chore: prune monorepo-only config from golangci and pre-commit

.golangci.yml

@@ -99,46 +99,28 @@ linters:
           - govet
         text: "unusedwrite"
         path: _test\.go
-      - linters:
-          - errcheck
-          - gosec
-        path: internal/testutil/
       - linters:
           - all
         path: .*_gen\.go
-      # revive var-naming: "api" is an intentional package name for the HTTP API
-      # layer; it is not a utility package and "avoid meaningless package names"
-      # is a false positive here. All 88+ files in internal/api use this name.
-      - linters:
-          - revive
-        path: internal/api/
-        text: "avoid meaningless package names"
       # revive var-naming: "common" is the established public package name in
       # the nested pkg module; renaming it would break unaliased consumers.
       - linters:
           - revive
         path: ^pkg/common/
         text: "avoid meaningless package names"
-      # noctx: exec.Command calls in configure CLI helpers intentionally
-      # omit context (CommandRunner interface contract; operator-controlled inputs).
-      # Suppressed per-file rather than per-line so #nosec G204 can lead the comment.
-      - linters:
-          - noctx
-        path: (cmd/configure_gcp|cmd/configure_azure)\.go
       # noctx: http.Get and net.Listen in test helpers appropriately use the
       # background context; threading a test context through every helper would
       # add noise without improving test correctness.
       - linters:
           - noctx
         path: _test\.go
-      # misspell: "cancelled" is the canonical DB column name (migration 000035,
-      # UK spelling throughout; migration #1277 tracks the rename). "initialised"
-      # appears in established comments in internal/config/types.go matching the
-      # existing UK convention. Allow both spellings in the files listed below.
+      # misspell: "cancelled" is the canonical stored status value in
+      # pkg/ladder (RunStatusCancelled, TrancheStatusCancelled); allow the UK
+      # spelling in the files that carry it.
       - linters:
           - misspell
-        path: (internal/config/(store_postgres|store_postgres_pgxmock_test|store_postgres_ladder|types|interfaces)|pkg/ladder/(store|types_test)|internal/api/(handler_history|handler_ri_exchange(_test)?|router_handlers_test|coverage_extras_test)|internal/mocks/stores|internal/purchase/scheduled_fire_test)\.go
-        text: "cancelled|initialised"
+        path: pkg/ladder/(store|types_test)\.go
+        text: "cancelled"
     paths:
       - third_party$
       - builtin$

.pre-commit-config.yaml

@@ -28,19 +28,6 @@ repos:
         pass_filenames: false
         files: \.go$
 
-  # Terraform formatting
-  - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: d0e12caebb2ab0ee8bf98181c8bfe9702bca103d # v1.105.0
-    hooks:
-      - id: terraform_fmt
-        name: Terraform format
-      - id: terraform_validate
-        name: Terraform validate
-      - id: terraform_tflint
-        name: Terraform lint
-        args:
-          - --args=--config=__GIT_WORKING_DIR__/.tflint.hcl
-
   # General file checks
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0
@@ -53,7 +40,7 @@ repos:
         exclude: '^\.github/golangci/'
       - id: check-yaml
         name: Check YAML syntax
-        exclude: '^(docker-compose.*\.yml|\.github/workflows/.*|cloudformation/.*|iac/.*/cloudformation/.*)$'
+        exclude: '^\.github/workflows/.*$'
       - id: check-json
         name: Check JSON syntax
         exclude: '^\.github/golangci/'
@@ -191,66 +178,20 @@ repos:
         # installs trivy v0.69.3 via the workflow step in
         # .github/workflows/pre-commit.yml, so PRs are always scanned
         # regardless of a developer's local setup.
-        #
-        # `**/.terraform` is skipped because it is a gitignored, generated
-        # local cache (downloaded provider schemas + cached plan snapshots
-        # from `terraform init`) — never committed and never present in CI
-        # (which checks out from git), so findings there are local-only
-        # false positives on third-party provider cache, not on our source.
-        # The actual terraform module source files are still fully scanned.
-        entry: bash -c 'trivy config --severity HIGH,CRITICAL --exit-code 1 --skip-dirs terraform/environments/aws --skip-dirs "**/.terraform" --skip-dirs .claude .'
-        language: system
-        pass_filenames: false
-
-  # Migration checks
-  - repo: local
-    hooks:
-      - id: check-migration-conflicts
-        name: Check for conflicting migration numbers
-        entry: bash -c 'dups=$(ls internal/database/postgres/migrations/*.up.sql 2>/dev/null | sed "s/.*\///" | cut -c1-6 | sort | uniq -d); if [ -n "$dups" ]; then echo "Duplicate migration number(s) found:"; echo "$dups"; exit 1; fi'
+        entry: bash -c 'trivy config --severity HIGH,CRITICAL --exit-code 1 --skip-dirs .claude .'
         language: system
         pass_filenames: false
-        files: ^internal/database/postgres/migrations/
-
-  # Permissions codegen: regenerate frontend/src/permissions.generated.ts
-  # from internal/auth/types.go and fail if the committed copy is stale.
-  # Triggers on changes to the backend defaults or the generator itself,
-  # plus the generated file (in case a dev hand-edits it).
-  - repo: local
-    hooks:
-      - id: permissions-codegen
-        name: Regenerate frontend permissions from Go defaults
-        entry: bash -c 'go run ./cmd/gen-permissions && git diff --exit-code -- frontend/src/permissions.generated.ts || { echo "permissions.generated.ts is stale. Run go run ./cmd/gen-permissions and commit the result."; exit 1; }'
-        language: system
-        pass_filenames: false
-        files: ^(internal/auth/types\.go|cmd/gen-permissions/.*\.go|frontend/src/permissions\.generated\.ts)$
 
