# Pre-commit Configuration for steam-backlog-enforcer
# Install:  pre-commit install && pre-commit install --hook-type pre-push
# Run:      pre-commit run --all-files
# Update:   pre-commit autoupdate

default_language_version:
  python: python3
default_stages: [pre-commit]
fail_fast: false

default_install_hook_types: [pre-commit, pre-push, post-commit, post-merge, post-rewrite]
repos:
  # ===========================================================================
  # GENERAL HOOKS
  # ===========================================================================
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.6.0
    hooks:
      - id: trailing-whitespace
        args: [--markdown-linebreak-ext=md]
      - id: end-of-file-fixer
      - id: check-yaml
        # pnpm 12 writes pnpm-lock.yaml as two YAML documents (the pinned
        # packageManager's own lock, then the project lock); parse both.
        args: [--allow-multiple-documents]
      - id: check-json
      - id: check-toml
      - id: check-added-large-files
        args: [--maxkb=2000]
      - id: check-merge-conflict
      - id: check-case-conflict
      - id: detect-private-key
      - id: debug-statements
      - id: name-tests-test
        args: [--pytest-test-first]
        exclude: ^steam_backlog_enforcer/tests/_[a-z_]+\.py$
      - id: check-ast
      - id: check-builtin-literals
      - id: check-docstring-first
      - id: mixed-line-ending
        args: [--fix=lf]
      - id: requirements-txt-fixer

  # ===========================================================================
  # NOQA BLOCKER
  # ===========================================================================
  - repo: local
    hooks:
      - id: no-noqa
        name: Block noqa comments
        entry: '(?i)#\s*(noqa|type:\s*ignore)'
        language: pygrep
        types: [python]
      - id: no-ruff-noqa
        name: Block ruff noqa file-level comments
        entry: '(?i)#\s*ruff:\s*noqa'
        language: pygrep
        types: [python]
      - id: file-length
        name: Files must be at most 250 lines
        entry: bash scripts/check_file_length.sh
        language: system
        types: [text]
      - id: requirements-sync
        name: requirements.txt covers all package imports
        entry: python3 scripts/check_requirements_sync.py
        language: system
        pass_filenames: false
        files: ^(steam_backlog_enforcer/.*\.py|requirements\.txt)$

  # ===========================================================================
  # RUFF - Linter + formatter
  # ===========================================================================
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.17.0
    hooks:
      - id: ruff
        exclude: ^scripts/file_length/
        args: [--fix, --unsafe-fixes, --exit-non-zero-on-fix, --show-fixes]
        types_or: [python, pyi]
      - id: ruff-format
        exclude: ^scripts/file_length/
        types_or: [python, pyi]

  # ===========================================================================
  # MYPY - Type checking
  # ===========================================================================
  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: v1.13.0
    hooks:
      - id: mypy
        exclude: ^scripts/file_length/
        args:
          - --ignore-missing-imports
          - --no-error-summary
          - --disable-error-code=no-untyped-def
          - --disable-error-code=no-untyped-call
          - --disable-error-code=var-annotated
          - --disable-error-code=no-any-unimported
          - --disable-error-code=type-arg
          - --disable-error-code=no-any-return
          - --disable-error-code=misc
          - --disable-error-code=unused-ignore
          - --disable-error-code=unreachable
          - --disable-error-code=assignment
          - --disable-error-code=no-redef
          - --disable-error-code=attr-defined
          - --disable-error-code=arg-type
          - --disable-error-code=union-attr
          - --disable-error-code=call-overload
          - --disable-error-code=return-value
          - --disable-error-code=redundant-cast
          - --disable-error-code=empty-body
          - --disable-error-code=list-item
        additional_dependencies:
          - types-requests
          - earned-time @ git+https://github.com/kuhyx/utils@earned-time-v0.21.0#subdirectory=earned_time
          - leisure-watch @ git+https://github.com/kuhyx/leisure-watch@leisure-watch-v0.2.7

  # ===========================================================================
  # PYLINT
  # ===========================================================================
  - repo: https://github.com/pylint-dev/pylint
    rev: v4.0.9
    hooks:
      - id: pylint
        # Whole tree on every run, never the staged subset: `--fail-under`
        # grades a score, and a score over whatever happened to be staged let a
        # 9.99 tree pass at commit time and fail in CI. scripts/file_length/
        # is the shared copy from ~/src/utils, linted there.
        pass_filenames: false
        args:
          - --rcfile=pyproject.toml
          - --fail-under=10.0
          # Serial: parallel pylint pickles PyLinter with dill, which crashes on
          # Python 3.15 (removed co_lnotab). Same reason as jobs = 1 in pyproject.
          - --jobs=1
          - steam_backlog_enforcer
          - scripts/check_requirements_sync.py
        # pylint resolves imports in its OWN isolated env, so anything the
        # package imports has to be listed here or it reports import-error and
        # drags the score under --fail-under. `mcp` is a real runtime import
        # (steam_backlog_enforcer._mcp_server).
        additional_dependencies:
          - aiohttp==3.14.5
          - earned-time @ git+https://github.com/kuhyx/utils@earned-time-v0.21.0#subdirectory=earned_time
          - leisure-watch @ git+https://github.com/kuhyx/leisure-watch@leisure-watch-v0.2.7
          - howlongtobeatpy==1.0.24
          - mcp==2.3.0
          - pytest
          - requests
          - websockets==17.2

