feat(project): add git hooks

Author: krokoko

.claude/settings.json

@@ -4,4 +4,4 @@
       "code-review@claude-plugins-official": true,
       "pr-review-toolkit@claude-plugins-official": true
   }
-}
+}

.github/CODEOWNERS

@@ -6,4 +6,4 @@
 
 ## File must end with CODEOWNERS file
 
-.github/CODEOWNERS                  @aws-samples/coding-agents-admin
+.github/CODEOWNERS                  @aws-samples/coding-agents-admin

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -34,7 +34,7 @@ body:
     id: use-case
     attributes:
       label: Use case
-      description: Why do you need this? For example: "I'm always frustrated when..."
+      description: "Why do you need this? For example: I'm always frustrated when..."
     validations:
       required: true
   - type: textarea

.github/SECURITY.md

@@ -3,4 +3,4 @@
 If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com.
 
 > [!IMPORTANT]
-> Please do not create a GitHub issue, pull request, or other public announcements.
+> Please do not create a GitHub issue, pull request, or other public announcements.

.github/pull_request_template.md

@@ -0,0 +1,71 @@
+# Git hooks via https://github.com/j178/prek (installed by `mise run install` in a Git checkout; re-run `mise run hooks:install` after edits).
+# Config format matches pre-commit; run hooks with `prek` from mise (`mise.toml` [tools]).
+
+default_install_hook_types: [pre-commit, pre-push]
+fail_fast: false
+exclude: ^\.threat-composer/
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+        # Skip generated trees and paths often checked in read-only (0444); mutating hooks must not touch them.
+        exclude: (cdk/cdk\.out/|node_modules/|(^|/)LICENSE$|(^|/)\.gitattributes$|(^|/)\.npmignore$|(^|/)\.gitignore$|^cli/header\.js$|^docs/astro\.config\.mjs$|^docs/tsconfig\.json$|^docs/src/content\.config\.ts$|\.(snap|lock)$)
+      - id: end-of-file-fixer
+        exclude: (cdk/cdk\.out/|node_modules/|(^|/)LICENSE$|(^|/)\.gitattributes$|(^|/)\.npmignore$|(^|/)\.gitignore$|^cli/header\.js$|^docs/astro\.config\.mjs$|^docs/tsconfig\.json$|^docs/src/content\.config\.ts$)
+      - id: check-merge-conflict
+      - id: check-yaml
+        exclude: ^(cdk/cdk\.out/|cdk\.out/|node_modules/|agent/\.venv/)
+      - id: check-json
+        exclude: ^(cdk/cdk\.out/|node_modules/)
+
+  - repo: local
+    hooks:
+      - id: gitleaks-staged
+        name: gitleaks (staged)
+        entry: bash -lc 'cd "$(git rev-parse --show-toplevel)" && mise run security:secrets:staged'
+        language: system
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: cdk-eslint
+        name: eslint (cdk)
+        entry: bash -lc 'cd "$(git rev-parse --show-toplevel)" && export MISE_EXPERIMENTAL=1 && mise //cdk:eslint'
+        language: system
+        pass_filenames: false
+        files: ^cdk/.*\.(ts|tsx|cjs|mjs|js)$
+        exclude: ^cdk/cdk\.out/
+        stages: [pre-commit]
+
+      - id: cli-eslint
+        name: eslint (cli)
+        entry: bash -lc 'cd "$(git rev-parse --show-toplevel)" && export MISE_EXPERIMENTAL=1 && mise //cli:eslint'
+        language: system
+        pass_filenames: false
+        files: ^cli/.*\.(ts|tsx|cjs|mjs|js)$
+        stages: [pre-commit]
+
+      - id: agent-quality
+        name: quality (agent)
+        entry: bash -lc 'cd "$(git rev-parse --show-toplevel)/agent" && mise run quality'
+        language: system
+        pass_filenames: false
+        files: ^agent/.*\.py$
+        stages: [pre-commit]
+
+      - id: docs-astro-check
+        name: astro check (docs)
+        entry: bash -lc 'cd "$(git rev-parse --show-toplevel)/docs" && ./node_modules/.bin/astro check'
+        language: system
+        pass_filenames: false
+        files: ^docs/
+        exclude: ^docs/node_modules/
+        stages: [pre-commit]
+
+      - id: monorepo-security-pre-push
+        name: security scans (pre-push)
+        entry: bash -lc 'cd "$(git rev-parse --show-toplevel)" && mise run security'
+        language: system
+        pass_filenames: false
+        stages: [pre-push]

.pre-commit-config.yaml

@@ -92,4 +92,4 @@
   "threats": [],
   "mitigations": [],
   "mitigationLinks": []
-}
+}

.threat-composer/20260331-1834/components/applicationInfo.tc.json

@@ -123,4 +123,4 @@
   "threats": [],
   "mitigations": [],
   "mitigationLinks": []
-}
+}

.threat-composer/20260331-1834/components/architectureDescription.tc.json

@@ -123,4 +123,4 @@
   "threats": [],
   "mitigations": [],
   "mitigationLinks": []
-}
+}

.threat-composer/20260331-1834/components/dataflowDescription.tc.json

@@ -450,4 +450,4 @@
       "linkedId": "30b38afc-9930-4602-8637-56ddb166d2a5"
     }
   ]
-}
+}