devops/.pre-commit-config.yaml at main · decdn/devops · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
---
# Pre-commit hooks for the deCDN DevOps monorepo.
#
#   pip install pre-commit && make hooks      # one-time install
#   make lint                                 # run on all files
#
# Heavier checks (ansible-lint, syntax-check, KICS security scan, and the Helm
# chart's `make lint-helm`) run in CI — see .github/workflows/. ansible-lint's production profile already
# carries the Ansible security rules; this file is the fast local gate (hygiene,
# shellcheck, yamllint, markdown).
minimum_pre_commit_version: "3.5.0"
default_install_hook_types: [pre-commit]

# Vendored / generated trees only.
exclude: >-
  (?x)^(
    ansible/collections/|
    ansible/\.ansible/|
    charts/[^/]+/files/monitoring/[^/]+\.(json|ya?ml)$
  )

repos:
  # ── Generic hygiene ────────────────────────────────────────────────────────
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v6.0.0
    hooks:
      - id: trailing-whitespace
        args: [--markdown-linebreak-ext=md]   # keep markdown hard line breaks
      - id: end-of-file-fixer
      - id: check-merge-conflict
      - id: check-added-large-files
        args: [--maxkb=512]
      - id: check-executables-have-shebangs
      - id: check-shebang-scripts-are-executable
        # Jinja2 templates render files that carry a shebang (e.g. nftables.conf
        # starts with `#!/usr/sbin/nft -f`); the template itself isn't a script.
        exclude: \.j2$
      - id: mixed-line-ending
        args: [--fix=lf]
      - id: check-yaml
        args: [--unsafe]   # tolerate custom/!vault tags; syntax check only
        # Helm templates are Go templates, not YAML; `make lint-helm` renders and
        # validates them instead.
        exclude: ^charts/[^/]+/templates/
      - id: check-json
      - id: check-toml

  # ── Bash ───────────────────────────────────────────────────────────────────
  # Honors inline `# shellcheck` directives and the repo .shellcheckrc.
  - repo: https://github.com/koalaman/shellcheck-precommit
    rev: v0.11.0
    hooks:
      - id: shellcheck

  # ── Markdown (relaxed ruleset; see .markdownlint-cli2.yaml) ────────────────
  - repo: https://github.com/DavidAnson/markdownlint-cli2
    rev: v0.23.3
    hooks:
      - id: markdownlint-cli2

  # ── YAML lint for the Ansible tree and cloud-init/ (reuses ansible/.yamllint) ─
  # Scoped so it stays in lockstep with `make -C ansible lint`. cloud-init/ is the
  # Ansible project's user-data and collection lock, so it takes the same rules.
  # *.yml.example templates don't match (they end in .example) and are skipped.
  - repo: local
    hooks:
      - id: yamllint-ansible
        name: yamllint (ansible/, cloud-init/)
        entry: yamllint -c ansible/.yamllint
        language: python
        additional_dependencies: ["yamllint==1.35.1"]
        files: ^(ansible|cloud-init)/.*\.(ya?ml)$
        exclude: ^ansible/(collections|\.ansible)/

      # Opt-in: full ansible-lint locally (needs `make -C ansible deps` first).
      #   pre-commit run ansible-lint --hook-stage manual
      - id: ansible-lint
        name: ansible-lint (manual — run `make -C ansible deps` first)
        entry: bash -c 'make -C ansible lint'
        language: system
        pass_filenames: false
        stages: [manual]