default_language_version:
  node: 18.15.0

repos:
  # EOF and whitespace checker
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.4.0
    hooks:
      - id: end-of-file-fixer
        exclude: |
          (?x)^(
              site/.*|
              tests/assets/.*
          )$

  # Ruff
  - repo: https://github.com/charliermarsh/ruff-pre-commit
    rev: "v0.5.0"
    hooks:
      - id: ruff
        exclude: "tests"

  # python code formatting
  - repo: https://github.com/psf/black
    rev: 23.1.0
    hooks:
      - id: black

  # Sort Python import
  - repo: https://github.com/pycqa/isort
    rev: 5.11.5
    hooks:
      - id: isort
        name: isort (python)

  # TODO: Enable mypy as soon as possible
  # python static type checking
  # - repo: https://github.com/pre-commit/mirrors-mypy
  #   rev: "v1.0.1"
  #   hooks:
  #     - id: mypy
  #       additional_dependencies: [types-PyYAML]
  #       exclude: "tests"

  # markdown linting
  - repo: https://github.com/igorshubovych/markdownlint-cli
    rev: v0.33.0
    hooks:
      - id: markdownlint
        args: [--config=.markdownlint.yaml]

  # Git conflict marker
  # FIXME: Disabled because it triggers false positives in .rst files.
  # - repo: https://github.com/jumanjihouse/pre-commit-hooks
  #   rev: 3.0.0
  #   hooks:
  #     - id: git-check # Configure in .gitattributes

  # notebooks
  - repo: https://github.com/nbQA-dev/nbQA
    rev: 1.8.5
    hooks:
      - id: nbqa-black
      - id: nbqa-ruff
        additional_dependencies: [ruff==0.4.10]

  # zizmor detects security issues in GitHub Actions workflows.
  - repo: https://github.com/woodruffw/zizmor-pre-commit
    rev: v1.11.0
    hooks:
      - id: zizmor
        args: ["--min-severity", "low", "--min-confidence", "low"]

  # add bandit for security checks
  - repo: https://github.com/PyCQA/bandit
    rev: 1.8.3
    hooks:
      - id: bandit
        args:
          [
            "-c",
            "pyproject.toml",
            "--severity-level",
            "all",
            "--confidence-level",
            "all",
          ]
        additional_dependencies: ["bandit[toml]"]