From 38cb036a038ec85087698d8f2807f768b6f6b965 Mon Sep 17 00:00:00 2001
From: Adi <6841988+DeepSpace2@users.noreply.github.com>
Date: Tue, 7 Jul 2026 21:15:43 +0300
Subject: [PATCH 1/3] chore: add pre-commit

---
 .github/workflows/pr-build.yml              | 10 +++++++++
 .github/workflows/reusable-docker-build.yml |  2 +-
 .github/workflows/reusable-pre-commit.yml   | 25 +++++++++++++++++++++
 .pre-commit-config.yaml                     | 11 +++++++++
 Dockerfile                                  |  1 -
 README.md                                   |  4 ++--
 docs/assets/logo_full.svg                   |  8 +++----
 docs/assets/logo_full_dark.svg              |  6 ++---
 docs/assets/logo_full_light.svg             |  6 ++---
 docs/assets/logo_icon.svg                   |  6 ++---
 docs/css/theme.css                          |  1 -
 docs/index.md                               |  4 ++--
 docs/js/anchor-jump-highlight.js            |  2 +-
 docs/js/copy-to-clipboard.js                | 14 ++++++------
 docs/monitoring.md                          |  5 ++---
 docs/theme/overrides/main.html              |  2 +-
 16 files changed, 75 insertions(+), 32 deletions(-)
 create mode 100644 .github/workflows/reusable-pre-commit.yml
 create mode 100644 .pre-commit-config.yaml

diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index 0d62ccc..3e6d65e 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -22,6 +22,8 @@ jobs:
               - '.github/workflows/pr-build.yml'
               - '.github/workflows/release.yml'
               - '.github/workflows/reusable-docker-build.yml'
+              - '.github/workflows/reusable-pre-commit.yml'
+              - '.pre-commit-config.yaml'
               - 'pkg/**'
               - 'main.go'
               - 'go.*'
@@ -53,3 +55,11 @@ jobs:
     needs: changes
     if: ${{ needs.changes.outputs.src == 'true' }}
     uses: ./.github/workflows/reusable-unittests.yml
+
+  pre-commit:
+    needs: changes
+    if: ${{ needs.changes.outputs.src == 'true' }}
+    uses: ./.github/workflows/reusable-pre-commit.yml
+    with:
+      base_sha: ${{ github.event.pull_request.base.sha }}
+      head_sha: ${{ github.event.pull_request.head.sha }}
diff --git a/.github/workflows/reusable-docker-build.yml b/.github/workflows/reusable-docker-build.yml
index e6eaaac..6dc73f0 100644
--- a/.github/workflows/reusable-docker-build.yml
+++ b/.github/workflows/reusable-docker-build.yml
@@ -18,7 +18,7 @@ jobs:
       packages: write
       attestations: write
       id-token: write
-      
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
diff --git a/.github/workflows/reusable-pre-commit.yml b/.github/workflows/reusable-pre-commit.yml
new file mode 100644
index 0000000..7b45313
--- /dev/null
+++ b/.github/workflows/reusable-pre-commit.yml
@@ -0,0 +1,25 @@
+name: Reusable Pre-commit
+
+on:
+  workflow_call:
+    inputs:
+      base_sha:
+        required: true
+        type: string
+      head_sha:
+        required: true
+        type: string
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+      - uses: pre-commit/action@v3.0.1
+        with:
+          extra_args: --from-ref ${{ inputs.base_sha }} --to-ref ${{ inputs.head_sha }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..dfb250d
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,11 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+
+  - repo: https://github.com/golangci/golangci-lint
+    rev: v2.12.2
+    hooks:
+      - id: golangci-lint
diff --git a/Dockerfile b/Dockerfile
index ef81d9c..93d8097 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,4 +23,3 @@ WORKDIR /app
 COPY --from=builder /app/plugnpin .
 
 CMD [ "./plugnpin" ]
-
diff --git a/README.md b/README.md
index 4af840e..3bf4ebf 100644
--- a/README.md
+++ b/README.md
@@ -31,8 +31,8 @@ as local DNS/CNAME records in **Pi-Hole** (or DNS Rewrites in **AdGuard Home**)
 PlugNPiN discovers services by scanning for Docker containers that have the following labels:
 
 - `plugNPiN.ip` - The IP address and port of the container (e.g., `192.168.1.100:8080`).
-- `plugNPiN.url` - The desired URL for the service (e.g., `my-service.local`).  
-   Multiple domains are supported and should be comma-separated,  
+- `plugNPiN.url` - The desired URL for the service (e.g., `my-service.local`).
+   Multiple domains are supported and should be comma-separated,
    for example `domain1.local,domain2.local`.
 
