.pre-commit-config.yaml

# ============== WARNING ==============================================================================
# File is managed by copier template: gh:LabAutomationAndScreening/copier-base-template.git
# See .config/.copier-managed-files.json for details.
#
# You are welcome to make changes to this file in your repo if they are custom to your project,
# but if the change should be shared with other projects, please backport it to the template repo.
# =====================================================================================================
minimum_pre_commit_version: 4.5.1
# run `pre-commit autoupdate --freeze` to update all hooks
default_install_hook_types: [pre-commit, post-checkout]
repos:
  # Git-related
  - repo: https://github.com/jumanjihouse/pre-commit-hooks
    rev: 38980559e3a605691d6579f96222c30778e5a69e # frozen: 3.0.0
    hooks:
      - id: git-dirty

  # package management
  - repo: local
    hooks:
      - id: uv-check
        name: check pyproject.toml for valid uv config
        entry: bash -c 'uv lock --check'
        language: system
        pass_filenames: false
        verbose: true
        files: "^pyproject.toml$|^uv.lock$"

      - id: sync-dependencies-on-commit
        name: ensure python dependencies are up to date during commits
        stages:
          [pre-commit]
          # When the install does change things, it exits 0, so needed to check for the phrases 'Installed' or 'Uninstalled' in stderr (where uv writes its progress) in order to cause things pre-commit command to fail. 'Uninstalled' is checked separately because a removal-only sync never prints 'Installed'
        entry: python -c "import subprocess,sys; results=subprocess.run(['uv', 'sync', '--frozen'],timeout=360,capture_output=True); stderr=results.stderr.decode('utf-8', 'strict'); print ('stdout- ' + results.stdout.decode('utf-8', 'strict')); print ('stderr- ' + stderr); sys.exit(int(results.returncode or int('Installed' in stderr or 'Uninstalled' in stderr)));"
        # don't pass filenames else the command line sees them twice
        pass_filenames: false
        language: system
        files: "uv.lock$"
        verbose: true

      - id: sync-dependencies-post-checkout
        name: ensure python dependencies are up to date during checkouts
        stages: [post-checkout]
        entry: bash -c 'uv sync --frozen'
        pass_filenames: false
        language: system
        always_run: true
        verbose: true

  # Reformatting (should generally come before any file format or other checks, because reformatting can change things)
  - repo: https://github.com/crate-ci/typos
    rev: 12ffd4a04b4893ab75db66a59aaad2d996c3e982  # frozen: v1
    hooks:
      - id: typos
        args: [--write-changes, --force-exclude, --config, .config/_typos.toml]
        exclude: |
          (?x)^(
              .*\.min.js|
              .*\.min.css|
              .*\.umd.js|
          )$
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
    hooks:
      - id: trailing-whitespace
        exclude: |
          (?x)^(
              .*/vendor_files/.*|
              .*tests/.*/__snapshots__/.*|
              .*/generated/open[-_]api/.*|
          )$
      - id: end-of-file-fixer
        # the XML formatter hook doesn't leave a blank line at the end, so excluding XML files from this hook to avoid conflicts
        exclude: | # the extra trailing newline in the pull request template makes it easier to click there in the github console. The CLI that programmatically generates devcontainer-lock.json always ends the file incompatible with this hook.
          (?x)^(
              \.github/pull_request_template.md|
              template/\.github/pull_request_template.md|
              .*generated/graphql.ts|
              .*/generated/open[-_]api/.*|
              .*tests/.*/__snapshots__/.*|
              .devcontainer/devcontainer-lock.json|
              .*\.copier-answers\.yml(\.jinja(-base)?)?|
              .*\.xml|
              .*\.svg|
              .*/vendor_files/.*|
          )$

  # `language: system` so the hooks run the one Biome that .devcontainer/install-ci-tooling.py installs, which the VS Code
  # extension uses too, instead of a second copy whose version has to be kept in sync (https://biomejs.dev/recipes/git-hooks/#pre-commit)
  - repo: local
    hooks:
      - id: biome-check
        name: biome check
        entry: biome check --write --files-ignore-unknown=true --no-errors-on-unmatched --config-path .config/biome.jsonc
        language: system
        types: [text]
        files: '\.(jsx?|tsx?|c(js|ts)|m(js|ts)|d\.(ts|cts|mts)|jsonc?|css|svelte|vue|astro|graphql|gql)$'
        require_serial: true
      - id: biome-format-config
        name: format the biome config itself
        # run from .config/ so Biome treats the file as its own root config instead of rejecting it as a second one
        entry: bash -c 'cd .config && biome format --write biome.jsonc'
        language: system
        files: ^\.config/biome\.jsonc$
        pass_filenames: false

