Add deny-pattern and require-pattern builtin hooks

[j178]

Add native deny-pattern and require-pattern builtin hooks with case-insensitive and multiline matching.

Document pygrep as a pre-commit compatibility option that requires Python.

Benchmark

With a profiling build and prewarmed filesystem and Python environment, the native hooks were:

• 4.6–6.0x faster for a single 40 KiB file.
• 4.6–4.8x faster across 1,000 files (39.2 MiB).
• 7.1–13.2x faster for multiline matching with eight patterns across the same dataset.

The benchmark excluded first-time Python lookup and installation, so the measured difference is conservative.

Closes #2355

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[codecov]

Codecov Report

❌ Patch coverage is 97.16312% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.35%. Comparing base (b45e671) to head (b8b5cb3).

Files with missing lines	Patch %	Lines
crates/prek/src/hooks/builtin_hooks/pattern.rs	96.33%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2359      +/-   ##
==========================================
+ Coverage   93.33%   93.35%   +0.01%     
==========================================
  Files         128      129       +1     
  Lines       27262    27402     +140     
==========================================
+ Hits        25446    25582     +136     
- Misses       1816     1820       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[prek-ci-bot]

📦 Cargo Bloat Comparison

Binary size change: -0.34% (29.2 MiB → 29.1 MiB)

Expand for cargo-bloat output

Head Branch Results

 File  .text     Size             Crate Name
 1.1%   2.3% 332.0KiB        aws_lc_sys aws_lc_0_42_0_aes_gcm_encrypt_avx512
 1.1%   2.3% 332.0KiB        aws_lc_sys aws_lc_0_42_0_aes_gcm_decrypt_avx512
 0.3%   0.6%  79.3KiB              prek <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
 0.2%   0.4%  52.4KiB              prek <<prek::config::Config as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<<serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
 0.2%   0.3%  49.4KiB annotate_snippets annotate_snippets::renderer::render::render
 0.1%   0.3%  41.3KiB              prek prek::cli::run::run::run::{closure#0}
 0.1%   0.3%  39.5KiB              prek prek::run::{closure#0}
 0.1%   0.2%  33.4KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
 0.1%   0.2%  32.1KiB              prek <prek::cli::RunOptions as clap_builder::derive::Args>::augment_args
 0.1%   0.2%  30.1KiB     granit_parser <granit_parser::scanner::Scanner<granit_parser::input::str::StrInput>>::fetch_more_tokens
 0.1%   0.2%  28.6KiB    cargo_metadata <&mut serde_json::de::Deserializer<serde_json::read::StrRead> as serde_core::de::Deserializer>::deserialize_struct::<<cargo_metadata::Package as serde_core::de::Deserialize>::deserialize::__Visitor>
 0.1%   0.2%  28.3KiB              prek <<prek::config::RemoteHook as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<<serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
 0.1%   0.2%  28.0KiB        aws_lc_sys aws_lc_0_42_0_edwards25519_scalarmuldouble_alt
 0.1%   0.2%  27.5KiB        aws_lc_sys aws_lc_0_42_0_edwards25519_scalarmuldouble
 0.1%   0.2%  26.2KiB              prek prek::cli::try_repo::try_repo::{closure#0}
 0.1%   0.2%  25.6KiB              prek <<prek::config::LocalHook as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<<serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
 0.1%   0.2%  25.2KiB              prek <<prek::config::UpdateOptions as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<<serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
 0.1%   0.2%  24.9KiB               xml <xml::reader::parser::PullParser>::dispatch_token
 0.1%   0.2%  24.3KiB              prek <prek::languages::node::installer::NodeInstaller>::install::{closure#0}
 0.1%   0.2%  24.0KiB     granit_parser <granit_parser::scanner::Scanner<serde_saphyr::de::buffered_input::ReaderInput>>::fetch_more_tokens
42.0%  88.1%  12.2MiB                   And 25816 smaller methods. Use -n N to show more.
47.7% 100.0%  13.9MiB                   .text section size, the file size is 29.1MiB