 The application operates in two complementary modes to keep your services synchronized:
diff --git a/docs/assets/logo_full.svg b/docs/assets/logo_full.svg
index 3dd3d16..0916fd4 100644
--- a/docs/assets/logo_full.svg
+++ b/docs/assets/logo_full.svg
@@ -6,7 +6,7 @@
     </linearGradient>
     <style type="text/css">
       .logo-text { font-family: 'Segoe UI', Roboto, Helvetica, Arial, sans-serif; font-weight: 700; font-size: 100px; }
-      
+
       /* Default (Light Mode) */
       .text-main { fill: #333333; }
       .text-accent { fill: url(#gradient); }
@@ -21,17 +21,17 @@
   <g transform="translate(30, 20) scale(0.85)">
     <!-- Creature Body -->
     <path d="M70 155V60C70 43.4315 83.4315 30 100 30H120C136.569 30 150 43.4315 150 60V80C150 96.5685 136.569 110 120 110H70" stroke="url(#gradient)" stroke-width="20" stroke-linecap="round"/>
-    
+
     <!-- Container Eye -->
     <path d="M100 62L108.66 67V77L100 82L91.34 77V67L100 62Z" fill="url(#gradient)" />
-    
+
     <!-- Plug Heads -->
     <rect x="150" y="55" width="16" height="10" rx="2" fill="#2496ED" />
     <rect x="150" y="75" width="16" height="10" rx="2" fill="#8E44AD" />
 
     <!-- DNS/IP Address Dots -->
     <circle cx="182" cy="50" r="5" fill="#2496ED" opacity="0.4" />
-    <circle cx="182" cy="70" r="6" fill="url(#gradient)" /> 
+    <circle cx="182" cy="70" r="6" fill="url(#gradient)" />
     <circle cx="182" cy="90" r="5" fill="#8E44AD" opacity="0.4" />
     <circle cx="182" cy="110" r="5" fill="#8E44AD" opacity="0.2" />
   </g>
diff --git a/docs/assets/logo_full_dark.svg b/docs/assets/logo_full_dark.svg
index d79127e..bb7a419 100644
--- a/docs/assets/logo_full_dark.svg
+++ b/docs/assets/logo_full_dark.svg
@@ -14,17 +14,17 @@
   <g transform="translate(30, 20) scale(0.85)">
     <!-- Creature Body -->
     <path d="M70 155V60C70 43.4315 83.4315 30 100 30H120C136.569 30 150 43.4315 150 60V80C150 96.5685 136.569 110 120 110H70" stroke="url(#gradient)" stroke-width="20" stroke-linecap="round"/>
-    
+
     <!-- Container Eye -->
     <path d="M100 62L108.66 67V77L100 82L91.34 77V67L100 62Z" fill="url(#gradient)" />
-    
+
     <!-- Plug Heads -->
     <rect x="150" y="55" width="16" height="10" rx="2" fill="#2496ED" />
     <rect x="150" y="75" width="16" height="10" rx="2" fill="#8E44AD" />
 
     <!-- DNS/IP Address Dots -->
     <circle cx="182" cy="50" r="5" fill="#2496ED" opacity="0.4" />
-    <circle cx="182" cy="70" r="6" fill="url(#gradient)" /> 
+    <circle cx="182" cy="70" r="6" fill="url(#gradient)" />
     <circle cx="182" cy="90" r="5" fill="#8E44AD" opacity="0.4" />
     <circle cx="182" cy="110" r="5" fill="#8E44AD" opacity="0.2" />
   </g>
diff --git a/docs/assets/logo_full_light.svg b/docs/assets/logo_full_light.svg
index 877ee68..8ceb343 100644
--- a/docs/assets/logo_full_light.svg
+++ b/docs/assets/logo_full_light.svg
@@ -14,17 +14,17 @@
   <g transform="translate(30, 20) scale(0.85)">
     <!-- Creature Body -->
     <path d="M70 155V60C70 43.4315 83.4315 30 100 30H120C136.569 30 150 43.4315 150 60V80C150 96.5685 136.569 110 120 110H70" stroke="url(#gradient)" stroke-width="20" stroke-linecap="round"/>
-    
+
     <!-- Container Eye -->
     <path d="M100 62L108.66 67V77L100 82L91.34 77V67L100 62Z" fill="url(#gradient)" />
-    
+
     <!-- Plug Heads -->
     <rect x="150" y="55" width="16" height="10" rx="2" fill="#2496ED" />
     <rect x="150" y="75" width="16" height="10" rx="2" fill="#8E44AD" />
 
