mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
984831bcab
* fix: add explicit bool filters for Ansible 12 jinja2_native compatibility Ansible 12 enables jinja2_native by default, which means string values like "true"/"false" are no longer automatically coerced to booleans in when: conditions and Jinja2 if statements. Add | bool filters to all boolean variable references in tasks, templates, and handlers. Also reformats long single-line Jinja2 conditionals into multi-line for readability, fixes GCE default() calls for native mode, adds help command to the algo script, and updates test fixtures to register the bool filter. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add j2lint for Jinja2 template linting Add j2lint (aristanetworks/j2lint) to catch syntax errors, spacing issues, and operator formatting in Jinja2 templates. Integrated into pre-commit hooks, lint.yml CI, and smart-tests.yml. Rules S3/S5/S6/S7/V1 are ignored — they enforce conventions incompatible with Ansible's config-file-embedded templates. Also fixes int+1 → int + 1 operator spacing in server.conf.j2. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: resolve all ansible-lint warnings and enforce zero-tolerance policy Fix 18 jinja[spacing] errors across 12 files by moving Jinja2 block delimiters to prevent YAML >- folding from introducing trailing spaces. Fix 27 key-order[task] warnings across 17 files by reordering task keys to canonical order (name → when → tags → environment → become → block). Promote key-order[task] and yaml[line-length] from warn_list to hard errors by removing warn_list entirely from .ansible-lint. Add zero-tolerance warning policy to CLAUDE.md explaining why warnings are unacceptable in a security tool and documenting resolution order. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
97 lines
2.6 KiB
YAML
97 lines
2.6 KiB
YAML
# See https://prek.j178.dev for more information
|
|
---
|
|
# Apply to all files without committing:
|
|
# prek run --all-files
|
|
# Update this file:
|
|
# prek auto-update
|
|
|
|
repos:
|
|
# Use prek built-in hooks (faster, Rust-native)
|
|
- repo: builtin
|
|
hooks:
|
|
- id: check-yaml
|
|
args: [--allow-multiple-documents]
|
|
exclude: '(files/cloud-init/base\.yml|roles/cloud-.*/files/stack\.yaml)'
|
|
- id: end-of-file-fixer
|
|
- id: trailing-whitespace
|
|
- id: check-added-large-files
|
|
args: ['--maxkb=500']
|
|
- id: check-merge-conflict
|
|
- id: mixed-line-ending
|
|
args: [--fix=lf]
|
|
|
|
# Python linting with ruff (fast, replaces many tools)
|
|
- repo: https://github.com/astral-sh/ruff-pre-commit
|
|
rev: v0.14.14
|
|
hooks:
|
|
- id: ruff
|
|
args: [--fix, --exit-non-zero-on-fix]
|
|
- id: ruff-format
|
|
|
|
# YAML linting
|
|
- repo: https://github.com/adrienverge/yamllint
|
|
rev: v1.38.0
|
|
hooks:
|
|
- id: yamllint
|
|
args: [-c=.yamllint]
|
|
exclude: '.git/.*'
|
|
|
|
# Shell script linting
|
|
- repo: https://github.com/shellcheck-py/shellcheck-py
|
|
rev: v0.11.0.1
|
|
hooks:
|
|
- id: shellcheck
|
|
exclude: '.git/.*'
|
|
|
|
# Local hooks that use the project's installed tools
|
|
- repo: local
|
|
hooks:
|
|
- id: ty-check
|
|
name: Python type check
|
|
entry: bash -c 'uv run --with ty ty check'
|
|
language: system
|
|
types: [python]
|
|
pass_filenames: false
|
|
|
|
- id: j2lint
|
|
name: Jinja2 template lint
|
|
entry: bash -c 'uv run j2lint roles/ --ignore S3 S5 S6 S7 V1'
|
|
language: system
|
|
files: '\.j2$'
|
|
pass_filenames: false
|
|
|
|
- id: ansible-lint
|
|
name: Ansible-lint
|
|
entry: bash -c 'uv run ansible-lint --force-color || echo "Ansible-lint had issues - check output"'
|
|
language: system
|
|
types: [yaml]
|
|
files: \.(yml|yaml)$
|
|
exclude: '^(.git/|.github/|requirements\.yml)'
|
|
pass_filenames: false
|
|
|
|
- id: ansible-syntax
|
|
name: Ansible syntax check
|
|
entry: bash -c 'uv run ansible-playbook main.yml --syntax-check'
|
|
language: system
|
|
files: 'main\.yml|server\.yml|users\.yml'
|
|
pass_filenames: false
|
|
|
|
- id: actionlint
|
|
name: GitHub Actions lint
|
|
entry: bash -c 'command -v actionlint >/dev/null && actionlint .github/workflows/ || echo "actionlint not installed - skipping"'
|
|
language: system
|
|
files: '^\.github/workflows/.*\.yml$'
|
|
pass_filenames: false
|
|
|
|
# Configuration for prek
|
|
|
|
# Files to exclude globally
|
|
exclude: |
|
|
(?x)^(
|
|
.env/.*|
|
|
.venv/.*|
|
|
.git/.*|
|
|
__pycache__/.*|
|
|
.*\.egg-info/.*
|
|
)$
|