From 9f880d89fac7a461892181e6c467812f9a0aa9e2 Mon Sep 17 00:00:00 2001
From: Forge <forge@phenotype.local>
Date: Fri, 24 Apr 2026 16:11:16 -0700
Subject: [PATCH] ci: bootstrap .pre-commit-config.yaml (per audit #219)

Add language-aware pre-commit hooks: base text hygiene, conventional
commits, trufflehog secret scan, Rust toolchain.
---
 .pre-commit-config.yaml | 52 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 .pre-commit-config.yaml

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 000000000..a01a5d653
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,52 @@
+# See https://pre-commit.com for hooks list + config docs
+repos:
+  # Basic text/file hygiene
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+        args: [--allow-multiple-documents]
+      - id: check-json
+      - id: check-toml
+      - id: check-added-large-files
+        args: [--maxkb=1000]
+      - id: check-merge-conflict
+      - id: detect-private-key
+      - id: mixed-line-ending
+        args: [--fix=lf]
+
+  # Commit message convention
+  - repo: https://github.com/compilerla/conventional-pre-commit
+    rev: v3.6.0
+    hooks:
+      - id: conventional-pre-commit
+        stages: [commit-msg]
+        args: []
+
+  # Secret scanning
+  - repo: https://github.com/trufflesecurity/trufflehog
+    rev: v3.88.40
+    hooks:
+      - id: trufflehog
+        name: trufflehog (secret scan)
+        entry: trufflehog filesystem --no-update --only-verified --fail .
+        language: system
+        pass_filenames: false
+
+  # Rust toolchain
+  - repo: local
+    hooks:
+      - id: cargo-fmt
+        name: cargo fmt --check
+        entry: cargo fmt --all -- --check
+        language: system
+        types: [rust]
+        pass_filenames: false
+      - id: cargo-clippy
+        name: cargo clippy -D warnings
+        entry: cargo clippy --all-targets --all-features -- -D warnings
+        language: system
+        types: [rust]
+        pass_filenames: false