diff --git a/.golangci.yml b/.golangci.yml index 5f3e527..e40a39e 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -99,46 +99,28 @@ linters: - govet text: "unusedwrite" path: _test\.go - - linters: - - errcheck - - gosec - path: internal/testutil/ - linters: - all path: .*_gen\.go - # revive var-naming: "api" is an intentional package name for the HTTP API - # layer; it is not a utility package and "avoid meaningless package names" - # is a false positive here. All 88+ files in internal/api use this name. - - linters: - - revive - path: internal/api/ - text: "avoid meaningless package names" # revive var-naming: "common" is the established public package name in # the nested pkg module; renaming it would break unaliased consumers. - linters: - revive path: ^pkg/common/ text: "avoid meaningless package names" - # noctx: exec.Command calls in configure CLI helpers intentionally - # omit context (CommandRunner interface contract; operator-controlled inputs). - # Suppressed per-file rather than per-line so #nosec G204 can lead the comment. - - linters: - - noctx - path: (cmd/configure_gcp|cmd/configure_azure)\.go # noctx: http.Get and net.Listen in test helpers appropriately use the # background context; threading a test context through every helper would # add noise without improving test correctness. - linters: - noctx path: _test\.go - # misspell: "cancelled" is the canonical DB column name (migration 000035, - # UK spelling throughout; migration #1277 tracks the rename). "initialised" - # appears in established comments in internal/config/types.go matching the - # existing UK convention. Allow both spellings in the files listed below. + # misspell: "cancelled" is the canonical stored status value in + # pkg/ladder (RunStatusCancelled, TrancheStatusCancelled); allow the UK + # spelling in the files that carry it. - linters: - misspell - path: (internal/config/(store_postgres|store_postgres_pgxmock_test|store_postgres_ladder|types|interfaces)|pkg/ladder/(store|types_test)|internal/api/(handler_history|handler_ri_exchange(_test)?|router_handlers_test|coverage_extras_test)|internal/mocks/stores|internal/purchase/scheduled_fire_test)\.go - text: "cancelled|initialised" + path: pkg/ladder/(store|types_test)\.go + text: "cancelled" paths: - third_party$ - builtin$ diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 9f0c3d9..e14c280 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -28,19 +28,6 @@ repos: pass_filenames: false files: \.go$ - # Terraform formatting - - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: d0e12caebb2ab0ee8bf98181c8bfe9702bca103d # v1.105.0 - hooks: - - id: terraform_fmt - name: Terraform format - - id: terraform_validate - name: Terraform validate - - id: terraform_tflint - name: Terraform lint - args: - - --args=--config=__GIT_WORKING_DIR__/.tflint.hcl - # General file checks - repo: https://github.com/pre-commit/pre-commit-hooks rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0 @@ -53,7 +40,7 @@ repos: exclude: '^\.github/golangci/' - id: check-yaml name: Check YAML syntax - exclude: '^(docker-compose.*\.yml|\.github/workflows/.*|cloudformation/.*|iac/.*/cloudformation/.*)$' + exclude: '^\.github/workflows/.*$' - id: check-json name: Check JSON syntax exclude: '^\.github/golangci/' @@ -191,66 +178,20 @@ repos: # installs trivy v0.69.3 via the workflow step in # .github/workflows/pre-commit.yml, so PRs are always scanned # regardless of a developer's local setup. - # - # `**/.terraform` is skipped because it is a gitignored, generated - # local cache (downloaded provider schemas + cached plan snapshots - # from `terraform init`) — never committed and never present in CI - # (which checks out from git), so findings there are local-only - # false positives on third-party provider cache, not on our source. - # The actual terraform module source files are still fully scanned. - entry: bash -c 'trivy config --severity HIGH,CRITICAL --exit-code 1 --skip-dirs terraform/environments/aws --skip-dirs "**/.terraform" --skip-dirs .claude .' - language: system - pass_filenames: false - - # Migration checks - - repo: local - hooks: - - id: check-migration-conflicts - name: Check for conflicting migration numbers - entry: bash -c 'dups=$(ls internal/database/postgres/migrations/*.up.sql 2>/dev/null | sed "s/.