     <!-- DNS/IP Address Dots -->
     <circle cx="182" cy="50" r="5" fill="#2496ED" opacity="0.4" />
-    <circle cx="182" cy="70" r="6" fill="url(#gradient)" /> 
+    <circle cx="182" cy="70" r="6" fill="url(#gradient)" />
     <circle cx="182" cy="90" r="5" fill="#8E44AD" opacity="0.4" />
     <circle cx="182" cy="110" r="5" fill="#8E44AD" opacity="0.2" />
   </g>
diff --git a/docs/assets/logo_icon.svg b/docs/assets/logo_icon.svg
index 833c9b6..84903d8 100644
--- a/docs/assets/logo_icon.svg
+++ b/docs/assets/logo_icon.svg
@@ -8,17 +8,17 @@
 
   <!-- Creature Body -->
   <path d="M70 160V60C70 43.4315 83.4315 30 100 30H120C136.569 30 150 43.4315 150 60V80C150 96.5685 136.569 110 120 110H70" stroke="url(#gradient)" stroke-width="20" stroke-linecap="round"/>
-  
+
   <!-- Container Eye -->
   <path d="M100 62L108.66 67V77L100 82L91.34 77V67L100 62Z" fill="url(#gradient)" />
-  
+
   <!-- Plug Heads -->
   <rect x="150" y="55" width="16" height="10" rx="2" fill="#2496ED" />
   <rect x="150" y="75" width="16" height="10" rx="2" fill="#8E44AD" />
 
   <!-- DNS/IP Address Dots -->
   <circle cx="182" cy="50" r="5" fill="#2496ED" opacity="0.4" />
-  <circle cx="182" cy="70" r="6" fill="url(#gradient)" /> 
+  <circle cx="182" cy="70" r="6" fill="url(#gradient)" />
   <circle cx="182" cy="90" r="5" fill="#8E44AD" opacity="0.4" />
   <circle cx="182" cy="110" r="5" fill="#8E44AD" opacity="0.2" />
 
diff --git a/docs/css/theme.css b/docs/css/theme.css
index 40783b4..77671d6 100644
--- a/docs/css/theme.css
+++ b/docs/css/theme.css
@@ -7,4 +7,3 @@
 [data-md-color-scheme="slate"] {
   --md-code-fg-color: #DEDEDE;
 }
-
diff --git a/docs/index.md b/docs/index.md
index 916ce41..5a4b5a1 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -21,8 +21,8 @@ See [Optional Environment Variables](./configuration.md#optional).
 PlugNPiN discovers services by scanning for Docker containers that have the following labels:
 
 - `plugNPiN.ip` - The IP address and port of the container (e.g., `192.168.1.100:8080`).
-- `plugNPiN.url` - The desired URL for the service (e.g., `my-service.local`).  
-  Multiple domains are supported (since version [:octicons-tag-24: 0.10.0](https://github.com/DeepSpace2/plugnpin/releases/tag/v0.10.0){ .md-tag target="_blank" }) and should be comma-separated,  
+- `plugNPiN.url` - The desired URL for the service (e.g., `my-service.local`).
+  Multiple domains are supported (since version [:octicons-tag-24: 0.10.0](https://github.com/DeepSpace2/plugnpin/releases/tag/v0.10.0){ .md-tag target="_blank" }) and should be comma-separated,
    for example `domain1.local,domain2.local`.
 
 The application operates in two complementary modes to keep your services synchronized:
diff --git a/docs/js/anchor-jump-highlight.js b/docs/js/anchor-jump-highlight.js
index b8a0ec2..675af96 100644
--- a/docs/js/anchor-jump-highlight.js
+++ b/docs/js/anchor-jump-highlight.js
@@ -14,7 +14,7 @@ function isElementInsideTable(element) {
 document.addEventListener('DOMContentLoaded', function() {
   document.querySelectorAll('a[href^="#"]').forEach(anchor => {
     anchor.addEventListener('click', function(e) {
-      
+
       const targetId = this.getAttribute('href').substring(1);
       let targetElement = document.getElementById(targetId);
 
diff --git a/docs/js/copy-to-clipboard.js b/docs/js/copy-to-clipboard.js
index a85ba0a..9f699ee 100644
--- a/docs/js/copy-to-clipboard.js
+++ b/docs/js/copy-to-clipboard.js
@@ -12,25 +12,25 @@ document$.subscribe(function() {
 