   # Heavy test execution: pre-push stage only.
   #
-  # These three hooks rebuild + run the full Go and frontend test suites,
-  # which is ~6-7 min of work and the bulk of the CI pre-commit job's
-  # runtime. They are *redundant in CI* — the same suites are run by
-  # dedicated workflows that PRs and pushes already trigger:
-  #
-  #   - go-test (-short -race ./...)  : ci.yml `unit-tests` runs the same
-  #                                     suite with -race AND an integration
-  #                                     pass with -tags=integration.
-  #   - frontend-build (npm run build): frontend-build.yml runs npm run
-  #                                     typecheck + npm run build on PRs;
-  #                                     frontend-build-sentinel.yml runs
-  #                                     the build on every push to main /
-  #                                     feat/**.
-  #   - frontend-test (jest)          : frontend-build-sentinel.yml runs
-  #                                     `npx jest --no-coverage --silent`
-  #                                     on every push to feat/** (which
-  #                                     fires on every PR-branch update).
-  #
-  # Moving them to the pre-push stage keeps the local safety net (devs
-  # who run `pre-commit install --hook-type pre-push` still get these
-  # tests on `git push`) while letting the CI pre-commit workflow stay
-  # focused on style/security/syntax. Pre-commit's default stage filter
-  # is `pre-commit`, so the CI workflow's `pre-commit run --all-files`
-  # skips these hooks automatically.
+  # This hook rebuilds + runs the full Go test suite, which is the bulk of
+  # the CI pre-commit job's runtime. It is *redundant in CI*: ci.yml
+  # `unit-tests` runs the same suite with -race AND an integration pass with
+  # -tags=integration. Keeping it on the pre-push stage preserves the local
+  # safety net (devs who run `pre-commit install --hook-type pre-push` still
+  # get it on `git push`) while the CI pre-commit workflow stays focused on
+  # style/security/syntax. Pre-commit's default stage filter is `pre-commit`,
+  # so `pre-commit run --all-files` skips it automatically.
   - repo: local
     hooks:
       - id: go-test
@@ -261,22 +202,6 @@ repos:
         files: \.go$
         stages: [pre-push]
 
-      - id: frontend-build
-        name: Build frontend (pre-push only; CI covers via frontend-build.yml)
-        entry: bash -c 'cd frontend && npm run build'
-        language: system
-        pass_filenames: false
-        files: ^frontend/src/
-        stages: [pre-push]
-
-      - id: frontend-test
-        name: Run frontend tests (pre-push only; CI covers via frontend-build-sentinel.yml)
-        entry: bash -c 'cd frontend && npx jest --no-coverage --silent'
-        language: system
-        pass_filenames: false
-        files: ^frontend/src/
-        stages: [pre-push]
-
 # Global configuration
 default_install_hook_types: [pre-commit, pre-push]
 default_stages: [pre-commit, pre-push]