mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
bdc03d0a7f
* ci: add semgrep SAST scanning to CI and pre-commit Add semgrep static analysis to the security workflow and pre-commit hooks. Uses `--config auto` for comprehensive coverage across Python, Dockerfile, and GitHub Actions. The intentional `USER root` in the Dockerfile (required for bind mount compatibility) is excluded via `--exclude-rule`. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: pin semgrep container image to digest for zizmor Pin semgrep/semgrep to sha256 digest (v1.151.0) to satisfy zizmor's unpinned-images audit. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add zizmor pre-commit hook for Actions security audit Matches the existing actionlint pattern — gracefully skips if zizmor is not installed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
116 lines
3.3 KiB
YAML
116 lines
3.3 KiB
YAML
# See https://prek.j178.dev for more information
|
|
---
|
|
# Apply to all files without committing:
|
|
# prek run --all-files
|
|
# Update this file:
|
|
# prek auto-update
|
|
|
|
repos:
|
|
# Use prek built-in hooks (faster, Rust-native)
|
|
- repo: builtin
|
|
hooks:
|
|
- id: check-yaml
|
|
args: [--allow-multiple-documents]
|
|
exclude: '(files/cloud-init/base\.yml|roles/cloud-.*/files/stack\.yaml)'
|
|
- id: end-of-file-fixer
|
|
- id: trailing-whitespace
|
|
- id: check-added-large-files
|
|
args: ['--maxkb=500']
|
|
- id: check-merge-conflict
|
|
- id: mixed-line-ending
|
|
args: [--fix=lf]
|
|
|
|
# Python linting with ruff (fast, replaces many tools)
|
|
- repo: https://github.com/astral-sh/ruff-pre-commit
|
|
rev: v0.14.14
|
|
hooks:
|
|
- id: ruff
|
|
args: [--fix, --exit-non-zero-on-fix]
|
|
- id: ruff-format
|
|
|
|
# YAML linting
|
|
- repo: https://github.com/adrienverge/yamllint
|
|
rev: v1.38.0
|
|
hooks:
|
|
- id: yamllint
|
|
args: [-c=.yamllint]
|
|
exclude: '.git/.*'
|
|
|
|
# Shell script linting
|
|
- repo: https://github.com/shellcheck-py/shellcheck-py
|
|
rev: v0.11.0.1
|
|
hooks:
|
|
- id: shellcheck
|
|
exclude: '.git/.*'
|
|
|
|
# Local hooks that use the project's installed tools
|
|
- repo: local
|
|
hooks:
|
|
- id: ty-check
|
|
name: Python type check
|
|
entry: bash -c 'uv run --with ty ty check'
|
|
language: system
|
|
types: [python]
|
|
pass_filenames: false
|
|
|
|
- id: j2lint
|
|
name: Jinja2 template lint
|
|
entry: bash -c 'uv run j2lint roles/ --ignore S3 S5 S6 S7 V1'
|
|
language: system
|
|
files: '\.j2$'
|
|
pass_filenames: false
|
|
|
|
- id: ansible-lint
|
|
name: Ansible-lint
|
|
entry: bash -c 'uv run ansible-lint --force-color || echo "Ansible-lint had issues - check output"'
|
|
language: system
|
|
types: [yaml]
|
|
files: \.(yml|yaml)$
|
|
exclude: '^(.git/|.github/|requirements\.yml)'
|
|
pass_filenames: false
|
|
|
|
- id: ansible-syntax
|
|
name: Ansible syntax check
|
|
entry: bash -c 'uv run ansible-playbook main.yml --syntax-check'
|
|
language: system
|
|
files: 'main\.yml|server\.yml|users\.yml'
|
|
pass_filenames: false
|
|
|
|
- id: semgrep
|
|
name: Semgrep security scan
|
|
entry: >
|
|
bash -c '
|
|
command -v semgrep >/dev/null &&
|
|
semgrep --config auto
|
|
--exclude-rule dockerfile.security.last-user-is-root.last-user-is-root
|
|
--error --quiet --skip-unknown-extensions .
|
|
|| echo "semgrep not installed - skipping"'
|
|
language: system
|
|
pass_filenames: false
|
|
|
|
- id: actionlint
|
|
name: GitHub Actions lint
|
|
entry: bash -c 'command -v actionlint >/dev/null && actionlint .github/workflows/ || echo "actionlint not installed - skipping"'
|
|
language: system
|
|
files: '^\.github/workflows/.*\.yml$'
|
|
pass_filenames: false
|
|
|
|
- id: zizmor
|
|
name: GitHub Actions security audit
|
|
entry: bash -c 'command -v zizmor >/dev/null && zizmor .github/workflows/ || echo "zizmor not installed - skipping"'
|
|
language: system
|
|
files: '^\.github/workflows/.*\.yml$'
|
|
pass_filenames: false
|
|
|
|
# Configuration for prek
|
|
|
|
# Files to exclude globally
|
|
exclude: |
|
|
(?x)^(
|
|
.env/.*|
|
|
.venv/.*|
|
|
.git/.*|
|
|
__pycache__/.*|
|
|
.*\.egg-info/.*
|
|
)$
|