.pre-commit-config.yaml

# Stop after the first failing hook so a broken Block 1 never runs Block 2 (code review + contract tests).
# Layout and stages mirror specfact-cli-modules; CLI adds Markdown + workflow lint + version hook.
fail_fast: true

repos:
  - repo: local
    hooks:
      - id: verify-module-signatures
        name: Verify module signatures (branch-aware; skip if no staged module tree changes)
        entry: scripts/pre-commit-verify-modules.sh
        language: script
        pass_filenames: false
        always_run: true

      - id: check-version-sources
        name: Check synchronized version sources (always; PR orchestrator tests job parity)
        entry: hatch run check-version-sources
        language: system
        pass_filenames: false
        always_run: true

      - id: dependency-trust-gate
        name: Dependency trust gate (blocked releases and frozen-review binding)
        entry: hatch run python scripts/check_dependency_trust_exceptions.py
        language: system
        pass_filenames: false
        files: |
          (?x)^(
            pyproject\.toml|
            uv\.lock|
            requirements/ci/locked\.txt|
            requirements/code-review/(requirements\.in|locked\.txt)|
            ci/dependency-trust-exceptions\.json|
            ci/security-tool-minimum-versions\.json|
            scripts/check_dependency_trust_exceptions\.py
          )$

      - id: frozen-cve-audit
        name: Frozen CVE audit (exact lock export; reviewed exceptions only)
        entry: hatch run security-audit
        language: system
        pass_filenames: false
        files: |
          (?x)^(
            pyproject\.toml|
            uv\.lock|
            requirements/ci/locked\.txt|
            requirements/code-review/(requirements\.in|locked\.txt)|
            ci/vulnerability-audit-exceptions\.json|
            scripts/security_audit_gate\.py
          )$

      - id: docs-gem-lock-security
        name: Docs Gem lock security floor
        entry: hatch run pytest tests/unit/docs/test_docs_validation_scripts.py::test_docs_json_gem_uses_the_patched_security_floor -q
        language: system
        pass_filenames: false
        files: ^(docs/Gemfile|docs/Gemfile\.lock|\.github/dependabot\.yml|tests/unit/docs/test_docs_validation_scripts\.py)$

      # Runs only when canonical version files are staged — same scope as pr-orchestrator tests job
      # PyPI step (version_sources_changed). Skips routine commits when local == PyPI after a release.
      - id: check-local-version-ahead-of-pypi
        name: Check local version ahead of PyPI (lenient network; when version files staged)
        entry: >-
          env SPECFACT_PYPI_VERSION_CHECK_LENIENT_NETWORK=1
          hatch run python scripts/check_local_version_ahead_of_pypi.py
          --skip-when-version-unchanged-vs HEAD
        language: system
        pass_filenames: false
        files: ^(pyproject\.toml|setup\.py|src/__init__\.py|src/specfact_cli/__init__\.py)$

      - id: cli-block1-format
        name: "CLI Block 1 — format"
        entry: ./scripts/pre-commit-quality-checks.sh block1-format
        language: system
        files: \.(py|pyi)$
        pass_filenames: false
        verbose: true

      - id: cli-block1-yaml
        name: "CLI Block 1 — yaml-lint (when YAML staged)"
        entry: ./scripts/pre-commit-quality-checks.sh block1-yaml
        language: system
        files: \.(yaml|yml)$
        verbose: true

      - id: cli-block1-markdown-fix
        name: "CLI Block 1 — markdown auto-fix (when Markdown staged)"
        entry: ./scripts/pre-commit-quality-checks.sh block1-markdown-fix
        language: system
        pass_filenames: false
        files: \.(md|mdc)$
        verbose: true

      - id: cli-block1-markdown-lint
        name: "CLI Block 1 — markdownlint (when Markdown staged)"
        entry: ./scripts/pre-commit-quality-checks.sh block1-markdown-lint
        language: system
        files: \.(md|mdc)$
        verbose: true

      - id: cli-block1-workflows
        name: "CLI Block 1 — workflow lint (when workflows staged)"
        entry: ./scripts/pre-commit-quality-checks.sh block1-workflows
        language: system
        files: ^\.github/workflows/.*\.(yaml|yml)$
        verbose: true

      - id: cli-block1-lint
        name: "CLI Block 1 — lint (when Python staged)"
        entry: ./scripts/pre-commit-quality-checks.sh block1-lint
        language: system
        files: \.(py|pyi)$
        verbose: true

      - id: cli-block2
        name: "CLI Block 2 — code review + contract tests"
        entry: ./scripts/pre-commit-quality-checks.sh block2
        language: system
        pass_filenames: false
        always_run: true
        verbose: true

      - id: check-doc-frontmatter
        name: Check documentation ownership frontmatter (enforced paths)
        entry: hatch run doc-frontmatter-check
        language: system
        files: ^(docs/.*\.md|docs/\.doc-frontmatter-enforced|USAGE-FAQ\.md)$
        pass_filenames: false
        always_run: false