.pre-commit-config.yaml

# Pre-commit (https://pre-commit.com) configuration for assorted lint checks.
#
# See https://pre-commit.com/hooks.html for more hooks.

# Top level exclusions from all hooks. Some of these could be moved into more
# specific exclusions like check-yaml and clang-format, but for large generated
# files even simple hooks like trailing-whitespace can be expensive.
#
# Note the yaml multiline literal and (?x) regex flag used here, see
# https://pre-commit.com/#regular-expressions.
exclude: |
  (?x)
    # ==========================================================================
    # Opted-out projects
    # To opt-in, remove your project from the exclusions.
    # See CONTRIBUTING.md for detailed instructions.
    #
    # Some opted-out projects are listed on the individual hooks below instead
    # of here. This top level exclude hides a file from every hook, and
    # pre-commit gives a hook no way to opt back in, so anything listed here is
    # invisible to the security gate as well.
    # ==========================================================================
    projects/composablekernel/.*|
    projects/hipblas/.*|
    projects/hipblas-common/.*|
    projects/hipcub/.*|
    projects/hipfft/.*|
    projects/hiprand/.*|
    projects/hipsolver/.*|
    projects/hipsparse/.*|
    projects/hipsparselt/.*|
    projects/hiptensor/.*|
    projects/hipthreads/.*|
    projects/rocblas/.*|
    projects/rocfft/.*|
    projects/rocprim/.*|
    projects/rocsolver/.*|
    projects/rocsparse/.*|
    projects/rocthrust/.*|
    projects/rocwmma/.*|
    shared/mxdatagenerator/.*|
    shared/origami/.*|
    shared/rocroller/.*|
    # ==========================================================================
    # Permanent exclusions
    # ==========================================================================
    # Binary files
    projects/hipdnn/.*\.bin$|
    # Generated hipDNN FlatBuffers headers
    projects/hipdnn/flatbuffers_sdk/include/hipdnn_flatbuffers_sdk/data_objects/.*_generated\.h|
    # Reference data (auto-generated)
    dnn-providers/integration-tests/integration-test-bundles/.*|
    # Generated files (see rocrand/tools/ _generator.cpp files)
    projects/rocrand/library/.*constants\.(cpp|h)|
    projects/rocrand/library/.*precomputed\.(cpp|h)|
    # MIOpen exclusion list
    projects/miopen/.*\.s$|
    projects/miopen/.*\.inc$|
    projects/miopen/.*\.model$|
    # RPP exclusion list - raw test data with no early NUL byte, which pre-commit would
    # otherwise treat as text and corrupt. Matched by extension so new data stays covered.
    projects/rpp/.*\.(bin|rgb|yuv)$


repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v3.2.0
    hooks:
      - id: trailing-whitespace
        # Opted out of the formatting hooks, but still scanned by the security
        # gate below. Anchored here and aliased onto the other hooks that would
        # otherwise pick these up from the top level exclude.
        exclude: &opted_out_but_scanned |
          (?x)
          projects/hipblaslt/.*|
          shared/tensile/.*
      - id: end-of-file-fixer
        exclude: *opted_out_but_scanned
      - id: check-yaml
        exclude: |
          (?x)
          projects/hipblaslt/.*|
          shared/tensile/.*|
          ^projects/hipdnn/\.clang-format$|
          ^projects/miopen/\.clang-format$|
          ^dnn-providers/miopen-provider/\.clang-format$|
          ^dnn-providers/hipblaslt-provider/\.clang-format$|
          ^dnn-providers/hip-kernel-provider/\.clang-format$|
          ^dnn-providers/integration-tests/\.clang-format$
      - id: check-added-large-files
        exclude: *opted_out_but_scanned

  - repo: https://github.com/psf/black
    rev: 25.12.0
    hooks:
      - id: black
        language_version: python3
        exclude: *opted_out_but_scanned

  - repo: https://github.com/pre-commit/mirrors-clang-format
    rev: v18.1.4
    hooks:
      - id: clang-format
        name: clang-format (C/C++/ObjC)
        entry: clang-format -i -style=file
        files: '\.(c|cpp|cc|h|hpp|m|mm|cl)$|\.(h|hpp|cpp)\.in$'
        exclude: *opted_out_but_scanned

  # Blocks new unsafe yaml.load (arbitrary-object deserialization) from landing.
  # Intentionally outside the opted-out projects list: this is a security
  # regression gate, and it only inspects files a commit already touches.
  # See ROCM-26843 / SEC-00404.
  - repo: https://github.com/PyCQA/bandit
    rev: 1.9.4
    hooks:
      - id: bandit
        name: bandit (unsafe yaml.load / B506)
        args: ["-t", "B506"]
        # TODO(ROCM-26843): temporary. Drop once the pre-existing findings here
        # are converted, so the gate covers the whole repository.
        exclude: ^shared/rocroller/

  - repo: local
    hooks:
      - id: flatc-hipdnn
        name: flatc (hipDNN)
        entry: python projects/hipdnn/scripts/run_flatc.py
        language: python
        files: ^projects/hipdnn/(data_sdk|flatbuffers_sdk)/schemas/.*\.fbs$
        pass_filenames: true