Base Branch Results

 File  .text     Size             Crate Name
 1.1%   2.3% 332.0KiB        aws_lc_sys aws_lc_0_42_0_aes_gcm_encrypt_avx512
 1.1%   2.3% 332.0KiB        aws_lc_sys aws_lc_0_42_0_aes_gcm_decrypt_avx512
 0.3%   0.6%  79.0KiB              prek <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
 0.2%   0.4%  53.4KiB              prek prek::run::{closure#0}
 0.2%   0.4%  52.0KiB              prek <<prek::config::Config as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<<serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
 0.2%   0.3%  49.4KiB annotate_snippets annotate_snippets::renderer::render::render
 0.1%   0.3%  41.2KiB              prek prek::cli::run::run::run::{closure#0}
 0.1%   0.2%  33.4KiB              prek prek::archive::unpack::<fs_err::tokio::file::File, &std::path::PathBuf>::{closure#0}
 0.1%   0.2%  31.9KiB              prek <prek::cli::RunOptions as clap_builder::derive::Args>::augment_args
 0.1%   0.2%  30.1KiB     granit_parser <granit_parser::scanner::Scanner<granit_parser::input::str::StrInput>>::fetch_more_tokens
 0.1%   0.2%  28.6KiB    cargo_metadata <&mut serde_json::de::Deserializer<serde_json::read::StrRead> as serde_core::de::Deserializer>::deserialize_struct::<<cargo_metadata::Package as serde_core::de::Deserialize>::deserialize::__Visitor>
 0.1%   0.2%  28.0KiB        aws_lc_sys aws_lc_0_42_0_edwards25519_scalarmuldouble_alt
 0.1%   0.2%  27.9KiB              prek <<prek::config::RemoteHook as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<<serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
 0.1%   0.2%  27.5KiB        aws_lc_sys aws_lc_0_42_0_edwards25519_scalarmuldouble
 0.1%   0.2%  26.1KiB              prek prek::cli::try_repo::try_repo::{closure#0}
 0.1%   0.2%  25.6KiB              prek <<prek::config::LocalHook as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<<serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
 0.1%   0.2%  25.2KiB              prek <<prek::config::UpdateOptions as serde_core::de::Deserialize>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::<<serde_saphyr::de::deserializer::YamlDeserializer as serde_core::de::Deserializer>::deserialize_map::MA>
 0.1%   0.2%  24.9KiB               xml <xml::reader::parser::PullParser>::dispatch_token
 0.1%   0.2%  24.3KiB              prek <prek::languages::node::installer::NodeInstaller>::install::{closure#0}
 0.1%   0.2%  24.0KiB     granit_parser <granit_parser::scanner::Scanner<serde_saphyr::de::buffered_input::ReaderInput>>::fetch_more_tokens
42.2%  88.1%  12.3MiB                   And 25758 smaller methods. Use -n N to show more.
47.9% 100.0%  14.0MiB                   .text section size, the file size is 29.2MiB

[prek-ci-bot]

⚡️ Hyperfine Benchmarks

Summary: 0 regressions, 2 improvements above the 10% threshold.

Environment

• OS: Linux 6.17.0-1020-azure
• CPU: 4 cores
• prek version: prek 0.4.10+3 (22a3cb5 2026-07-17)
• Rust version: rustc 1.97.1 (8bab26f4f 2026-07-14)
• Hyperfine version: hyperfine 1.20.0

CLI Commands

Benchmarking basic commands in the main repo:

prek --version

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base --version	2.5 ± 0.1	2.3	2.9	1.08 ± 0.06
prek-head --version	2.3 ± 0.1	2.2	2.5	1.00

prek list

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base list	10.3 ± 0.2	9.8	11.0	1.00
prek-head list	10.4 ± 0.2	9.9	10.8	1.01 ± 0.03

prek validate-config .pre-commit-config.yaml

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base validate-config .pre-commit-config.yaml	3.7 ± 0.1	3.6	3.9	1.09 ± 0.04
prek-head validate-config .pre-commit-config.yaml	3.4 ± 0.1	3.3	3.7	1.00

prek sample-config

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base sample-config	2.9 ± 0.1	2.8	3.2	1.07 ± 0.04
prek-head sample-config	2.7 ± 0.1	2.6	2.9	1.00

Cold vs Warm Runs

Comparing first run (cold) vs subsequent runs (warm cache):

prek run --all-files (cold - no cache)

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run --all-files	80.0 ± 3.5	75.0	86.2	1.02 ± 0.05
prek-head run --all-files	78.4 ± 2.3	74.1	82.7	1.00

prek run --all-files (warm - with cache)

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run --all-files	76.7 ± 4.8	71.0	93.8	1.00
prek-head run --all-files	77.4 ± 2.5	73.0	81.8	1.01 ± 0.07

Full Hook Suite

Running the builtin hook suite on the benchmark workspace:

prek run --all-files (full builtin hook suite)