  - repo: https://github.com/rbubley/mirrors-prettier
    rev: 0ee178619d696787ca73d210cc191d720868c631  # frozen: v3.9.6
    hooks:
      - id: prettier
        args: [--config, .config/.prettierrc]
        # Biome formats everything else. Its Vue and HTML formatting is still experimental
        # TODO: get template YAML and MD files more in line with prettier expectations so we can start using prettier on those too
        exclude: |
          (?x)^(
              .*/__snapshots__/.*|
              .*/vendor_files/.*|
              template/.*|
          )$
        files: \.(vue|html)$


  - repo: https://github.com/pamoller/xmlformatter
    rev: bf91234ba2949363eec3429c4ecc2b39a9e8bfce  # frozen: v0.2.9
    hooks:
      - id: xml-formatter
        exclude: |
          (?x)^(
              .*/__snapshots__/.*|
              .*/vendor_files/.*|
              .*\.svg|
              .*\.wxs|  # formatter sorts attributes and joins multi-line ones, making the Windows installer files hard to read
          )$

  # Invalid File Checks
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
    hooks:
      - id: check-added-large-files
        args: ["--maxkb=123"]
        exclude: (uv.lock)|(pnpm-lock.yaml)
      - id: check-json
        # exclude JSON5 or JSONC files with comments
        exclude: |
          (?x)^(
              .devcontainer/devcontainer.json|
              .devcontainer/devcontainer-lock.json|
              .*devcontainer.json|
              .*pyrightconfig\.json|
              .*tsconfig.json|
          )$
      - id: check-yaml
        # some tools (e.g. pnpm) create multiple-document YAML streams
        args: [--allow-multiple-documents]
        # .copier-answers.yml is an autogenerated YAML file by Copier that throws 'found unhashable key' errors
        # Helm charts contain other non-YAML markers that cause errors here. they should be checked with helm-lint instead
        # VCRpy cassettes sometimes contain non-YAML markers that cause errors---but they're autogenerated anyway
        exclude: |
          (?x)^(
              (.*\.copier-answers\.yml)|
              (.*/?helm/.*)|
              (.*/tests/unit/.*/?cassettes/.*)|
          )$
      - id: check-xml
      - id: check-merge-conflict
      - id: check-case-conflict

  - repo: https://github.com/python-jsonschema/check-jsonschema
    rev: c4654a7e007c9619a5eb63c39a456572a0fa1851  # frozen: 0.38.0
    hooks:
      - id: check-github-workflows
      - id: check-jsonschema
        name: check taskfiles
        # Task itself silently ignores unknown keys, so a typo'd key is only caught by the schema.
        args: [--schemafile, 'https://taskfile.dev/schema.json']
        files: ^(Taskfile\.yaml|(template/)?\.config/taskfiles/[^/{]+\.yaml)$

  - repo: https://github.com/maresb/check-json5
    rev: bd4737432a2175617a9eeaa510ab369cbc1cbd3d  # frozen: v1.0.1
    hooks:
      - id: check-json5
        files: |
          (?x)^(
              .devcontainer/devcontainer.json|
              .devcontainer/devcontainer-lock.json|
              .*devcontainer.json|
              .*tsconfig.json|
          )$

  - repo: local
    hooks:
      - id: forbidden-files
        name: forbidden files
        entry: found copier update rejection files; review them and remove them
        language: fail
        files: "\\.rej$"

  # Safety/Security Issues
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
    hooks:
      - id: detect-private-key

  # - repo: https://github.com/woodruffw/zizmor-pre-commit # TODO: implement this: https://github.com/LabAutomationAndScreening/copier-base-template/issues/95
  #   rev: b933184438555436e38621f46ceb0c417cbed400  # frozen: v1.13.0
  #   hooks:
  #     - id: zizmor

  # Linting

  - repo: https://github.com/Lucas-C/pre-commit-hooks-markup
    rev: 501f3d60cee13c712492103343bc23efdc7b3d1f #v1.0.1
    hooks:
      - id: rst-linter
        # this hook fails on Sphinx documentation https://github.com/Lucas-C/pre-commit-hooks-markup/issues/13
        exclude: docs/.*\.rst$

