.pre-commit-config.yaml

repos:
  - repo: local
    hooks:
      - id: license-header-check
        name: Run license-check script
        entry: ./ci/scripts/license_check.py
        language: python
        types_or: [python, rust]
        pass_filenames: true
        always_run: false
  - repo: local
    hooks:
      - id: check-copied-files
        name: Run check-copied-files script
        entry: ./ci/scripts/check_copied_files.py
        language: python
        pass_filenames: true
        always_run: false
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v2.3.0
    hooks:
      - id: end-of-file-fixer
      - id: trailing-whitespace
      - id: check-yaml
        exclude: "mkdocs.yml"
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.12.8
    hooks:
      - id: ruff
        # 1. Attempt to automatically fix any lint issues.
        args: ["--fix"]
      - id: ruff-format
  - repo: https://github.com/executablebooks/mdformat
    rev: 0.7.22             # Use the latest stable version
    hooks:
      - id: mdformat
        additional_dependencies:
        - mdformat-tables
        - mdformat-gfm
        - mdformat-black
        - mdformat-frontmatter
        - black==25.12.0
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.24.2
    hooks:
      - id: gitleaks
        # Override upstream `gitleaks git --pre-commit --staged`, which scans
        # staged git diffs and is a no-op in CI (`pre-commit run --all-files`
        # has nothing staged).  Instead, scan the files pre-commit passes in:
        # staged files on `git commit`, tracked files on `--all-files`.
        # `gitleaks dir` only accepts one path per invocation, so fan out via
        # xargs -P for parallelism; xargs returns 123 if any child exits
        # non-zero, which pre-commit surfaces as a hook failure.
        entry: sh -c 'printf "%s\0" "$@" | xargs -0 -n1 -P"$(getconf _NPROCESSORS_ONLN)" gitleaks dir --redact --verbose --no-banner' --
        pass_filenames: true