ci: bootstrap .pre-commit-config.yaml (audit #219)

[KooshaPari]

User description

Bootstraps pre-commit hooks per cross-repo audit #219. Language-inferred: Rust. Base: text hygiene + conventional-pre-commit + trufflehog. Extended for the repo's primary language where applicable.

Note

Low Risk
Low risk because it only adds developer tooling and local checks without changing runtime code paths; potential impact is limited to stricter commit-time validation and CI parity issues if tool versions differ.

Overview
Introduces a new .pre-commit-config.yaml to standardize local pre-commit checks.

Configures file hygiene hooks (whitespace/EOF, YAML/JSON/TOML validation, large-file and merge-conflict checks, private key detection, LF normalization), enforces Conventional Commits via commit-msg, runs TruffleHog secret scanning, and adds Rust-specific checks (cargo fmt --check and cargo clippy -D warnings).

^{Reviewed by Cursor Bugbot for commit 9f880d8. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Add pre-commit checks for file hygiene, secret scanning, and Rust code quality

What Changed

• Adds pre-commit checks that catch trailing spaces, missing line endings, invalid YAML/JSON/TOML, merge conflicts, large files, and private keys before commits land
• Enforces Conventional Commits for commit messages
• Scans for verified secrets before commits
• Runs Rust formatting and lint checks locally before changes are committed

Impact

✅ Fewer broken commits
✅ Earlier secret detection
✅ Cleaner Rust commits

🔄 Retrigger CodeAnt AI Review

Details

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@KooshaPari has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 39 minutes and 47 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 39 minutes and 47 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 52270c12-79ae-45ec-80a2-815cf3747110

📥 Commits

Reviewing files that changed from the base of the PR and between 14252ad and 9f880d8.

📒 Files selected for processing (1)

• .pre-commit-config.yaml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/bootstrap-pre-commit-audit-219

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch ci/bootstrap-pre-commit-audit-219

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Deprecated --only-verified flag silently misses secrets
  • Replaced deprecated --only-verified flag with --results=verified,unknown to ensure verification errors and ambiguous results are properly surfaced.
• ✅ Fixed: TruffleHog uses filesystem instead of recommended git
  • Changed from 'trufflehog filesystem .' to 'trufflehog git file://.' with --since-commit HEAD to scan only staged changes efficiently.

Or push these changes by commenting:

@cursor push fcac1d8756

Preview (fcac1d8756)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -31,7 +31,7 @@
     hooks:
       - id: trufflehog
         name: trufflehog (secret scan)
-        entry: trufflehog filesystem --no-update --only-verified --fail .
+        entry: trufflehog git file://. --no-update --since-commit HEAD --results=verified,unknown --fail --trust-local-git-config
         language: system
         pass_filenames: false

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 9f880d8. Configure here.}

[cursor]

Deprecated --only-verified flag silently misses secrets

Medium Severity

The trufflehog hook uses the deprecated --only-verified flag, which was replaced by --results=verified,unknown as of late 2024. The --only-verified flag silently suppresses verification errors (e.g., network timeouts, overlapping detectors), meaning real secrets that couldn't be verified due to transient issues are silently ignored. The recommended flag --results=verified,unknown ensures both confirmed leaks and ambiguous results are surfaced.

 

^{Reviewed by Cursor Bugbot for commit 9f880d8. Configure here.}

[cursor]

TruffleHog uses filesystem instead of recommended git

Medium Severity

The trufflehog entry uses trufflehog filesystem . but the official pre-commit documentation recommends trufflehog git file://. instead. The filesystem subcommand scans the entire working directory on every commit (slow) and doesn't leverage git-aware optimizations. The git subcommand auto-detects the pre-commit context and scans only staged changes, which is both faster and more precise for a pre-commit hook.

 

^{Reviewed by Cursor Bugbot for commit 9f880d8. Configure here.}

[codeant-ai]

CodeAnt AI is running the review.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

Sequence Diagram

This PR adds a pre-commit configuration that enforces file hygiene, conventional commit messages, secret scanning, and Rust formatting and linting before allowing a commit to succeed.

sequenceDiagram
    participant Developer
    participant Git
    participant PreCommit
    participant HygieneHooks
    participant CommitMsgHook
    participant SecretScan
    participant RustTools

    Developer->>Git: Run git commit
    Git->>PreCommit: Invoke configured pre-commit hooks
    PreCommit->>HygieneHooks: Run file and config hygiene checks
    PreCommit->>CommitMsgHook: Validate conventional commit message
    PreCommit->>SecretScan: Scan repository for potential secrets
    PreCommit->>RustTools: Run cargo fmt and cargo clippy
    RustTools-->>PreCommit: Return formatting and lint results
    PreCommit-->>Git: Approve or block commit based on all checks

Loading

---

Generated by CodeAnt AI

[codeant-ai]

🟠 Architect Review — HIGH

The Conventional Commits rule is configured for the commit-msg stage, but .pre-commit-config.yaml does not set default_install_hook_types (and the repo has no documented pre-commit install --hook-type commit-msg flow), so a normal pre-commit install will not install the commit-msg hook and commit-message enforcement will silently not run.

Suggestion: Add a top-level default_install_hook_types including commit-msg (or document/install via pre-commit install --hook-type commit-msg) so the Conventional Commits check is actually installed and enforced in standard local workflows.

Fix in Cursor | Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖

This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.

**Path:** .pre-commit-config.yaml
**Line:** 24:25
**Comment:**
	*HIGH: The Conventional Commits rule is configured for the `commit-msg` stage, but `.pre-commit-config.yaml` does not set `default_install_hook_types` (and the repo has no documented `pre-commit install --hook-type commit-msg` flow), so a normal `pre-commit install` will not install the `commit-msg` hook and commit-message enforcement will silently not run.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

[codeant-ai]

CodeAnt AI finished running the review.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

CodeAnt AI is running the review.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[codeant-ai]

Sequence Diagram

This PR adds a pre-commit configuration that runs text hygiene checks, enforces Conventional Commits, scans for verified secrets, and validates Rust formatting and lints before allowing commits.

sequenceDiagram
    participant Dev
    participant Git
    participant PreCommit
    participant Hygiene
    participant CommitLint
    participant Trufflehog
    participant RustTools

    Dev->>Git: Run git commit
    Git->>PreCommit: Trigger pre-commit hooks
    PreCommit->>Hygiene: Check whitespace and config files
    PreCommit->>CommitLint: Enforce Conventional Commits
    PreCommit->>Trufflehog: Scan repository for verified secrets
    PreCommit->>RustTools: Run cargo fmt check and cargo clippy
    PreCommit-->>Git: All hooks passed
    Git-->>Dev: Commit recorded

Loading

---

Generated by CodeAnt AI

[codeant-ai]

CodeAnt AI finished running the review.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn