.pre-commit-config.yaml

# Semgrep pre-commit configuration.
# See https://pre-commit.com/ for more information.
# Once pre-commit is installed, you can run it locally with `pre-commit run --all`.
#
# This config defines also 2 "jobs" with the `stages: [manual]` directive
# which are only exercised in CI (see .github/workflows/lint.yml).

exclude: "^cli/tests/e2e/(targets|snapshots|rules/syntax)|^semgrep-core/tests|^semgrep-core/src/pfff/tests|^cli/src/semgrep/external|\\binvalid\\b|^cli/.test_durations|TOPORT"

# See https://pre-commit.com/#pre-commit-configyaml---repos
# for more information on the format of the content below
repos:
  # ----------------------------------------------------------
  # Standard pre-commit hooks
  # ----------------------------------------------------------
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.3.0
    hooks:
      - id: check-added-large-files
      - id: check-ast
      - id: check-builtin-literals
      - id: check-case-conflict
      - id: check-docstring-first
      - id: check-executables-have-shebangs
      - id: check-json
        exclude: ".devcontainer/devcontainer.json"
      - id: check-merge-conflict
      - id: check-shebang-scripts-are-executable
      - id: check-symlinks
      - id: check-toml
      - id: check-vcs-permalinks
      - id: check-xml
      - id: check-yaml
        args: [--allow-multiple-documents]
      - id: debug-statements
      - id: destroyed-symlinks
      - id: detect-private-key
      - id: end-of-file-fixer
      - id: fix-byte-order-marker
      - id: fix-encoding-pragma
        args: [--remove]
      - id: mixed-line-ending
        args: [--fix=lf]
      - id: no-commit-to-branch
      - id: requirements-txt-fixer
      - id: trailing-whitespace
        args: [--markdown-linebreak-ext=md]

  # ----------------------------------------------------------
  # Extra hooks with repositories defining their own hooks
  # ----------------------------------------------------------
  - repo: https://github.com/myint/autoflake
    rev: v1.4
    hooks:
      - id: autoflake
        args:
          - --in-place
          - --remove-unused-variables
          - --remove-duplicate-keys
          - --remove-all-unused-imports
          - --ignore-init-module-imports
          - --exclude=/cli/src/semgrep/output_from_core.py

  - repo: https://github.com/psf/black
    rev: 22.6.0
    hooks:
      - id: black
        args: [--exclude=/cli/src/semgrep/output_from_core.py]

  - repo: https://github.com/asottile/reorder_python_imports
    rev: v3.1.0
    hooks:
      - id: reorder-python-imports
        args: ["--application-directories=cli/src", --py37-plus]

  - repo: https://github.com/asottile/pyupgrade
    rev: v2.34.0
    hooks:
      - id: pyupgrade
        args: ["--py37-plus"]

  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: v0.961
    hooks:
      - id: mypy
        exclude: ^cli/tests/.+$|^setup.py$|^scripts/.+$|^parsing-stats/.+$|pfff|^perf/.+$$
        args: [--config, mypy.ini, --show-error-codes]
        additional_dependencies: &mypy-deps
          # versions must be manually synced:
          # - cli/setup.py lists dependencies
          # - cli/Pipfile lists type hint packages for dev env
          # - .pre-commit-config.yaml's mypy hooks also list type hint packages

          # some packages ship with type definitions
          - attrs~=21.3
          - click~=8.0
          - packaging~=21.0
          - requests~=2.22
          - defusedxml~=0.7.1
          # other packages have separate typings published
          - types-colorama~=0.4.0
          - types-jsonschema~=4.6.0
          - types-requests
          - types-setuptools
          - types-freezegun
          - types-python-dateutil
          - types-Jinja2
      - id: mypy
        alias: mypy-test
        name: mypy (test files)
        files: ^cli/tests/.+$
        args: [--config, mypy-tests.ini, --show-error-codes]
        additional_dependencies: *mypy-deps

  - repo: https://github.com/PyCQA/flake8
    rev: 3.9.2
    hooks:
      - id: flake8
        additional_dependencies: ["flake8-bugbear==22.1.11"]
        args: ["--select=B,E9,F4,F63,F7,F82"]

  # Reformat YAML, JSON, and Markdown files
  - repo: https://github.com/pre-commit/mirrors-prettier
    rev: v2.7.1
    hooks:
      - id: prettier
        exclude: "^perf/bench/dummy/.+$|^cli/tests/e2e/rules/.+$|^.+/Pipfile.lock$|^.devcontainer/devcontainer.json$"

  # ----------------------------------------------------------
  # Extra hooks using additional_dependencies
  # ----------------------------------------------------------
  - repo: local
    hooks:
      - id: gitignore-to-dockerignore
        name: Convert .gitignore to .dockerignore
        language: node
        entry: gitignore-to-dockerignore
        files: ^.(git|docker)ignore$
        additional_dependencies: ["gitignore-to-dockerignore@2.0.0"]

