.pre-commit-config.yaml

# ref. https://pre-commit.com/#plugins

# 特定のhookでエラーが発生した時点でエラー終了
fail_fast: true

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.6.0
    hooks:
      - id: trailing-whitespace
      - id: check-json
      - id: check-toml
      - id: check-yaml

  # test
  - repo: local
    hooks:
      - id: test-matrix
        name: check test_matrix.yaml
        entry: ./scripts/check_test_matrix.sh
        language: system
        always_run: true

  # opa
  - repo: local
    hooks:
      - id: opa-fmt
        name: run opa fmt
        entry: ./scripts/opafmt.sh
        language: system
        files: (\.rego)$
      - id: regal-lint
        name: run regal lint
        entry: ./scripts/regal.sh
        language: system
        files: (\.rego)$
      - id: conftest
        name: run conftest
        entry: ./scripts/conftest.sh
        language: system
        always_run: true

  # terraform
  - repo: local
    hooks:
      - id: terraform-fmt
        name: run terraform fmt
        entry: ./scripts/tffmt.sh
        language: system
        files: (\.tf|\.tfvars|\.hcl)$
        exclude: \.terraform\/.*$
      - id: tflint
        name: run tflint
        entry: ./scripts/tflint.sh
        language: system
        files: (\.tf|\.tfvars|\.hcl)$
        exclude: \.terraform\/.*$
      # チェックに1分以上かかるのでCIに任せる
      # - id: terraform-validate
      #   name: run terraform validate
      #   entry: ./scripts/tfvalidate.sh
      #   language: system
      #   files: (\.tf|\.tfvars|\.hcl)$
      #   exclude: \.terraform\/.*$

  # trivy
  - repo: local
    hooks:
      # 脆弱性DBのアップデートなどが発生する場合、チェックに時間がかかるので必要に応じてCIに任せる
      # ただしその場合でもsecretスキャンだけはローカルで行うべき
      - id: trivy
        name: run trivy
        entry: ./scripts/trivy.sh
        language: system
        always_run: true