*\///" | cut -c1-6 | sort | uniq -d); if [ -n "$dups" ]; then echo "Duplicate migration number(s) found:"; echo "$dups"; exit 1; fi' + entry: bash -c 'trivy config --severity HIGH,CRITICAL --exit-code 1 --skip-dirs .claude .' language: system pass_filenames: false - files: ^internal/database/postgres/migrations/ - - # Permissions codegen: regenerate frontend/src/permissions.generated.ts - # from internal/auth/types.go and fail if the committed copy is stale. - # Triggers on changes to the backend defaults or the generator itself, - # plus the generated file (in case a dev hand-edits it). - - repo: local - hooks: - - id: permissions-codegen - name: Regenerate frontend permissions from Go defaults - entry: bash -c 'go run ./cmd/gen-permissions && git diff --exit-code -- frontend/src/permissions.generated.ts || { echo "permissions.generated.ts is stale. Run go run ./cmd/gen-permissions and commit the result."; exit 1; }' - language: system - pass_filenames: false - files: ^(internal/auth/types\.go|cmd/gen-permissions/.*\.go|frontend/src/permissions\.generated\.ts)$ # Heavy test execution: pre-push stage only. # - # These three hooks rebuild + run the full Go and frontend test suites, - # which is ~6-7 min of work and the bulk of the CI pre-commit job's - # runtime. They are *redundant in CI* — the same suites are run by - # dedicated workflows that PRs and pushes already trigger: - # - # - go-test (-short -race ./...) : ci.yml `unit-tests` runs the same - # suite with -race AND an integration - # pass with -tags=integration. - # - frontend-build (npm run build): frontend-build.yml runs npm run - # typecheck + npm run build on PRs; - # frontend-build-sentinel.yml runs - # the build on every push to main / - # feat/**. - # - frontend-test (jest) : frontend-build-sentinel.yml runs - # `npx jest --no-coverage --silent` - # on every push to feat/** (which - # fires on every PR-branch update). - # - # Moving them to the pre-push stage keeps the local safety net (devs - # who run `pre-commit install --hook-type pre-push` still get these - # tests on `git push`) while letting the CI pre-commit workflow stay - # focused on style/security/syntax. Pre-commit's default stage filter - # is `pre-commit`, so the CI workflow's `pre-commit run --all-files` - # skips these hooks automatically. + # This hook rebuilds + runs the full Go test suite, which is the bulk of + # the CI pre-commit job's runtime. It is *redundant in CI*: ci.yml + # `unit-tests` runs the same suite with -race AND an integration pass with + # -tags=integration. Keeping it on the pre-push stage preserves the local + # safety net (devs who run `pre-commit install --hook-type pre-push` still + # get it on `git push`) while the CI pre-commit workflow stays focused on + # style/security/syntax. Pre-commit's default stage filter is `pre-commit`, + # so `pre-commit run --all-files` skips it automatically. - repo: local hooks: - id: go-test @@ -261,22 +202,6 @@ repos: files: \.go$ stages: [pre-push] - - id: frontend-build - name: Build frontend (pre-push only; CI covers via frontend-build.yml) - entry: bash -c 'cd frontend && npm run build' - language: system - pass_filenames: false - files: ^frontend/src/ - stages: [pre-push] - - - id: frontend-test - name: Run frontend tests (pre-push only; CI covers via frontend-build-sentinel.yml) - entry: bash -c 'cd frontend && npx jest --no-coverage --silent' - language: system - pass_filenames: false - files: ^frontend/src/ - stages: [pre-push] - # Global configuration default_install_hook_types: [pre-commit, pre-push] default_stages: [pre-commit, pre-push]