.pre-commit-config.yaml

---
# Pre-commit hooks for qubinode-pipelines
# Install with: pip install pre-commit && pre-commit install
# Run manually: pre-commit run --all-files

repos:
  # General file checks
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: trailing-whitespace
      - id: end-of-file-fixer
      - id: check-yaml
        args: ['--unsafe']  # Allow custom YAML tags
      - id: check-json
      - id: check-added-large-files
        args: ['--maxkb=1000']
      - id: check-merge-conflict
      - id: check-case-conflict
      - id: detect-private-key

  # Python code quality
  - repo: https://github.com/psf/black
    rev: 24.1.1
    hooks:
      - id: black
        language_version: python3
        args: ['--line-length=120']
        files: ^dags/.*\.py$

  # Python linting
  - repo: https://github.com/pycqa/flake8
    rev: 7.0.0
    hooks:
      - id: flake8
        args: ['--max-line-length=120', '--extend-ignore=E203,W503']
        files: ^dags/.*\.py$

  # Airflow DAG validation (non-blocking if Airflow not available)
  - repo: local
    hooks:
      - id: airflow-dag-validation
        name: Airflow DAG Validation
        entry: bash -c 'cd "$(git rev-parse --show-toplevel)" && ./scripts/validate-dags.sh || true'
        language: system
        files: ^dags/.*\.py$
        pass_filenames: false
        always_run: true
        stages: [commit]
        fail_fast: false

  # Secret detection with gitleaks (blocks pushes, allows commits)
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks
        args: ['--no-banner', '--verbose']
        stages: [push]
        # Only runs on push to block secrets from reaching remote
        # Commits are allowed to proceed for local development

  # YAML validation (for Airflow configs, etc.)
  - repo: https://github.com/adrienverge/yamllint
    rev: v1.33.0
    hooks:
      - id: yamllint
        args: ['-d', '{extends: default, rules: {line-length: {max: 120}}}']
        files: \.(yaml|yml)$

  # Shell script linting (less strict - warnings only)
  - repo: https://github.com/shellcheck-py/shellcheck-py
    rev: v0.9.0.6
    hooks:
      - id: shellcheck
        files: \.(sh|bash)$
        args: ['--severity=warning', '--exclude=SC1090,SC1091,SC2034,SC2086,SC2155']
        # SC1090/SC1091: Can't follow non-constant source
        # SC2034: Variable appears unused
        # SC2086: Double quote to prevent globbing
        # SC2155: Declare and assign separately