.pre-commit-config.yaml

# Pre-commit hooks configuration
repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
  rev: v5.0.0
  hooks:
  - id: trailing-whitespace
  - id: end-of-file-fixer
  - id: check-yaml
  - id: check-toml
  - id: mixed-line-ending
    args: ['--fix=lf']
  - id: detect-private-key
    exclude: ^scripts/pre-commit-check\.sh$  # 排除安全检查脚本（包含检测模式字符串，非真实私钥）
  - id: check-merge-conflict

# Detect secrets（高熵字符串/各类 token；baseline 记录已知误报，新增真实密钥才报警）
- repo: https://github.com/Yelp/detect-secrets
  rev: v1.5.0
  hooks:
  - id: detect-secrets
    args: [--baseline, .secrets.baseline]
    exclude: '^Cargo\.lock$'

# Rust 工程化检查（local hooks，使用系统 cargo）
- repo: local
  hooks:
  # 代码格式检查（不修改，仅检查）
  - id: cargo-fmt
    name: cargo fmt --check
    entry: cargo fmt --all -- --check
    language: system
    types: [rust]
    pass_filenames: false
  # Clippy 严格检查（-D warnings 将所有 warning 视为 error）
  - id: cargo-clippy
    name: cargo clippy
    entry: cargo clippy --all-targets --workspace -- -D warnings
    language: system
    types: [rust]
    pass_filenames: false
  # cargo-deny 许可证/漏洞/禁用依赖检查
  - id: cargo-deny
    name: cargo deny check
    entry: cargo deny check licenses advisories bans
    language: system
    pass_filenames: false
    files: ^(Cargo\.(toml|lock)|deny\.toml)$

# 禁止直接提交到 main 分支（仅在 commit 阶段运行，允许 feature branch → merge → main → push 流程）
- repo: local
  hooks:
  - id: no-commit-to-main
    name: No commit to main branch
    entry: scripts/no-commit-to-main.sh
    language: script
    pass_filenames: false
    always_run: true
    stages: [pre-commit]