mirror of
https://github.com/trustedsec/hate_crack.git
synced 2026-07-28 14:47:22 -07:00
Justin BollingerandClaude
4418c4e4d6
Adds the gates the hashview repo runs, adapted to hate_crack's uv toolchain: - ruff format --check as a CI step + a ruff-format prek pre-push hook (the package was reformatted in the preceding commit). - Bandit SAST vs a committed baseline (.bandit-baseline.json, 114 reviewed low-severity subprocess/shlex findings); [tool.bandit] config in pyproject.toml; CI job + prek pre-push hook. Only NEW findings fail. - pip-audit dependency-CVE gate (CI job). PYSEC-2026-2447 (diskcache 5.6.3, transitive via instructor -> atomic-agents) is ignored — no upstream fix. - Hygiene pre-commit hooks (trailing-whitespace, end-of-file-fixer, check-yaml, check-merge-conflict, check-added-large-files) via the pre-commit-hooks repo. - CLAUDE.md updated: lint/security commands, prek install (+pre-commit hook type), and the active-hooks list. Co-Authored-By: Claude <noreply@anthropic.com>
89 lines
1.9 KiB
TOML
89 lines
1.9 KiB
TOML
[[repos]]
|
|
repo = "local"
|
|
|
|
[[repos.hooks]]
|
|
id = "ruff"
|
|
name = "ruff"
|
|
entry = "uv run ruff check hate_crack"
|
|
language = "system"
|
|
stages = ["pre-push"]
|
|
pass_filenames = false
|
|
always_run = true
|
|
|
|
[[repos.hooks]]
|
|
id = "ruff-format"
|
|
name = "ruff-format"
|
|
entry = "uv run ruff format --check hate_crack"
|
|
language = "system"
|
|
stages = ["pre-push"]
|
|
pass_filenames = false
|
|
always_run = true
|
|
|
|
[[repos.hooks]]
|
|
id = "ty"
|
|
name = "ty"
|
|
entry = "uv run ty check hate_crack"
|
|
language = "system"
|
|
stages = ["pre-push"]
|
|
pass_filenames = false
|
|
always_run = true
|
|
|
|
[[repos.hooks]]
|
|
id = "pytest"
|
|
name = "pytest"
|
|
entry = "env HATE_CRACK_SKIP_INIT=1 uv run pytest -q"
|
|
language = "system"
|
|
stages = ["pre-push"]
|
|
pass_filenames = false
|
|
always_run = true
|
|
|
|
[[repos.hooks]]
|
|
id = "pytest-lima"
|
|
name = "pytest-lima"
|
|
entry = "uv run pytest tests/test_lima_vm_install.py -v"
|
|
language = "system"
|
|
stages = ["pre-push"]
|
|
pass_filenames = false
|
|
always_run = true
|
|
|
|
[[repos.hooks]]
|
|
id = "bandit"
|
|
name = "bandit security scan (vs baseline)"
|
|
entry = "uvx --from 'bandit[toml]==1.9.4' bandit -r hate_crack -c pyproject.toml -b .bandit-baseline.json -q"
|
|
language = "system"
|
|
stages = ["pre-push"]
|
|
pass_filenames = false
|
|
always_run = true
|
|
|
|
[[repos.hooks]]
|
|
id = "audit-docs"
|
|
name = "audit-docs"
|
|
entry = "bash .claude/audit-docs.sh HEAD"
|
|
language = "system"
|
|
stages = ["post-commit"]
|
|
pass_filenames = false
|
|
always_run = true
|
|
|
|
# General hygiene hooks (mirrors hashview's .pre-commit-config.yaml). These run
|
|
# at the pre-commit stage, so `prek install` must include `--hook-type pre-commit`
|
|
# (see CLAUDE.md). Auto-fixers modify files in place; re-stage and commit again.
|
|
[[repos]]
|
|
repo = "https://github.com/pre-commit/pre-commit-hooks"
|
|
rev = "v5.0.0"
|
|
|
|
[[repos.hooks]]
|
|
id = "trailing-whitespace"
|
|
|
|
[[repos.hooks]]
|
|
id = "end-of-file-fixer"
|
|
|
|
[[repos.hooks]]
|
|
id = "check-yaml"
|
|
|
|
[[repos.hooks]]
|
|
id = "check-merge-conflict"
|
|
|
|
[[repos.hooks]]
|
|
id = "check-added-large-files"
|
|
args = ["--maxkb=1024"]
|