  # ===========================================================================
  # BANDIT - Security linter
  # ===========================================================================
  - repo: https://github.com/PyCQA/bandit
    rev: 1.7.10
    hooks:
      - id: bandit
        args:
          - -c
          - pyproject.toml
          - --severity-level=high
          - --confidence-level=medium
          - --skip=B113
        additional_dependencies: ["bandit[toml]"]
        exclude: ^(tests/|.*test.*\.py$)

  # ===========================================================================
  # PYTEST + COVERAGE (push stage)
  # ===========================================================================
  - repo: local
    hooks:
      - id: ci-mirror
        name: CI mirror (clean-venv pytest + pre-commit --all-files)
        entry: bash scripts/ci_mirror.sh steam_backlog_enforcer/tests/
        language: system
        pass_filenames: false
        always_run: true
        require_serial: true
        stages: [manual]

  # ===========================================================================
  # VITEST + COVERAGE (push stage)
  # ===========================================================================
  - repo: local
    hooks:
      - id: vitest-coverage
        name: vitest with 100% coverage enforcement
        entry: pnpm --dir web coverage
        language: system
        files: ^web/src/
        pass_filenames: false
        require_serial: true
        stages: [manual]

  # ===========================================================================
  # CODESPELL - Spell checking
  # ===========================================================================
  - repo: https://github.com/codespell-project/codespell
    rev: v2.3.0
    hooks:
      - id: codespell
        args:
          # pnpm-lock.yaml is integrity hashes, not prose: `vEw` in a
          # sha512 read as a misspelling of "view".
          - --skip=*.json,*.lock,*-lock.yaml,.git,__pycache__,.venv,node_modules
          # `lazer` is osu!lazer's own name, not a misspelling of laser.
          - --ignore-words-list=lazer,als,ans,ect,nd,som,sur,te,nam,numer,lew,sie,wil,postion,clen,ther,folow,derrive,ony,tje,noe,theses,crate,doubleclick,wile,tabel,pary,blok,bloc,proces,serwer,parametr,adres,hart,dout,metod,tekst,synonim,grup,mosty,lokal,skalar,milion,nowe,tre,hel,alph

  # ===========================================================================
  # SHELLCHECK - Shell script linting
  # ===========================================================================
  - repo: local
    hooks:
      - id: shellcheck
        name: shellcheck
        entry: bash -c 'printf "%s\0" "$@" | xargs -0 -n 40 shellcheck --severity=warning' --
        language: system
        types: [shell]

      # Four markdown namespaces (README / CLAUDE* / DOCS* / TODO*), plus the
      # rule that a TODO carries "REMOVE ME AFTER FINISH" and nothing else may.
      # Shared gate in ~/src/utils owns the namespaces and the exemption list, so
      # one repo's idea of a valid name cannot drift from every other repo's.
      - id: md-naming
        name: markdown naming convention
        entry: scripts/check_md_naming.sh
        language: system
        files: \.(md|markdown)$

      - id: todo-closer
        name: close Todo trailer tasks
        entry: scripts/todo_hooks.sh closer
        language: system
        stages: [post-commit]
        always_run: true
        pass_filenames: false

      - id: todo-import-pr-merge
        name: import PR Todo sections (pull)
        entry: scripts/todo_hooks.sh import-pr post-merge
        language: system
        stages: [post-merge]
        always_run: true
        pass_filenames: false

      - id: todo-import-pr-rewrite
        name: import PR Todo sections (pull --rebase)
        entry: scripts/todo_hooks.sh import-pr post-rewrite
        language: system
        stages: [post-rewrite]
        always_run: true
        pass_filenames: false

      # Every dependency on its ecosystem's newest STABLE release, exact-pinned
      # so the question is mechanically answerable at all.
      #
      # `files:` is what keeps this cheap: a commit touching only source makes
      # ZERO network requests, and manifest commits mostly hit a 6h disk cache.
      #
      # Runs WITHOUT --strict on purpose. Offline it degrades to the cached
      # answer and passes with a loud banner; `--no-verify` is banned here, so
      # a hook that hard-failed on a flaky connection would leave no way to
      # commit at all. CI, always online, is the strict authority.
      - id: dependency-freshness
        name: dependencies on newest stable
        entry: scripts/check_dependency_freshness.sh
        language: system
        pass_filenames: true
        files: >-
          (pubspec\.(yaml|lock)|pyproject\.toml|requirements.*\.txt|uv\.lock
          |package\.json|package-lock\.json|pnpm-lock\.yaml
          |Cargo\.(toml|lock)|go\.(mod|sum)
          |\.fvmrc|\.nvmrc|\.python-version
          |\.github/workflows/.*\.ya?ml)$

  - repo: local
    hooks:
      # The only pre-push hook. Everything that used to run here is now
      # `stages: [manual]` -- run on demand with `scripts/check_gate_stamp.sh
      # full`, and by CI on every push. finish_auto.sh stamps HEAD after its
      # gate; a tree without that receipt cannot leave the machine.
      - id: gate-stamp
        name: pushed tree passed the local gate (stamp check)
        entry: scripts/check_gate_stamp.sh check
        language: system
        pass_filenames: false
        always_run: true
        stages: [pre-push]

      - id: repo-contract
        name: repo contract (CLAUDE.md Commands + test_changed)
        entry: scripts/check_repo_contract.sh
        language: system
        pass_filenames: false
        files: ^(CLAUDE\.md|AGENTS\.md|scripts/test_changed\.sh)$