.pre-commit-config.yaml

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.3.0
    hooks:
      # Git Style
      - id: check-added-large-files # default=500kb
        alias: check-added-large-files-500kb
      - id: check-merge-conflict
      - id: check-vcs-permalinks
      - id: forbid-new-submodules
      # TODO Upon deploying into production, add "no-commit-to-branch" to protect "main".

      # Common Errors
      - id: check-executables-have-shebangs
      - id: check-yaml
      - id: end-of-file-fixer # Ensures files end in newline char
        alias: end-of-file-newline-fixer
      - id: trailing-whitespace # Trims superfluous whitespace from eol
        alias: trailing-whitespace-eol-trimmer
        args: [--markdown-linebreak-ext=md]

      # Security
      - id: detect-aws-credentials
        args: ["--allow-missing-credentials"]
      - id: detect-private-key

  - repo: https://github.com/gruntwork-io/pre-commit
    rev: v0.1.17
    hooks:
      - id: shellcheck
      - id: terraform-fmt
      - id: tflint
        exclude: examples/.*

  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.72.1
    hooks:
      - id: terraform_tfsec
      - id: tfupdate
        alias: tf-version-autoupdate
      - id: terraform_docs
        # DOCS:       https://terraform-docs.io/user-guide/configuration/
        # HOOK DOCS:  https://github.com/antonbabenko/pre-commit-terraform#terraform_docs
        args:
          - --hook-config=--path-to-file=README.md
          - --hook-config=--add-to-existing-file=true
          - --args=--config=.terraform_docs/config.yml

  - repo: local
    hooks:
      - id: validate-custom-tfsec-checks
        name: validate-custom-tfsec-checks
        entry: /bin/bash -c 'for file in .tfsec/*; do tfsec-checkgen validate "$file"; done'
        language: script
        files: ^.tfsec/