  # ----------------------------------------------------------
  # Simple docker-based hooks
  # ----------------------------------------------------------
  - repo: local
    hooks:
      - id: shellcheck
        name: shellcheck
        language: docker_image
        entry: koalaman/shellcheck:v0.8.0
        files: "[.]sh$"
        exclude: "pfff"
      - id: hadolint
        name: hadolint
        language: docker_image
        types:
          - dockerfile
        exclude: "^dockerfiles/linuxbrew[.]Dockerfile$"
        entry: hadolint/hadolint:v2.8.0-alpine hadolint
        args: ["--ignore", "DL3008", "--ignore", "DL3018"]

  # ----------------------------------------------------------
  # Local hooks
  # ----------------------------------------------------------
  # Reformat OCaml code (ml, mli) with ocamlformat if ocamlformat is
  # present. If ocamlformat is missing, this step will succeed.
  # This allows pure python users to run 'pre-commit run --all' without
  # installing opam and ocamlformat.
  - repo: local
    hooks:
      - id: lint-ocaml
        name: Reformat OCaml code
        entry: ./scripts/lint-ocaml
        language: script
        files: "\\.mli?$"
        # weird ocamlformat bug, can't process this file
        exclude: "^semgrep-core/src/pfff/lang_js/analyze/graph_code_js.ml"

  # ----------------------------------------------------------
  # Dogfood! running semgrep in pre-commit!
  # ----------------------------------------------------------
  - repo: local
    hooks:
      - id: semgrep-jsonnet
        name: semgrep jsonnet
        language: docker_image
        # See .pre-commit-hooks.yaml for why we need to set those
        # SEMGREP_XXX variables.  Ideally we would not need this
        # because we would use the 'language: python' instead of
        # 'docker_image' to run semgrep, but for now jsonnet support
        # is not available via setup.py and only (unofficially)
        # available in docker.
        entry: -e SEMGREP_LOG_FILE=/tmp/out.log -e SEMGREP_VERSION_CACHE_PATH=/tmp/cache returntocorp/semgrep:develop semgrep
        exclude: "^semgrep-core/src/pfff"
        #note that the --exclude below are useless because pre-commit pass
        # a list of files explicitely which prevents --exclude to work
        # hence the separate exclude: above.
        #coupling: 'make check' and the SEMGREP_ARGS variable
        args: [
            "--config",
            "semgrep.jsonnet",
            "--error",
            "--exclude",
            "tests",
            # note that pre-commit can call multiple times semgrep in
            # one run if there are many files in a PR (or in CI where
            # it runs on all the files in a repo).  In that case I
            # think pre-commit splits the list of files in multiple
            # batches and run one semgrep per batch. This is why it's
            # important to use --quiet otherwise you can have the same
            # banner repeated many times in the output in case of
            # errors.
            "--quiet",
            # this is useful in a pre-commit context because
            # pre-commit calls the hooks with all the files in the PR
            # (or in CI with all the files in the repo) but we don't
            # want an OCaml rule to be applied on a script.
            "--skip-unknown-extensions",
          ]
  # Dogfooding .pre-commit-hooks.yml and setup.py
  - repo: https://github.com/returntocorp/semgrep
    rev: v0.100.0
    hooks:
      - id: semgrep
        name: Semgrep Python
        types: [python]
        exclude: "^cli/tests/.+$|^scripts/.+$|^cli/setup.py$"
        args: ["--config", "https://semgrep.dev/p/python", "--error"]
      - id: semgrep
        name: Semgrep Bandit
        types: [python]
        exclude: "^cli/tests/.+$|^scripts/.+$|^cli/setup.py$"
        args: ["--config", "https://semgrep.dev/p/bandit", "--error"]

  # Run Semgrep Docker images. Only used in CI since it's slower for local developmemt.
  # To run locally use `pre-commit run --hook-stage manual semgrep-docker-develop`
  - repo: https://github.com/returntocorp/semgrep
    # Note that the 'rev:' below is the revision to use to clone the URL
    # above and to fetch its .pre-commit-hooks.yaml file. It does not always
    # mean which version of semgrep to use for the hook itself.
    # For example in .pre-commit-hooks.yaml if you use an entry with
    # the 'language: docker_image', the 'entry:' field will then specify
    # which version to use. In the case below, we're actually running
    # returntocorp/semgrep:develop if you look at .pre-commit-hooks.yaml
    rev: v0.100.0
    hooks:
      - id: semgrep-docker-develop
        name: Semgrep Develop Python
        types: [python]
        exclude: "^cli/tests/.+$|^scripts/.+$|^cli/setup.py$"
        args: ["--config", "p/python", "--error"]
        stages: [manual]
      - id: semgrep-docker-develop
        name: Semgrep Develop Bandit
        types: [python]
        exclude: "^cli/tests/.+$|^scripts/.+$|^cli/setup.py$"
        args: ["--config", "p/bandit", "--error"]
        stages: [manual]