mirror of
https://github.com/trustedsec/hate_crack.git
synced 2026-07-28 14:47:22 -07:00
Justin BollingerandClaude Fable 5
d91dc0dc59
The repo had no secret-scanning gate of any kind: prek.toml carried no detect-private-key/detect-secrets hook, CI had none, and bandit only scans hate_crack/ so it never inspected config files, docs, or fixtures for committed key material. Adds the detect-private-key hook from the pre-commit-hooks remote repo at the pre-commit stage, and records v2.14.3 in the changelog alongside the removal of the published agent tooling. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
85 lines
1.9 KiB
TOML
85 lines
1.9 KiB
TOML
[[repos]]
|
|
repo = "local"
|
|
|
|
[[repos.hooks]]
|
|
id = "ruff"
|
|
name = "ruff"
|
|
entry = "uv run ruff check hate_crack"
|
|
language = "system"
|
|
stages = ["pre-push"]
|
|
pass_filenames = false
|
|
always_run = true
|
|
|
|
[[repos.hooks]]
|
|
id = "ruff-format"
|
|
name = "ruff-format"
|
|
entry = "uv run ruff format --check hate_crack"
|
|
language = "system"
|
|
stages = ["pre-push"]
|
|
pass_filenames = false
|
|
always_run = true
|
|
|
|
[[repos.hooks]]
|
|
id = "ty"
|
|
name = "ty"
|
|
entry = "uv run ty check hate_crack"
|
|
language = "system"
|
|
stages = ["pre-push"]
|
|
pass_filenames = false
|
|
always_run = true
|
|
|
|
[[repos.hooks]]
|
|
id = "pytest"
|
|
name = "pytest"
|
|
entry = "env HATE_CRACK_SKIP_INIT=1 uv run pytest -q"
|
|
language = "system"
|
|
stages = ["pre-push"]
|
|
pass_filenames = false
|
|
always_run = true
|
|
|
|
[[repos.hooks]]
|
|
id = "pytest-lima"
|
|
name = "pytest-lima"
|
|
entry = "uv run pytest tests/test_lima_vm_install.py -v"
|
|
language = "system"
|
|
stages = ["pre-push"]
|
|
pass_filenames = false
|
|
always_run = true
|
|
|
|
[[repos.hooks]]
|
|
id = "bandit"
|
|
name = "bandit security scan (vs baseline)"
|
|
entry = "uvx --from 'bandit[toml]==1.9.4' bandit -r hate_crack -c pyproject.toml -b .bandit-baseline.json -q"
|
|
language = "system"
|
|
stages = ["pre-push"]
|
|
pass_filenames = false
|
|
always_run = true
|
|
|
|
# General hygiene hooks (mirrors hashview's .pre-commit-config.yaml). These run
|
|
# at the pre-commit stage, so `prek install` must include `--hook-type pre-commit`.
|
|
# Auto-fixers modify files in place; re-stage and commit again.
|
|
[[repos]]
|
|
repo = "https://github.com/pre-commit/pre-commit-hooks"
|
|
rev = "v5.0.0"
|
|
|
|
[[repos.hooks]]
|
|
id = "trailing-whitespace"
|
|
|
|
[[repos.hooks]]
|
|
id = "end-of-file-fixer"
|
|
|
|
[[repos.hooks]]
|
|
id = "check-yaml"
|
|
|
|
[[repos.hooks]]
|
|
id = "check-merge-conflict"
|
|
|
|
[[repos.hooks]]
|
|
id = "check-added-large-files"
|
|
args = ["--maxkb=1024"]
|
|
|
|
# Blocks committing PEM/OpenSSH private keys. The repo had no secret-scanning
|
|
# gate at all before this; bandit only covers hate_crack/.
|
|
[[repos.hooks]]
|
|
id = "detect-private-key"
|