prek.toml

# prek.toml — pre-commit hook configuration
# Docs: https://prek.j178.dev
#
# Install hooks:      prek install
# Run on all files:   prek run --all-files
# Update pinned revs: prek auto-update

# ── Built-in: fast Rust-native checks (priority 0) ────────────────────────────
# No network, no environment setup — run first to catch trivial issues cheaply.

[[repos]]
repo = "builtin"

# The omnigraph store fixtures are binary Lance data whose manifests sniff as
# text; "fixing" them corrupts the stores the contract suite opens.
[[repos.hooks]]
id = "trailing-whitespace"
priority = 0
exclude = "^packages/witan-core/tests/fixtures/omnigraph-stores/"

[[repos.hooks]]
id = "end-of-file-fixer"
priority = 0
exclude = "^packages/witan-core/tests/fixtures/omnigraph-stores/"

[[repos.hooks]]
id = "check-merge-conflict"
priority = 0

[[repos.hooks]]
id = "check-case-conflict"
priority = 0

[[repos.hooks]]
id = "check-added-large-files"
priority = 0

[[repos.hooks]]
id = "check-toml"
priority = 0

[[repos.hooks]]
id = "check-yaml"
priority = 0

[[repos.hooks]]
id = "check-json"
priority = 0

[[repos.hooks]]
id = "check-executables-have-shebangs"
priority = 0

[[repos.hooks]]
id = "check-shebang-scripts-are-executable"
priority = 0

[[repos.hooks]]
id = "detect-private-key"
priority = 0
# The witan scanner's own test fixtures contain a sample PEM header on purpose;
# gitleaks handles them via inline `# gitleaks:allow`, but detect-private-key has
# no inline pragma, so exclude that one fixture file here.
exclude = "^mcp/servers/witan/tests/test_detectors\\.py$"

# ── Shell: shellcheck (priority 10) ───────────────────────────────────────────

[[repos]]
repo = "https://github.com/shellcheck-py/shellcheck-py"
rev = "v0.11.0.1"
hooks = [{ id = "shellcheck", priority = 10 }]

# ── GitHub Actions: actionlint (priority 10, parallel with shellcheck) ────────

[[repos]]
repo = "https://github.com/rhysd/actionlint"
rev = "v1.7.12"

[[repos.hooks]]
id = "actionlint"
priority = 10
files = "^\\.github/workflows/.*\\.ya?ml$"

# ── GitHub Actions: zizmor (priority 10, parallel with shellcheck) ────────────

[[repos]]
repo = "https://github.com/zizmorcore/zizmor-pre-commit"
rev = "v1.31.1"

[[repos.hooks]]
id = "zizmor"
priority = 10
args = ["--no-progress", "--min-severity=high", "--min-confidence=medium"]

# ── Secrets: gitleaks (priority 10, parallel with shellcheck) ─────────────────
# Comprehensive secret scanning; complements the builtin detect-private-key.
# `gitleaks` scans staged changes only, so it checks nothing once the work is committed
# (CI, `prek run --all-files`). `gitleaks-pr` is the CI counterpart: manual stage, so
# `prek run --all-files` and the commit hook skip it, and the autofix workflow runs it
# explicitly over the commits the pull request adds. `--pre-commit=false` and
# `--staged=false` cancel the flags in the hook's entry (the last occurrence wins);
# with either left on, gitleaks ignores --log-opts and scans nothing.
# It needs origin/main and full history, which the workflow fetches.

[[repos]]
repo = "https://github.com/gitleaks/gitleaks"
rev = "v8.30.1"

[[repos.hooks]]
id = "gitleaks"
priority = 10

[[repos.hooks]]
id = "gitleaks"
alias = "gitleaks-pr"
name = "Detect hardcoded secrets in the commits a PR adds"
stages = ["manual"]
args = ["--pre-commit=false", "--staged=false", "--log-opts=--no-merges origin/main..HEAD"]
priority = 10

# ── Markdown: markdownlint (priority 10, parallel) ────────────────────────────
# docs/reference/ is generated by bin/gen_docs.py (`just docs-gen`), so lint its sources instead.
# Rule choices live in .markdownlint.yaml. Do not pass `--disable <rules...>` here:
# it is variadic and swallows the filenames prek appends, so nothing gets linted.

