.pre-commit-config.yaml

repos:
  - hooks:
      - id: check-added-large-files
      - id: check-ast
      - id: check-case-conflict
      - id: check-executables-have-shebangs
      - id: check-merge-conflict
      - id: check-shebang-scripts-are-executable
      - id: check-yaml
      - id: detect-private-key
      - id: end-of-file-fixer
      - id: trailing-whitespace
    repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v5.0.0
  - repo: local
    hooks:
      - id: nixfmt
        name: Nix Syntax and Linting
        entry: nixfmt
        language: system
        types: [file]
        files: '\b\w+\.nix\b'
      #- id: nix-flake-check
      #  name: Nix Flake Check
      #  entry: bash -c 'if git diff --cached --name-only | grep -qE "\\.nix$|flake\\.nix|flake\\.lock"; then nix flake check --no-build --no-update-lock-file --no-write-lock-file --all-systems; fi'
      #  language: system
      #  always_run: true
      #  pass_filenames: false
      - id: gitleaks
        name: Detect hardcoded secrets
        description: Detect hardcoded secrets using Gitleaks
        entry: "gitleaks git --verbose --redact --staged"
        language: system
        pass_filenames: false