      # Separate from flatc-hipdnn: the annotation it reads is invisible to flatc's
      # C++ output. Fires on the schemas (transitively, via the generator reading
      # their fields through flatc) and on the generator script itself, since a
      # change to its emitter/filter/type-walk logic can desync the checked-in
      # header just like a schema change can. Re-derives the whole header, so
      # pass_filenames is false.
      - id: cache-key-hipdnn
        name: cache key codegen (hipDNN)
        entry: python projects/hipdnn/scripts/gen_cache_key.py
        language: python
        files: ^projects/hipdnn/flatbuffers_sdk/schemas/.*\.fbs$|^projects/hipdnn/scripts/gen_cache_key\.py$|^projects/hipdnn/cmake/default_flatc_version\.txt$
        pass_filenames: false

      - id: verify-support-claims
        name: Verify hipDNN support-claim sidecars (RFC 0015)
        entry: python dnn-providers/integration-tests/scripts/verify_support_claims.py
        language: python
        pass_filenames: false
        files: ^dnn-providers/integration-tests/(integration-test-bundles/.*|scripts/(test_)?verify_support_claims\.py)$

      - id: gtest-format-miopen
        name: GTest naming conventions (MIOpen)
        entry: python projects/miopen/test/utils/gtest_formating_checks.py
        language: python
        files: ^projects/miopen/test/gtest/.*\.cpp$
        pass_filenames: false

      - id: miopen-public-private-headers
        name: MIOpen public/private header consistency
        entry: python projects/miopen/script/check_public_abi.py check-headers
        language: python
        files: ^(projects/miopen/(include/miopen/miopen\.h|src/private/(miopen_impl\.h|miopen_private_rename\.h|wrapper\.cpp)|src/convolution_api\.cpp|test/gtest/conv_workspace_size_range\.cpp)|dnn-providers/miopen-provider/MiopenApi(PrivateRename)?\.hpp)$
        pass_filenames: false

      # The check above is the only one that can see signature drift in the
      # split, and it reads C declarations with a hand-rolled parser rather
      # than a compiler. These are that parser's own tests. They work on string
      # fixtures, so they run here -- where pre-commit provides pytest in an
      # isolated environment -- rather than in the MIOpen component CI job,
      # which installs no Python packages.
      - id: miopen-public-private-header-check-tests
        name: MIOpen public/private header check self-tests
        entry: python -m pytest projects/miopen/script/test_check_public_abi.py -q
        language: python
        additional_dependencies: ["pytest==8.4.2"]
        files: ^projects/miopen/script/(check_public_abi|test_check_public_abi)\.py$
        pass_filenames: false

      - id: kpack-pin-sync
        name: rocm_kpack pin is consistent (hipDNN)
        # The pin is the kpack-ref output of .github/actions/ci-env/action.yml.
        # Workflows read it from there. KpackPython.cmake and the dev container
        # Dockerfile cannot -- CMake does not run under Actions, and the image
        # build fetches the Dockerfile standalone into an empty context -- so
        # both carry a literal copy that this hook holds equal.
        entry: >-
          bash -c '
          set -uo pipefail;
          src=.github/actions/ci-env/action.yml;
          read_file() {
          if [ -f "$1" ]; then cat "$1";
          else git show "HEAD:$1" 2>/dev/null; fi;
          };
          pin=$(read_file "$src"
          | sed -n "/^  kpack-ref:/,/^  [a-z]/p"
          | grep -oE "[0-9a-f]{40}" | head -1);
          test -n "$pin" || { echo "kpack pin: no 40-char kpack-ref SHA in $src" >&2; exit 1; };
          check() {
          got=$(read_file "$1" | grep -oE "$2[0-9a-f]{40}" | grep -oE "[0-9a-f]{40}" | head -1);
          test -n "$got" || { echo "kpack pin: no pinned SHA in $1" >&2; exit 1; };
          test "$got" = "$pin" || { echo "kpack pin: $1 has $got, expected $pin from $src" >&2; exit 1; };
          };
          check dnn-providers/hip-kernel-provider/cmake/KpackPython.cmake
          "^set\(HIPKERNELPROVIDER_KPACK_GIT_REF \"";
          check projects/hipdnn/dockerfiles/Dockerfile.ubuntu24
          "^ARG ROCM_SYSTEMS_KPACK_REF=";
          '
        language: system
        # The source of truth, or either copy. The check always inspects the
        # full set, so this only decides when it runs.
        files: >-
          (?x)^(
            \.github/actions/ci-env/action\.yml|
            dnn-providers/hip-kernel-provider/cmake/KpackPython\.cmake|
            projects/hipdnn/dockerfiles/Dockerfile\.ubuntu24
          )$
        pass_filenames: false

  - repo: https://github.com/cheshirekow/cmake-format-precommit
    rev: v0.6.10
    hooks:
      - id: cmake-lint
        exclude: |
          (?x)
          projects/hipblaslt/.*|
          shared/tensile/.*|
          # MIOpen CMake files have not been audited for cmake-lint compliance yet.
          ^projects/miopen/.*
      # cmake-format is disabled due to undesirable formatting.
      # We can investigate changing the configuration before re-enabling or using an alternative tool.
      # - id: cmake-format