.pre-commit-config.yaml

# Local guardrails that mirror the CI merge gate. Install with `uvx pre-commit install`.
# Revisions are pinned to full commit SHAs (tag noted alongside); bump deliberately via a reviewed PR.
repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b  # v5.0.0
    hooks:
      - id: end-of-file-fixer
      - id: trailing-whitespace
      - id: check-yaml
      - id: check-added-large-files
        args: ["--maxkb=2048"]
      - id: mixed-line-ending
        args: ["--fix=lf"]

  # Matches the ruff version pinned in uv.lock (0.15.17) so the hook and
  # `make lint` can never disagree about formatting.
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: 3b3f7c3f57fe9925356faf5fe6230835138be230  # v0.15.17
    hooks:
      - id: ruff
        args: ["--fix"]
      - id: ruff-format

  # Matches the mypy version pinned in uv.lock (2.1.0) and the CI typecheck
  # scope (`make typecheck` = mypy src web).
  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: d2823d321df3af8f878f7ee3414dc94d037145b9  # v2.1.0
    hooks:
      - id: mypy
        additional_dependencies: ["types-PyYAML"]
        files: ^(src|web)/

  - repo: https://github.com/gitleaks/gitleaks
    rev: 43fae355e6fe4d99d2a7b240a224b85e2903aeb4  # v8.21.2
    hooks:
      - id: gitleaks