.pre-commit-config.yaml

---
# pre-commit is a linter runner and GitHub hook manager
# See https://pre-commit.com for more information
# See https://pre-commit.com/hooks.html for more hooks
# Run `pre-commit autoupdate` now and then, why don't ya?

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: c4a0b883114b00d8d76b479c820ce7950211c99b # frozen: v4.5.0
    hooks:
      - id: trailing-whitespace
        args: [--markdown-linebreak-ext=md]
      - id: mixed-line-ending
        args: ["--fix=lf"]
      - id: end-of-file-fixer
        exclude: \.idea$
      - id: check-added-large-files
        args: ["--maxkb=2200"]
      - id: check-merge-conflict
      - id: detect-private-key
      - id: check-yaml
        files: \.ya?ml$
      - id: check-json
        files: \.json$
      - id: check-xml
        files: \.xml$

  # So we allow this hook to pass if there are no creds
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: c4a0b883114b00d8d76b479c820ce7950211c99b # frozen: v4.5.0
    hooks:
      - id: detect-aws-credentials
        args: [--allow-missing-credentials]

  # Scan for secrets
  - repo: https://github.com/zricethezav/gitleaks
    rev: e815c559e3ac76227e8e7463cf3a6598b715687b # frozen: v8.18.1
    hooks:
      - id: gitleaks-docker
        name: Detect hardcoded secrets
        description: Detect hardcoded secrets using Gitleaks
        language: docker_image
        entry: zricethezav/gitleaks:v8.15.0 protect --verbose --redact --staged