[[repos]]
repo = "https://github.com/igorshubovych/markdownlint-cli"
rev = "v0.50.0"
hooks = [{ id = "markdownlint", priority = 10, exclude = "^docs/reference/" }]

# ── Python: ruff (priority 20 format → 30 lint) ───────────────────────────────
# Format runs first (priority 20); lint runs after (priority 30) so ruff check
# always sees already-formatted code and avoids spurious format-related findings.
# Covers Python added for the planned witan MCP server.

[[repos]]
repo = "https://github.com/astral-sh/ruff-pre-commit"
rev = "v0.17.2"

[[repos.hooks]]
id = "ruff-format"
priority = 20

[[repos.hooks]]
id = "ruff"
priority = 30

# ── TypeScript / JS / JSON: biome (priority 20, parallel with ruff-format) ────
# biome-check runs format + lint in one pass with --write (auto-fixes what it
# can; unfixable issues fail the commit). Safe to run parallel with ruff-format
# since the two tools operate on disjoint file types (.py vs .ts/.tsx/.json).
# Covers TypeScript for planned pi extensions and JSON config snippets.

# The witan UI fixtures are excluded: they are GENERATED
# (`just ui-fixtures`) and byte-compared by `just ui-fixtures-check`, so
# letting biome reformat them makes that gate fail on every commit against
# files nobody edited. The omnigraph store fixtures are excluded for the same
# reason the fixer hooks above skip them: they are an omnigraph's own output.
#
# `files` pins the file types biome owns here. Upstream's hook added md, yml and
# yaml in v2.6.3, and biome's Markdown formatter indents with tabs and rewrites
# `*emphasis*`, which markdownlint (the Markdown owner) then rejects.
[[repos]]
repo = "https://github.com/biomejs/pre-commit"
rev = "v2.6.3"
hooks = [
  { id = "biome-check", priority = 20, files = '\.(jsx?|tsx?|c(js|ts)|m(js|ts)|d\.(ts|cts|mts)|jsonc?|css|svelte|vue|astro|graphql|gql)$', exclude = "^(mcp/servers/witan/ui/fixtures|packages/witan-core/tests/fixtures/omnigraph-stores)/" },
]

# ── Skills: portability check (priority 10, parallel) ─────────────────────────
# Every skill in agent-config.toml's [skills] installs on every platform
# (Claude Code, Pi, Copilot, OpenCode), so a Claude-only tool (Agent tool,
# AskUserQuestion, built-in /review, subagents, ...) may be named only in a
# passage that also gives the fallback. Stdlib-only, no env to build. See the
# script's docstring for the rule and the `<!-- portability: ok -->` allowlist.

[[repos]]
repo = "local"

[[repos.hooks]]
id = "skill-portability"
name = "skill portability (no unconditional Claude-only tools)"
entry = "python3 bin/check_skill_portability.py"
language = "system"
pass_filenames = false
files = "^(skills/.*\\.md|agent-config\\.toml|bin/check_skill_portability\\.py)$"
priority = 10

# ── Skills: session-preflight script tests (priority 10, parallel) ────────────
# The script ships inside the skill and runs under plain `python3` at session
# start, so its tests are stdlib unittest too: no env to build, and they run
# here because no package's pytest suite covers files under skills/.

[[repos.hooks]]
id = "session-preflight-tests"
name = "session-preflight script tests"
entry = "python3 -m unittest discover -s tests/skills"
language = "system"
pass_filenames = false
files = "^(skills/workflow/session-preflight/|tests/skills/)"
priority = 10