.pre-commit-config.yaml

default_install_hook_types: [pre-commit, commit-msg]
# Hooks that don't declare stages run at pre-commit only, so installing the
# commit-msg shim doesn't re-run the file checks against the message file.
default_stages: [pre-commit]

repos:
  # Gitleaks secret scanning (300+ built-in rules)
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.30.1
    hooks:
      - id: gitleaks

  # Custom local hooks
  - repo: local
    hooks:
      # PII and absolute path detection
      - id: check-pii
        name: Check for PII and absolute paths
        entry: ./scripts/check-pii.sh
        language: script
        pass_filenames: false

      # Block planning/internal docs from being committed
      - id: check-planning-docs
        name: Block planning and internal docs
        entry: "BLOCKED: Planning/internal docs must not be committed. These are gitignored for a reason."
        language: fail
        files: '^(\.planning/|\.claude/|docs/superpowers/)'

      # Block large audio binaries (>1MB)
      - id: check-large-binaries
        name: Block large audio files (>1MB)
        entry: ./scripts/check-large-binaries.sh
        language: script
        types: [file]
        pass_filenames: false

      # Block AI session links/trailers in commit messages — any assistant,
      # not just Claude. Co-Authored-By trailers stay allowed.
      - id: check-ai-session-links
        name: Block AI session links in commit messages
        entry: ./scripts/check-ai-session-links.sh
        language: script
        stages: [commit-msg]

      # Semgrep SAST — same rulesets as the CI security-scan job. Runs via uv
      # (ephemeral, no project dep) and scans src/ when any source file changes.
      - id: semgrep
        name: Semgrep (SAST)
        entry: uv run --with semgrep semgrep scan --config p/python --config p/security-audit --config p/command-injection --error --metrics off --quiet src/
        language: system
        files: ^src/.*\.py$
        pass_filenames: false