toolguard/.pre-commit-config.yaml at main · AgentToolkit/toolguard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
# This is an example configuration to enable detect-secrets in the pre-commit hook.
# Add this file to the root folder of your repository.
#
# Read pre-commit hook framework https://pre-commit.com/ for more details about the structure of config yaml file and how git pre-commit would invoke each hook.
#
# This line indicates we will use the hook from ibm/detect-secrets to run scan during committing phase.
repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v6.0.0
    hooks:
      - id: trailing-whitespace
      - id: check-added-large-files
        exclude: uv.lock
      - id: check-toml
      - id: end-of-file-fixer
      - id: check-merge-conflict
        args: [ --assume-in-merge ]

  - repo: https://github.com/astral-sh/ruff-pre-commit
    # Ruff version.
    rev: v0.13.2
    hooks:
      # Run the linter.
      - id: ruff-check
        args: [ --fix ]
      # Run the formatter.
      - id: ruff-format

  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: 'v1.18.2'
    hooks:
    - id: mypy

  - repo: https://github.com/astral-sh/uv-pre-commit
    # uv version.
    rev: 0.8.22
    hooks:
      # Update the uv lockfile
      - id: uv-lock

  - repo: https://github.com/ibm/detect-secrets
    # If you desire to use a specific version of detect-secrets, you can replace `master` with other git revisions such as branch, tag or commit sha.
    # You are encouraged to use static refs such as tags, instead of branch name
    #
    # Running "pre-commit autoupdate" automatically updates rev to latest tag
    rev: 0.13.1+ibm.64.dss
    hooks:
      - id: detect-secrets # pragma: whitelist secret
        # necessary to fix breaking bug in new box sdk
        additional_dependencies: [boxsdk<4]
        # Add options for detect-secrets-hook binary. You can run `detect-secrets-hook --help` to list out all possible options.
        # You may also run `pre-commit run detect-secrets` to preview the scan result.
        # when "--baseline" without "--use-all-plugins", pre-commit scan with just plugins in baseline file
        # when "--baseline" with "--use-all-plugins", pre-commit scan with all available plugins
        # add "--fail-on-unaudited" to fail pre-commit for unaudited potential secrets
        args: [--baseline, .secrets.baseline, --use-all-plugins]