.pre-commit-config.yaml

# Pre-commit hooks configuration for SPAN SG
# Installation: pip install pre-commit && pre-commit install
# Documentation: https://pre-commit.com/

repos:
  # Secrets scanner (prevents credential leaks)
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks
        name: Gitleaks Secrets Scanner
        stages: [commit]

  # Python security linter (static analysis)
  - repo: https://github.com/PyCQA/bandit
    rev: '1.8.0'
    hooks:
      - id: bandit
        name: Bandit Security Linter
        args: ['-ll', '-r', 'scripts/', 'hooks/']
        exclude: ^tests/
        stages: [commit]

  # Dependency vulnerability checker (CVE database)
  - repo: local
    hooks:
      - id: safety
        name: Safety CVE Check
        entry: safety
        args: ['check', '-r', 'requirements-dsfr.txt']
        language: system
        pass_filenames: false
        stages: [commit]

  # Code formatting
  - repo: https://github.com/psf/black
    rev: '24.1.1'
    hooks:
      - id: black
        name: Black Code Formatter
        language_version: python3.9

  # Linting
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: 'v0.1.15'
    hooks:
      - id: ruff
        name: Ruff Linter
        args: [--fix]

  # Type checking
  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: 'v1.8.0'
    hooks:
      - id: mypy
        name: Mypy Type Checker
        args: [--ignore-missing-imports, --check-untyped-defs]
        additional_dependencies: [pikepdf, types-requests]