lefthook config

.mise.toml

[settings]
experimental = true
legacy_version_file_disable_tools = ['terraform']

[tools]
direnv = "2.37.1"
terraform-docs = "0.20.0"
tflint = "0.63.1"
opentofu = "1.12.3"
lefthook = "2.1.10"
"npm:markdownlint-cli2" = "0.23.2"
# https://pypi.org/project/pre-commit-hooks/
"pipx:pre-commit-hooks" = "6.0.0"

lefthook-with-pre-commit-hooks.yaml

---
pre-commit:
  parallel: true

  commands:
    fmt:
      run: tofu fmt -recursive
      stage_fixed: true

    tflint:
      run: tflint --recursive

    yamllint:
      run: yamllint .

    markdownlint:
      run: markdownlint-cli2 .

    trailing-whitespace:
      run: trailing-whitespace-fixer {staged_files}
      stage_fixed: true

    merge-conflicts:
      run: check-merge-conflict {staged_files}

    broken-symlinks:
      run: check-symlinks {staged_files}

    large-files:
      run: check-added-large-files --maxkb=1024

pre-push:
  commands:

    checkov:
      run: checkov -d .

    trivy:
      run: trivy config .

    docs:
      run: terraform-docs markdown --output-file README.md ./terraform

    branch-name:
      skip: false
      run: |
        BRANCH=$(git rev-parse --abbrev-ref HEAD)
        echo "$BRANCH" | grep -qE "^(main|master|develop|staging)$" && exit 0
        PATTERN="^(feature|bugfix)\/[a-z0-9][a-z0-9-]*$"
        if ! echo "$BRANCH" | grep -qE "$PATTERN"; then
          echo ""
          echo "  Bad branch name: $BRANCH"
          echo ""
          echo "  Format:  type/description"
          echo "  Desc:    lowercase, numbers, hyphens only"
          echo ""
          echo "  Types:   feature bugfix"
          echo ""
          echo "  OK:      feature/add-login"
          echo "  OK:      bugfix/null-pointer-on-startup"
          echo "  FAIL:    feat/add-login   (use 'feature')"
          echo "  FAIL:    fix/something    (use 'bugfix')"
          echo ""
          exit 1
        fi

commit-msg:
  commands:
    semantic-commit:
      run: |
        MSG=$(head -n1 {1})
        echo "$MSG" | grep -qE "^Merge " && exit 0
        MAX_LEN=72
        MSG_LEN=${#MSG}
        if [ "$MSG_LEN" -gt "$MAX_LEN" ]; then
          echo ""
          echo "  Commit message too long: $MSG_LEN chars (max $MAX_LEN)"
          echo "  $MSG"
          echo ""
          exit 1
        fi
        PATTERN="^(feat|fix|docs|style|refactor|test|chore|ci)(\([a-z0-9-]+\))?: [a-z0-9][a-zA-Z0-9 [:punct:]-]*$"
        if ! echo "$MSG" | grep -qE "$PATTERN"; then
          echo ""
          echo "  Bad commit message: $MSG"
          echo ""
          echo "  Format:  type(scope): subject"
          echo "  Scope:   optional"
          echo "  Subject: lowercase, may contain letters, numbers, punctuation, hyphens"
          echo "  Max:     $MAX_LEN characters"
          echo ""
          echo "  Types:   feat fix docs style refactor test chore ci"
          echo ""
          echo "  OK:      feat(auth): add login endpoint"
          echo "  OK:      fix: resolve null-pointer on startup"
          echo "  FAIL:    Fix: Something  (uppercase)"
          echo ""
          exit 1
        fi

lefthook.yaml

---
pre-commit:
  parallel: true

  commands:
    fmt:
      run: tofu fmt -recursive
      stage_fixed: true

    tflint:
      run: tflint --recursive

    yamllint:
      run: yamllint .

    markdownlint:
      run: markdownlint-cli2 .

    trailing-whitespace:
      run: |
        ! grep -rInE '[[:blank:]]+$' \
          --include='*.tf' \
          --include='*.md' \
          --include='*.yaml' \
          --include='*.yml' .

    merge-conflicts:
      run: |
        ! grep -rInE '^(<<<<<<<|=======|>>>>>>>)' .

    broken-symlinks:
      run: |
        find . -xtype l | grep . && exit 1 || exit 0


    large-files:
      run: |
        find . -type f -size +1M \
          -not -path "./.git/*" \
          | grep . && exit 1 || exit 0

pre-push:
  commands:

    checkov:
      run: checkov -d .

    trivy:
      run: trivy config .

    docs:
      run: terraform-docs markdown --output-file README.md ./terraform

    branch-name:
      skip: false
      run: |
        BRANCH=$(git rev-parse --abbrev-ref HEAD)
        echo "$BRANCH" | grep -qE "^(main|master|develop|staging)$" && exit 0
        PATTERN="^(feature|bugfix)\/[a-z0-9][a-z0-9-]*$"
        if ! echo "$BRANCH" | grep -qE "$PATTERN"; then
          echo ""
          echo "  Bad branch name: $BRANCH"
          echo ""
          echo "  Format:  type/description"
          echo "  Desc:    lowercase, numbers, hyphens only"
          echo ""
          echo "  Types:   feature bugfix"
          echo ""
          echo "  OK:      feature/add-login"
          echo "  OK:      bugfix/null-pointer-on-startup"
          echo "  FAIL:    feat/add-login   (use 'feature')"
          echo "  FAIL:    fix/something    (use 'bugfix')"
          echo ""
          exit 1
        fi

commit-msg:
  commands:
    semantic-commit:
      run: |
        MSG=$(head -n1 {1})
        echo "$MSG" | grep -qE "^Merge " && exit 0
        MAX_LEN=72
        MSG_LEN=${#MSG}
        if [ "$MSG_LEN" -gt "$MAX_LEN" ]; then
          echo ""
          echo "  Commit message too long: $MSG_LEN chars (max $MAX_LEN)"
          echo "  $MSG"
          echo ""
          exit 1
        fi
        PATTERN="^(feat|fix|docs|style|refactor|test|chore|ci)(\([a-z0-9-]+\))?: [a-z0-9][a-zA-Z0-9 [:punct:]-]*$"
        if ! echo "$MSG" | grep -qE "$PATTERN"; then
          echo ""
          echo "  Bad commit message: $MSG"
          echo ""
          echo "  Format:  type(scope): subject"
          echo "  Scope:   optional"
          echo "  Subject: lowercase, may contain letters, numbers, punctuation, hyphens"
          echo "  Max:     $MAX_LEN characters"
          echo ""
          echo "  Types:   feat fix docs style refactor test chore ci"
          echo ""
          echo "  OK:      feat(auth): add login endpoint"
          echo "  OK:      fix: resolve null-pointer on startup"
          echo "  FAIL:    Fix: Something  (uppercase)"
          echo ""
          exit 1
        fi