exclude: ^backups/
repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.15.8
    hooks:
      - id: ruff
        args: [--fix]
      - id: ruff-format

  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: v1.19.1
    hooks:
      - id: mypy
        files: ^src/engram/
        args: [--ignore-missing-imports]
        additional_dependencies: [types-PyYAML]

  - repo: https://github.com/semgrep/semgrep
    rev: v1.155.0
    hooks:
      - id: semgrep
        args: ['--config', 'p/python', '--config', 'p/secrets', '--error']

  - repo: local
    hooks:
      - id: no-env-files
        name: Block .env files
        entry: bash -c 'for f in "$@"; do if [[ "$f" == *.env || "$f" == *.env.* ]]; then echo "BLOCKED $f"; exit 1; fi; done' --
        language: system
        types: [file]
      - id: no-passwords
        name: Check for obvious passwords
        entry: bash -c 'if grep -PnE "(password|passwd|secret)\s*=\s*[^#\n]{4,}" "$@"; then exit 1; fi; exit 0' --
        language: system
        types: [python]
        exclude: ^(docs|config|tests)/