     const wrapper = document.createElement("span");
     wrapper.classList.add("copy-to-clipboard-wrapper");
-    
+
     code.parentNode.insertBefore(wrapper, code);
     wrapper.appendChild(code);
-    
+
     const button = document.createElement("button");
     button.type = "button";
     button.setAttribute("aria-label", "Copy to clipboard");
     button.setAttribute("title", "Copy to clipboard");
     button.classList.add("copy-to-clipboard-button");
     button.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 21H8V7h11m0-2H8a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h11a2 2 0 0 0 2-2V7a2 2 0 0 0-2-2m-3-4H4a2 2 0 0 0-2 2v14h2V3h12V1Z"/></svg>';
-    
+
     wrapper.appendChild(button);
-    
+
     button.addEventListener("click", (e) => {
       e.preventDefault();
       e.stopPropagation();
 
       const textToCopy = code.textContent.trim();
-      
+
       const fallbackCopy = () => {
         const textArea = document.createElement("textarea");
         textArea.value = textToCopy;
@@ -64,10 +64,10 @@ document$.subscribe(function() {
 
   function showSuccess(button) {
     const originalHTML = button.innerHTML;
-    
+
     button.innerHTML = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M21 7 9 19l-5.5-5.5 1.41-1.41L9 16.17 19.59 5.59 21 7Z"/></svg>';
     button.classList.add("copy-success");
-    
+
     setTimeout(() => {
       button.innerHTML = originalHTML;
       button.classList.remove("copy-success");
diff --git a/docs/monitoring.md b/docs/monitoring.md
index 22d7985..438f40d 100644
--- a/docs/monitoring.md
+++ b/docs/monitoring.md
@@ -4,10 +4,10 @@
 
 [:octicons-tag-24: 1.0.0](https://github.com/DeepSpace2/plugnpin/releases/tag/v1.0.0){ .md-tag target="_blank" }
 
-PlugNPiN optionally exposes runtime and application metrics in Prometheus format  
+PlugNPiN optionally exposes runtime and application metrics in Prometheus format
 by using the `METRICS` environment variable ([Configuration → Environment Variables](./configuration.md#optional)).
 
-By default the metrics endpoint is available at `http://<plugnpin-host>:9100/metrics`  
+By default the metrics endpoint is available at `http://<plugnpin-host>:9100/metrics`
 and the port can be set with the `METRICS_SERVER_PORT` environment variable.
 
 ### Example Prometheus Scrape Configuration
@@ -18,4 +18,3 @@ scrape_configs:
     static_configs:
       - targets: ["<plugnpin-host>:9100"]
 ```
-
diff --git a/docs/theme/overrides/main.html b/docs/theme/overrides/main.html
index 8d9f505..0af326a 100644
--- a/docs/theme/overrides/main.html
+++ b/docs/theme/overrides/main.html
@@ -2,7 +2,7 @@
 
 {% block outdated %}
   You're not viewing the latest version.
-  <a href="{{ '../' ~ base_url }}"> 
+  <a href="{{ '../' ~ base_url }}">
     <strong>Click here to go to latest.</strong>
   </a>
 {% endblock %}

From ed2d1e8cc33754276fc070ff30679094f94a7a44 Mon Sep 17 00:00:00 2001
From: Adi Vaknin <6841988+DeepSpace2@users.noreply.github.com>
Date: Tue, 7 Jul 2026 23:22:43 +0300
Subject: [PATCH 2/3] Potential fix for pull request finding 'CodeQL / Workflow
 does not contain permissions'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/reusable-pre-commit.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/reusable-pre-commit.yml b/.github/workflows/reusable-pre-commit.yml
index 7b45313..3eee6bf 100644
--- a/.github/workflows/reusable-pre-commit.yml
+++ b/.github/workflows/reusable-pre-commit.yml
@@ -10,6 +10,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest

From 0648e047ca109dfb170c31dc2b30912b0f16e767 Mon Sep 17 00:00:00 2001
From: Adi Vaknin <6841988+DeepSpace2@users.noreply.github.com>
Date: Tue, 7 Jul 2026 23:24:40 +0300
Subject: [PATCH 3/3] Potential fix for pull request finding 'CodeQL / Workflow
 does not contain permissions'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/pr-build.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index 3e6d65e..fb8bc94 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -5,6 +5,12 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  packages: write
+  attestations: write
+  id-token: write
+
 jobs:
   changes:
     runs-on: ubuntu-latest