electronic-prescription-service-account-resources/.pre-commit-config.yaml at main · NHSDigital/electronic-prescription-service-account-resources · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v6.0.0
    hooks:
      - id: check-merge-conflict
        name: Check for merge conflict strings

      - id: end-of-file-fixer
        name: Fix missing newline at the end of files

      - id: check-shebang-scripts-are-executable
        name: Check shell scripts are executable
        files: \.(sh)$

      - id: check-yaml
        name: Check pipelines configuration
        files: ^(.github)

  - repo: https://github.com/pycqa/flake8
    rev: "7ef0350a439c93166bc8ba89fcc3de6a9a664e6c"
    hooks:
      - id: flake8

  - repo: local
    hooks:
      - id: grype-scan-local
        name: Grype scan local changes
        entry: make
        args: ["grype-scan-local"]
        language: system
        pass_filenames: false
        always_run: true

      - id: check-commit-signing
        name: Check commit signing
        description: Ensures that commits are GPG signed
        entry: bash
        args:
          - -c
          - |
            if ! git config --get commit.gpgsign | grep -q "true" > /dev/null 2>&1; then
              echo "Error: Commit signing is not enabled."
              echo "Please enable commit signing with:"
              echo "  git config commit.gpgsign true"
              echo ""
              echo "For more information, see: https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits"
              exit 1
            fi
            echo "Commit signing is properly configured."
        language: system
        pass_filenames: false
        always_run: true

      - id: lint-cloudformation
        name: Lint cloudformation
        entry: make
        args: ["cfn-guard-cloudformation"]
        language: system
        files: ^cloudformation
        pass_filenames: false

      - id: lint-githubactions
        name: Lint github actions
        entry: make
        args: ["actionlint"]
        language: system
        files: ^.github
        types_or: [yaml]
        pass_filenames: false

      - id: lint-githubaction-scripts
        name: Lint github action scripts
        entry: make
        args: ["shellcheck"]
        language: system
        files: ^.github/scripts
        types_or: [sh, shell]
        pass_filenames: false

      - id: lint-certificate-checker
        name: Lint certificate-checker
        entry: npm
        args: ["run", "--prefix=packages/certificateChecker", "lint"]
        language: system
        files: ^packages\/certificateChecker
        types_or: [ts, tsx, javascript, jsx, json]
        pass_filenames: false

      - id: lint-slackAlerter
        name: Lint slackAlerter
        entry: npm
        args: ["run", "--prefix=packages/slackAlerter", "lint"]
        language: system
        files: ^packages\/slackAlerter
        types_or: [ts, tsx, javascript, jsx, json]
        pass_filenames: false

      - id: lint-proxygen
        name: Lint proxygen
        entry: npm
        args: ["run", "--prefix=packages/proxygen", "lint"]
        language: system
        files: ^packages\/proxygen
        types_or: [ts, tsx, javascript, jsx, json]
        pass_filenames: false

      - id: lint-lambdaJanitor
        name: Lint lambdaJanitor
        entry: npm
        args: ["run", "--prefix=packages/lambdaJanitor", "lint"]
        language: system
        files: ^packages\/lambdaJanitor
        types_or: [ts, tsx, javascript, jsx, json]
        pass_filenames: false

      - id: lint-cdk
        name: Lint cdk
        entry: npm
        args: ["run", "--prefix=packages/cdk", "lint"]
        language: system
        files: ^packages\/cdk
        types_or: [ts, tsx, javascript, jsx, json]
        pass_filenames: false

      - id: gitleaks
        name: Git Leaks
        description: gitleaks scans commits, commit messages, and --no-ff merges to prevent adding secrets into your git repositories.
        entry: bash
        args:
          - -c
          - "gitleaks git --pre-commit --redact --staged --verbose"
        language: system

fail_fast: true
default_stages: [pre-commit]