Skip to content

ci: bootstrap .pre-commit-config.yaml (audit #219) #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KooshaPari merged 1 commit into from
Apr 25, 2026
Merged

ci: bootstrap .pre-commit-config.yaml (audit #219) #10

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 52 additions & 0 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
# See https://pre-commit.com for hooks list + config docs
repos:
# Basic text/file hygiene
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v5.0.0
hooks:
- id: trailing-whitespace
- id: end-of-file-fixer
- id: check-yaml
args: [--allow-multiple-documents]
- id: check-json
- id: check-toml
- id: check-added-large-files
args: [--maxkb=1000]
- id: check-merge-conflict
- id: detect-private-key
- id: mixed-line-ending
args: [--fix=lf]

# Commit message convention
- repo: https://github.com/compilerla/conventional-pre-commit
rev: v3.6.0
hooks:
- id: conventional-pre-commit
stages: [commit-msg]
Comment on lines +24 to +25

@codeant-ai codeant-ai Bot May 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Architect Review — HIGH

The Conventional Commits rule is configured for the commit-msg stage, but .pre-commit-config.yaml does not set default_install_hook_types (and the repo has no documented pre-commit install --hook-type commit-msg flow), so a normal pre-commit install will not install the commit-msg hook and commit-message enforcement will silently not run.

Suggestion: Add a top-level default_install_hook_types including commit-msg (or document/install via pre-commit install --hook-type commit-msg) so the Conventional Commits check is actually installed and enforced in standard local workflows.

Fix in Cursor | Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖 
This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.

**Path:** .pre-commit-config.yaml
**Line:** 24:25
**Comment:**
	*HIGH: The Conventional Commits rule is configured for the `commit-msg` stage, but `.pre-commit-config.yaml` does not set `default_install_hook_types` (and the repo has no documented `pre-commit install --hook-type commit-msg` flow), so a normal `pre-commit install` will not install the `commit-msg` hook and commit-message enforcement will silently not run.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

args: []

# Secret scanning
- repo: https://github.com/trufflesecurity/trufflehog
rev: v3.88.40
hooks:
- id: trufflehog
name: trufflehog (secret scan)
entry: trufflehog filesystem --no-update --only-verified --fail .

@cursor cursor Bot Apr 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Deprecated --only-verified flag silently misses secrets

Medium Severity

The trufflehog hook uses the deprecated --only-verified flag, which was replaced by --results=verified,unknown as of late 2024. The --only-verified flag silently suppresses verification errors (e.g., network timeouts, overlapping detectors), meaning real secrets that couldn't be verified due to transient issues are silently ignored. The recommended flag --results=verified,unknown ensures both confirmed leaks and ambiguous results are surfaced.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 9f880d8. Configure here.

@cursor cursor Bot Apr 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TruffleHog uses filesystem instead of recommended git

Medium Severity

The trufflehog entry uses trufflehog filesystem . but the official pre-commit documentation recommends trufflehog git file://. instead. The filesystem subcommand scans the entire working directory on every commit (slow) and doesn't leverage git-aware optimizations. The git subcommand auto-detects the pre-commit context and scans only staged changes, which is both faster and more precise for a pre-commit hook.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 9f880d8. Configure here.

language: system
pass_filenames: false

# Rust toolchain
- repo: local
hooks:
- id: cargo-fmt
name: cargo fmt --check
entry: cargo fmt --all -- --check
language: system
types: [rust]
pass_filenames: false
- id: cargo-clippy
name: cargo clippy -D warnings
entry: cargo clippy --all-targets --all-features -- -D warnings
language: system
types: [rust]
pass_filenames: false
Loading