.pre-commit-config.yaml

repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
  rev: v5.0.0
  hooks:
    - id: check-added-large-files
    - id: check-merge-conflict
    - id: check-yaml
    - id: check-executables-have-shebangs
    - id: end-of-file-fixer
    - id: trailing-whitespace
      args: [--markdown-linebreak-ext=md]
    - id: mixed-line-ending
      args: [--fix=lf]
    - id: check-case-conflict
    - id: detect-aws-credentials
      args: [--allow-missing-credentials]
    - id: detect-private-key

- repo: https://github.com/commitizen-tools/commitizen
  rev: v4.6.0
  hooks:
    - id: commitizen
      stages: [commit-msg]

- repo: https://github.com/gitleaks/gitleaks
  rev: v8.24.3
  hooks:
    - id: gitleaks

- repo: https://github.com/antonbabenko/pre-commit-terraform
  rev: v1.99.4
  hooks:
    - id: terraform_fmt
    - id: terraform_validate
      args:
        - --args=-no-color
        - --hook-config=--retry-once-with-cleanup=true
      # Only validate workspace roots (workspaces/<env>/*.tf).
      # Sub-module directories (workspaces/<env>/<module>/) are child modules
      # that require a calling root to supply provider aliases — they cannot be
      # validated standalone.
      exclude: ^(modules/|workspaces/[^/]+/[^/]+/)
    - id: terraform_tflint
      args:
        - --args=--only=terraform_deprecated_interpolation
        - --args=--only=terraform_deprecated_index
        - --args=--only=terraform_unused_declarations
        - --args=--only=terraform_comment_syntax
        - --args=--only=terraform_documented_outputs
        - --args=--only=terraform_documented_variables
        - --args=--only=terraform_typed_variables
        - --args=--only=terraform_naming_convention
        - --args=--only=terraform_required_version
        - --args=--only=terraform_required_providers