podspine/.pre-commit-config.yaml at main · schubydoo/podspine · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
# Podspine pre-commit: the shift-left quality gate for the Rust/Cargo
# workspace.
#
#   commit stage : fast hygiene + fmt --check + clippy (-D warnings) + lib unit tests   (~seconds)
#   push  stage  : full workspace test suite (incl. ffmpeg-backed integration tests)
#
# cargo audit / cargo deny also run at the PUSH stage locally (see below).
# They need the online advisory DB, and `language: system` means both
# binaries must be on PATH: `cargo install cargo-audit cargo-deny`. Without
# them the pre-push hook fails. Hook commands mirror
# .github/workflows/ci.yml exactly, so the local gate and CI never drift.
# Bypass a hook deliberately with SKIP=<id> or --no-verify.
minimum_pre_commit_version: "3.2.0"
default_install_hook_types: [pre-commit, pre-push]

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v6.0.0
    hooks:
      - id: trailing-whitespace
        exclude: '^LICENSE$'          # keep the AGPL text byte-exact
      - id: end-of-file-fixer
        exclude: '^LICENSE$'
      - id: check-yaml
        # mkdocs.yml uses the `!!python/name:` tag (Material Mermaid fence);
        # the safe loader cannot resolve it. Everything else stays
        # safe-loaded.
        exclude: '^mkdocs\.yml$'
      - id: check-toml
      - id: check-merge-conflict
      - id: detect-private-key
      - id: mixed-line-ending
        args: [--fix=lf]
      - id: check-added-large-files    # nothing big sneaks in next to 500MB+ fixtures
        args: [--maxkb=1024]

  - repo: local
    hooks:
      # Guard: audiobook media must never be committed (fixtures live outside
      # the repo).
      - id: no-audio-fixtures
        name: block audio media files
        entry: "Audio media must not be committed — keep fixtures outside the repo (e.g. /home/claude/audiobooks). Override with: git add -f + SKIP=no-audio-fixtures."
        language: fail
        files: '\.(m4b|m4a|mp3|flac|ogg|opus|aax|aaxc|aa)$'

      # Guard: knope changeset fragments must have front matter and a
      # SINGLE-line body. Otherwise the release fails ("missing front matter"),
      # or the changelog renders a `#### heading` mid-list instead of a
      # bullet. This runs when a fragment changes.
      - id: changeset-lint
        name: changeset fragment lint (knope one-line body)
        entry: sh scripts/lint_changesets.sh
        language: system
        files: '^\.changeset/.+\.md$'
        pass_filenames: false

      # ---- commit stage: fast feedback on every commit ----
      - id: cargo-fmt
        name: cargo fmt --check
        entry: cargo fmt --all -- --check
        language: system
        types: [rust]
        pass_filenames: false

      - id: cargo-clippy
        name: cargo clippy (deny warnings)
        entry: cargo clippy --workspace --all-targets --all-features -- -D warnings
        language: system
        types: [rust]
        pass_filenames: false

      - id: cargo-test-unit
        name: cargo test (lib unit tests)
        entry: cargo test --workspace --lib
        language: system
        types: [rust]
        pass_filenames: false

      # ---- push stage: full suite before code leaves the machine ----
      - id: cargo-test-full
        name: cargo test (full workspace suite)
        entry: cargo test --workspace --all-features
        language: system
        types: [rust]
        pass_filenames: false
        stages: [pre-push]

      # Supply-chain checks mirror CI's supply-chain job. No `types` filter:
      # advisories/licenses can change independent of the source files. They
      # need network access.
      - id: cargo-audit
        name: cargo audit (RustSec advisories)
        entry: cargo audit
        language: system
        pass_filenames: false
        stages: [pre-push]

      - id: cargo-deny
        name: cargo deny (licenses/bans/sources/advisories)
        entry: cargo deny check
        language: system
        pass_filenames: false
        stages: [pre-push]

      # ---- push stage: CLI end-to-end (uncomment once podspine-cli lands; Task 1.6) ----
      # - id: e2e-cli
      #   name: CLI end-to-end smoke tests
      #   entry: bash scripts/e2e_test.sh
      #   language: system
      #   pass_filenames: false
      #   stages: [pre-push]