1  repos:
  2    - repo: https://github.com/pre-commit/pre-commit-hooks
  3      rev: v5.0.0
  4      hooks:
  5        - id: trailing-whitespace
  6        - id: end-of-file-fixer
  7        - id: check-yaml
  8          args: [--unsafe]
  9        - id: check-toml
 10  
 11    # check-yaml above only validates YAML syntax. actionlint validates GitHub
 12    # Actions semantics: invalid context names (e.g. bare `secrets.X` in `if:`
 13    # expressions), unknown action inputs, wrong event names, etc.
 14    - repo: https://github.com/rhysd/actionlint
 15      rev: v1.7.4
 16      hooks:
 17        - id: actionlint
 18  
 19    - repo: local
 20      hooks:
 21        # ── Fast gates (commit) ──────────────────────────────────────────────
 22        # These run on every `git commit`. They should take < 3 seconds incrementally.
 23  
 24        - id: cargo-fmt
 25          name: cargo fmt
 26          entry: cargo fmt --all --
 27          language: system
 28          types: [rust]
 29          pass_filenames: false
 30  
 31        - id: cargo-clippy
 32          name: cargo clippy
 33          entry: bash -c 'SQLX_OFFLINE=true cargo clippy --all-targets --all-features -- -D warnings'
 34          language: system
 35          types: [rust]
 36          pass_filenames: false
 37  
 38        - id: gen-docs-check
 39          name: cargo xtask gen-docs --check
 40          entry: cargo xtask gen-docs --check
 41          language: system
 42          files: (crates/auths-cli/src/|crates/xtask/src/gen_docs|docs/cli/commands/)
 43          pass_filenames: false
 44  
 45        - id: cargo-deny
 46          name: cargo deny (licenses + bans)
 47          entry: bash -c 'cargo deny check > .cargo/cargo-deny.log 2>&1; exit $?'
 48          language: system
 49          files: (Cargo\.(toml|lock)|deny\.toml)$
 50          pass_filenames: false
 51  
 52        # ── Slow gates (push only) ──────────────────────────────────────────
 53        # These run on `git push`. They require linking binaries, compiling
 54        # alternative targets, or cross-compilation.
 55  
 56        - id: cargo-test
 57          name: cargo test (unit tests)
 58          entry: cargo nextest run --workspace --profile pre-commit -E 'not kind(test)'
 59          language: system
 60          types: [rust]
 61          pass_filenames: false
 62          stages: [pre-push]
 63  
 64        - id: cargo-check-python-bindings
 65          name: cargo check (python bindings)
 66          # OPTIMIZATION: We pass CARGO_TARGET_DIR so the python workspace shares
 67          # the main workspace's compiled dependencies, preventing a duplicate build.
 68          entry: bash -c 'CARGO_TARGET_DIR=../../target cargo check --manifest-path packages/auths-python/Cargo.toml'
 69          language: system
 70          types: [rust]
 71          pass_filenames: false
 72          stages: [pre-push]
 73  
 74        - id: cargo-check-wasm
 75          name: cargo check (wasm32)
 76          entry: bash -c 'rustup target add wasm32-unknown-unknown 2>/dev/null; cd crates/auths-verifier && cargo check --target wasm32-unknown-unknown --no-default-features --features wasm'
 77          language: system
 78          types: [rust]
 79          pass_filenames: false
 80          stages: [pre-push]
 81  
 82        - id: wasm-pack-build
 83          name: wasm-pack build (auths-verifier)
 84          entry: bash -c 'command -v wasm-pack >/dev/null 2>&1 || { echo "Skipping wasm-pack build — not installed."; exit 0; }; cd crates/auths-verifier && wasm-pack build --target bundler -- --no-default-features --features wasm'
 85          language: system
 86          types: [rust]
 87          pass_filenames: false
 88          stages: [pre-push]
 89  
 90        - id: cross-check-aarch64
 91          name: cross check (aarch64-linux)
 92          entry: bash -c 'command -v cross >/dev/null 2>&1 || { echo "Skipping aarch64 check — cross not installed."; exit 0; }; docker info >/dev/null 2>&1 || { echo "Skipping aarch64 check — Docker not running"; exit 0; }; cross check --package auths-cli --target aarch64-unknown-linux-gnu 2>&1 && echo "aarch64 OK" || echo "aarch64 check failed - CI will verify"; exit 0'
 93          language: system
 94          types: [rust]
 95          pass_filenames: false
 96          stages: [pre-push]
 97  
 98        - id: cargo-check-linux
 99          name: cargo check (linux)
100          entry: bash -c 'rustup target add x86_64-unknown-linux-gnu 2>/dev/null; cargo clippy --target x86_64-unknown-linux-gnu -- -D warnings 2>&1 && echo "Linux OK" || echo "Linux check failed - CI will verify"; exit 0'
101          language: system
102          types: [rust]
103          pass_filenames: false
104          stages: [pre-push]
105  
106        - id: cargo-check-windows
107          name: cargo check (windows)
108          entry: bash -c 'rustup target add x86_64-pc-windows-msvc 2>/dev/null; cargo clippy --target x86_64-pc-windows-msvc --features keychain-windows -- -D warnings 2>&1 && echo "Windows OK" || echo "Windows check failed - CI will verify"; exit 0'
109          language: system
110          types: [rust]
111          pass_filenames: false
112          stages: [pre-push]