automated-security-helper/.pre-commit-config.yaml at main · awslabs/automated-security-helper · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
# See https://pre-commit.com for more information
# See https://pre-commit.com/hooks.html for more hooks
repos:
  - repo: local
    hooks:
      - id: generate-schemas
        name: Generate ASH JSON schemas
        entry: uv run python -m automated_security_helper.schemas.generate_schemas
        language: system
        verbose: true
        pass_filenames: false
      # Runs in --fix mode, so a pyproject bump repairs the duplicated constant in
      # the same commit that causes the drift. That is the point: the CI gate and
      # test_fallback_matches_installed_metadata both only ever *reported* it, and
      # a human edited the constant by hand on every dependabot bump.
      #
      # --python 3.13 is explicit because the script needs tomllib (3.11+) while
      # requires-python starts at 3.10. It never runs inside ASH, so that is a
      # constraint on this hook and not on the supported interpreter range -- which
      # is the whole reason this is codegen rather than a runtime pyproject read.
      - id: sync-cdk-extra-fallback
        name: Sync the cdk extra fallback constant with pyproject
        entry: uv run --python 3.13 python scripts/sync_cdk_extra_fallback.py --fix
        language: system
        verbose: true
        pass_filenames: false
        files: ^(pyproject\.toml|automated_security_helper/plugin_modules/ash_builtin/scanners/cdk_nag_scanner\.py|scripts/sync_cdk_extra_fallback\.py)$
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v5.0.0
    hooks:
      - id: pretty-format-json
        # deploy/cdk/templates/*.template.json is `cdk synth` output, and CDK
        # decides its whitespace. `Stack._synthesizeTemplate` indents by ONE space,
        # not two, so this hook and CDK disagree about these files by default --
        # nothing exotic is needed to make them conflict. A contributor running
        # pre-commit would reindent them to two spaces and fail the IaC drift gate,
        # which compares the committed bytes to a fresh synth.
        #
        # Excluded rather than reformatted for the same reason any generated file is:
        # the generator owns the format. Only the generated pattern is excluded, so a
        # hand-authored JSON file added beside them is still formatted.
        #
        # The exclusion predates this comment and briefly had a second justification:
        # `@aws-cdk/core:suppressTemplateIndentation` was set for a while to buy bytes
        # against CloudFormation's 51,200-byte inline `--template-body` cap, which
        # made the templates single-line and the conflict starker. That flag is gone
        # (single-line JSON crashes trivy -- see the header of
        # deploy/cdk/test/ash-template-size.test.ts), and the exclusion is still
        # needed without it.
        exclude: '\.vscode/.*|^deploy/cdk/templates/.*\.template\.json'
        args:
          - "--autofix"
          - "--indent=2"
  - repo: https://github.com/commitizen-tools/commitizen
    rev: v4.8.3
    hooks:
      - id: commitizen
        stages: [commit-msg]
  - repo: https://github.com/astral-sh/ruff-pre-commit
    # Ruff version.
    rev: v0.11.8
    hooks:
      # Run the linter.
      - id: ruff
        args: [--fix]
      # Run the formatter.
      - id: ruff-format

  # Local ASH development hooks to help validate ASH is running as expected with
  # local versions
  - repo: local
    hooks:
      - id: ash
        name: (manual) ASH dev manual scan
        description: Runs various code scanners from Python directly
        entry: uv run ash --mode=precommit
        pass_filenames: false
        verbose: true
        language: system
        args:
          - --output-dir=.ash/ash_output_precommit_local
  # - repo: https://github.com/awslabs/automated-security-helper
  #   rev: v3.0.0-beta
  #   hooks:
  #     - id: ash-simple-scan
  #       args:
  #         ## REQUIRED ARGS
  #         # N/A - ASH pre-commit hooks include `--mode=precommit` by default.
  #         # The only ARGS needed are custom args past what is available by default.
  #         ## EXTRA ARGS (these are specific to this repo's usage of the hook and are not required)
  #         # Default output-dir is `.ash/ash_output`, customize if preferred.
  #         # This is to allow the pre-commit runs of ASH to not collide with the
  #         # manual runs so results are retained independently.
  #         - --output-dir=.ash/ash_output_precommit