  - repo: https://github.com/hadolint/hadolint
    rev: 2eece55955ced00200be9729e9728cb7dacca505  # frozen: v2.15.1
    hooks:
      - id: hadolint-docker
        name: Lint Dockerfiles
        # The hadolint pre-commit has a problem where it just always pulls the `latest` image at runtime.
        # Explicitly pinning the image here to the same rev as the hook to patch it until https://github.com/hadolint/hadolint/pull/1177 gets resolved.
        entry: ghcr.io/hadolint/hadolint:v2.15.1@sha256:fdf19d026b54834f88c62774fdf2a61ff3b586a42632e5070674d41a796bfdf3 hadolint
        exclude: .*\.jinja$
        description: Runs hadolint to lint Dockerfiles

  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: 65dbdb59d2f2d9c3bdc343c566821ad3319ddaa3  # frozen: v0.16.3
    hooks:
      - id: ruff
        name: ruff-src
        args: [--fix, --config=./.config/ruff.toml]
        files: src/.+\.py$
        exclude: |
          (?x)^(
              .*/generated/graphql/.*|
              .*/generated/open[-_]api/.*|
              template/.*|
          )$
      - id: ruff
        name: ruff-non-src # tests, scripts and other non-source code
        args: [--fix, --config=./.config/ruff-non-src.toml]
        files: ^(?!src/)(?!.+/src/).+\.py$
        exclude: |
          (?x)^(
              .*/generated/graphql/.*|
              .*/generated/open[-_]api/.*|
              template/.*|
          )$
      - id: ruff-format
        args: [--config=./.config/ruff.toml]
        exclude: |
          (?x)^(
              .*/generated/graphql/.*|
              .*/generated/open[-_]api/.*|
          )$

  - repo: https://github.com/pylint-dev/pylint
    rev: f5a6e3b1de17502747a40d7f92f285ccf9c6c459  # frozen: v4.0.7
    hooks:
      - id: pylint
        name: pylint
        # exclude any generated code
        # flagging duplicate code for __all__ lists is a false positive
        # exclude the template files---duplication within them will be discovered during CI of that template instantiation
        exclude: |
          (?x)^(
              .*/generated/graphql/.*|
              .*/generated/open[-_]api/.*|
              .*__init__\.py|
              template/.*|
          )$
        args:
          - --rcfile=./.config/pylintrc.toml
        verbose: true

  - repo: local
    hooks:
      - id: pyrefly
        name: pyrefly
        entry: bash -c "uv run --frozen pyrefly check -c ./.config/pyrefly.toml"
        files: '.+\.py$'
        exclude: |
          (?x)^(
              .*/generated/graphql/.*|
              .*/generated/open[-_]api/.*|
          )$
        # don't pass filenames else the command line sees them twice
        pass_filenames: false
        language: system
        types: [python]
        # use require_serial so that script is only called once per commit
        require_serial: true
        # print the number of files as a sanity-check
        verbose: true

  # Updating repo config/tooling files
  - repo: local
    hooks:
      - id: merge-claude-settings
        # Keep Claude's settings.json synced with the JSON5 files. It's only for local development, so don't run it in CI
        name: merge Claude settings
        entry: bash -c '[[ "${GITHUB_ACTIONS:-}" == "true" || "${CI:-}" == "true" ]] && exit 0; bash .claude/helpers/merge-claude-settings.sh'
        files: ^\.claude/settings/.*\.(json|jsonc)$
        pass_filenames: false
        language: system

      - id: task-list
        # Schema validation cannot see across files: only Task itself resolves the include paths in the root shim and
        # rejects a task name defined by two flattened includes. Listing is enough to trigger both errors.
        name: validate taskfile includes and task names
        entry: bash -c "task --list-all > /dev/null"
        files: ^(Taskfile\.yaml|\.config/taskfiles/.*)$
        pass_filenames: false
        language: system

      - id: compute-devcontainer-context-hash
        # Devcontainer context --- this makes Github's "prebuild codespaces" feature work more intelligently for the "Configuration Change" trigger
        name: compute devcontainer context hash
        entry: bash -c "python3 .github/workflows/hash_git_files.py . --for-devcontainer-config-update"
        files: (.*.lock)|(.*pnpm-lock.yaml)|(.*hash_git_files.py)|(.devcontainer/.*)|(\.pre-commit-config.yaml)
        pass_filenames: false
        language: system