\.ico
)$
# ── Rust formatting ──────────────────────────────────────────
- repo: local
hooks:
- id: cargo-fmt
name: cargo fmt
entry: cargo fmt --all -- --check
language: system
types:
pass_filenames: false
# Same scanner pr-checks.yml runs. Development happens on Linux, so a
# POSIX-only path reads as correct locally until a Windows user hits it —
# catch it at commit time rather than at release time.
- id: check-portability
name: portability (POSIX-only assumptions)
entry: python3 ci/check-portability.py .
language: system
types:
pass_filenames: false
# ── Conventional commits ─────────────────────────────────────
- repo: https://github.com/compilerla/conventional-pre-commit
rev: v4.0.0
hooks:
- id: conventional-pre-commit
stages:
args:
- feat
- fix
- docs
- style
- refactor
- perf
- test
- build
- ci
- chore
- revert