.pre-commit-config.yaml

exclude: "^cli/tests/e2e/(targets|snapshots|rules/syntax)|^semgrep-core/tests|^cli/src/semgrep/external|\\binvalid\\b|^cli/.test_durations"

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.3.0
    hooks:
      - id: check-added-large-files
      - id: check-ast
      - id: check-builtin-literals
      - id: check-case-conflict
      - id: check-docstring-first
      - id: check-executables-have-shebangs
      - id: check-json
        exclude: ".devcontainer/devcontainer.json"
      - id: check-merge-conflict
      - id: check-shebang-scripts-are-executable
      - id: check-symlinks
      - id: check-toml
      - id: check-vcs-permalinks
      - id: check-xml
      - id: check-yaml
        args: [--allow-multiple-documents]
      - id: debug-statements
      - id: destroyed-symlinks
      - id: detect-private-key
      - id: end-of-file-fixer
      - id: fix-byte-order-marker
      - id: fix-encoding-pragma
        args: [--remove]
      - id: mixed-line-ending
        args: [--fix=lf]
      - id: no-commit-to-branch
      - id: requirements-txt-fixer
      - id: trailing-whitespace
        args: [--markdown-linebreak-ext=md]

  - repo: https://github.com/myint/autoflake
    rev: v1.4
    hooks:
      - id: autoflake
        args:
          - --in-place
          - --remove-unused-variables
          - --remove-duplicate-keys
          - --remove-all-unused-imports
          - --ignore-init-module-imports
          - --exclude=/cli/src/semgrep/output_from_core.py

  - repo: https://github.com/psf/black
    rev: 22.6.0
    hooks:
      - id: black
        args: [--exclude=/cli/src/semgrep/output_from_core.py]

  - repo: https://github.com/asottile/reorder_python_imports
    rev: v3.1.0
    hooks:
      - id: reorder-python-imports
        args: ["--application-directories=cli/src", --py37-plus]

  - repo: https://github.com/asottile/pyupgrade
    rev: v2.34.0
    hooks:
      - id: pyupgrade
        args: ["--py37-plus"]

  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: "v0.961"
    hooks:
      - id: mypy
        exclude: ^cli/tests/.+$|^setup.py$|^scripts/.+$|^parsing-stats/.+$|^perf/.+$$
        args: [--config, mypy.ini, --show-error-codes]
        additional_dependencies: &mypy-deps
          # versions must be manually synced:
          # - cli/setup.py lists dependencies
          # - cli/Pipfile lists type hint packages for dev env
          # - .pre-commit-config.yaml's mypy hooks also list type hint packages

          # some packages ship with type definitions
          - attrs~=21.3
          - click~=8.0
          - packaging~=21.0
          - requests~=2.22
          - defusedxml~=0.7.1
          # other packages have separate typings published
          - types-colorama~=0.4.0
          - types-jsonschema~=4.6.0
          - types-requests
          - types-setuptools
          - types-freezegun
          - types-python-dateutil
          - types-Jinja2
      - id: mypy
        alias: mypy-test
        name: mypy (test files)
        files: ^cli/tests/.+$
        args: [--config, mypy-tests.ini, --show-error-codes]
        additional_dependencies: *mypy-deps

  - repo: https://gitlab.com/pycqa/flake8
    rev: "3.9.2"
    hooks:
      - id: flake8
        additional_dependencies: ["flake8-bugbear==22.1.11"]
        args: ["--select=B,E9,F4,F63,F7,F82"]

  - repo: https://github.com/returntocorp/semgrep
    rev: "v0.100.0"
    hooks:
      - id: semgrep
        name: Semgrep Python
        types: [python]
        exclude: "^cli/tests/.+$|^scripts/.+$|^cli/setup.py$"
        args: ["--config", "https://semgrep.dev/p/python", "--error"]
      - id: semgrep
        name: Semgrep Bandit
        types: [python]
        exclude: "^cli/tests/.+$|^scripts/.+$|^cli/setup.py$"
        args: ["--config", "https://semgrep.dev/p/bandit", "--error"]

  - repo: local
    hooks:
      - id: shellcheck
        name: shellcheck
        language: docker_image
        entry: koalaman/shellcheck:v0.8.0
        files: "[.]sh$"

  - repo: local
    hooks:
      - id: hadolint
        name: hadolint
        language: docker_image
        types:
          - dockerfile
        exclude: "^dockerfiles/linuxbrew[.]Dockerfile$"
        entry: hadolint/hadolint:v2.8.0-alpine hadolint
        args: ["--ignore", "DL3008", "--ignore", "DL3018"]

  # Run develop semgrep. Only used in CI
  # To run locally use `pre-commit run --hook-stage manual semgrep-docker-develop`
  - repo: https://github.com/returntocorp/semgrep
    rev: "v0.100.0"
    hooks:
      - id: semgrep-docker-develop
        name: Semgrep Develop Python
        types: [python]
        exclude: "^cli/tests/.+$|^scripts/.+$|^cli/setup.py$"
        args: ["--config", "p/python", "--error"]
        stages: [manual]
      - id: semgrep-docker-develop
        name: Semgrep Develop Bandit
        types: [python]
        exclude: "^cli/tests/.+$|^scripts/.+$|^cli/setup.py$"
        args: ["--config", "p/bandit", "--error"]
        stages: [manual]

  # Reformat OCaml code (ml, mli) with ocamlformat if ocamlformat is
  # present. If ocamlformat is missing, this step will succeed.
  # This allows pure python users to run 'pre-commit run --all' without
  # installing opam and ocamlformat.
  #
  - repo: local
    hooks:
      - id: lint-ocaml
        name: Reformat OCaml code
        entry: ./scripts/lint-ocaml
        language: script
        files: "\\.mli?$"
      - id: gitignore-to-dockerignore
        name: Convert .gitignore to .dockerignore
        language: node
        entry: gitignore-to-dockerignore
        files: ^.(git|docker)ignore$
        additional_dependencies: ["gitignore-to-dockerignore@2.0.0"]

  # Reformat YAML, JSON, and Markdown files
  - repo: https://github.com/pre-commit/mirrors-prettier
    rev: v2.7.1
    hooks:
      - id: prettier
        exclude: "^perf/bench/dummy/.+$|^cli/tests/e2e/rules/.+$|^.+/Pipfile.lock$|^.devcontainer/devcontainer.json$"