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run --all-files	85.2 ± 10.3	74.1	121.1	1.07 ± 0.14
prek-head run --all-files	79.6 ± 4.8	72.2	97.6	1.00

Individual Hook Performance

Benchmarking each hook individually on the test repo:

prek run trailing-whitespace --all-files

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run trailing-whitespace --all-files	20.6 ± 0.3	20.0	21.4	1.00
prek-head run trailing-whitespace --all-files	20.6 ± 0.5	19.8	22.1	1.00 ± 0.03

prek run end-of-file-fixer --all-files

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run end-of-file-fixer --all-files	28.2 ± 5.8	24.1	56.5	1.06 ± 0.24
prek-head run end-of-file-fixer --all-files	26.7 ± 2.2	24.1	31.1	1.00

prek run check-json --all-files

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run check-json --all-files	8.4 ± 0.3	8.0	9.1	1.04 ± 0.05
prek-head run check-json --all-files	8.1 ± 0.3	7.5	8.8	1.00

prek run check-yaml --all-files

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run check-yaml --all-files	8.1 ± 0.1	7.9	8.3	1.02 ± 0.03
prek-head run check-yaml --all-files	8.0 ± 0.2	7.6	8.8	1.00

prek run check-toml --all-files

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run check-toml --all-files	8.3 ± 0.3	7.9	9.0	1.02 ± 0.08
prek-head run check-toml --all-files	8.2 ± 0.6	7.7	11.2	1.00

prek run check-xml --all-files

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run check-xml --all-files	8.2 ± 0.4	7.7	9.3	1.00 ± 0.07
prek-head run check-xml --all-files	8.2 ± 0.3	7.6	9.0	1.00

prek run detect-private-key --all-files

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run detect-private-key --all-files	14.4 ± 1.4	12.8	18.5	1.00 ± 0.16
prek-head run detect-private-key --all-files	14.3 ± 1.9	12.1	19.5	1.00

prek run fix-byte-order-marker --all-files

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run fix-byte-order-marker --all-files	32.1 ± 43.0	18.1	210.3	1.72 ± 2.30
prek-head run fix-byte-order-marker --all-files	18.7 ± 1.0	17.2	21.9	1.00

✅ Performance improvement for prek run fix-byte-order-marker --all-files: 41.9400% faster

Installation Performance

Benchmarking hook installation (fast path hooks skip Python setup):

prek install-hooks (cold - no cache)

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base install-hooks	5.1 ± 0.2	4.9	5.4	1.06 ± 0.04
prek-head install-hooks	4.8 ± 0.1	4.7	5.0	1.00

prek install-hooks (warm - with cache)

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base install-hooks	5.1 ± 0.2	4.9	5.4	1.03 ± 0.06
prek-head install-hooks	5.0 ± 0.2	4.7	5.3	1.00

File Filtering/Scoping Performance

Testing different file selection modes:

prek run (staged files only)

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run	42.9 ± 4.0	39.6	55.4	1.00
prek-head run	43.0 ± 3.4	39.1	49.7	1.00 ± 0.12

prek run --files '*.json' (specific file type)

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run --files '*.json'	9.0 ± 0.6	8.3	10.9	1.00
prek-head run --files '*.json'	9.3 ± 1.1	8.3	12.5	1.04 ± 0.14

Workspace Discovery & Initialization

Benchmarking hook discovery and initialization overhead:

prek run --dry-run --all-files (measures init overhead)

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run --dry-run --all-files	8.8 ± 1.0	7.6	12.0	1.15 ± 0.15
prek-head run --dry-run --all-files	7.7 ± 0.5	7.2	9.2	1.00

✅ Performance improvement for prek run --dry-run --all-files (measures init overhead): 13.0400% faster

Meta Hooks Performance

Benchmarking meta hooks separately:

prek run check-hooks-apply --all-files

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run check-hooks-apply --all-files	14.0 ± 1.2	13.0	17.7	1.04 ± 0.11
prek-head run check-hooks-apply --all-files	13.4 ± 0.9	12.7	16.2	1.00

prek run check-useless-excludes --all-files

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run check-useless-excludes --all-files	12.9 ± 1.5	11.4	16.5	1.04 ± 0.18
prek-head run check-useless-excludes --all-files	12.5 ± 1.6	11.2	17.0	1.00

prek run identity --all-files

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
prek-base run identity --all-files	11.5 ± 1.1	10.8	14.2	1.00
prek-head run identity --all-files	11.6 ± 1.3	10.7	14.6	1.01 ± 0.15

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.