dx/.pre-commit-config.yaml at main · pagopa/dx · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
repos:
  - repo: local
    hooks:
      - id: lock_modules
        name: Lock Terraform Registry modules
        description: "Locks Terraform module versions and maintains hashes"
        entry: infra/scripts/lock-modules.sh
        language: script
        files: '\.tf$'
        exclude: ^.*/(provider|modules)(/.*)?$
        pass_filenames: true
        require_serial: true
      - id: terraform_providers_lock_staged
        name: Terraform Providers Lock (on staged .terraform.lock.hcl files)
        entry: infra/scripts/terraform_lock_precommit.sh
        language: script
        pass_filenames: false
        verbose: true
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.105.0
    hooks:
      - id: terraform_fmt
      - id: terraform_docs
        name: terraform_docs on modules
        args:
          - --hook-config=--create-file-if-not-exist=true
          - --args=--hide providers
          - --args=--lockfile=false
        files: ^infra/(?:.*/)?_?modules/[^/]+/[^/]+\.tf$
        exclude: ^infra/(?:.*/)?_?modules/[^/]+/(examples|tests|example)/.*
      - id: terraform_tflint
        args:
          - --args=--disable-rule terraform_required_version
          - --args=--disable-rule terraform_required_providers
          - --args=--config=__GIT_WORKING_DIR__/.tflint.hcl
        exclude: ^providers/.*
      - id: terraform_validate
        args:
          - --args=-json
          - --args=-no-color
          - --hook-config=--retry-once-with-cleanup=true
        exclude: ^providers/.*|.*/examples?(/|$)
      - id: terraform_trivy
        args:
          - --args=--skip-dirs="**/.terraform"
          - --args=--skip-dirs="**/tests/apps/network_access"
          - --args=--ignorefile=__GIT_WORKING_DIR__/.trivyignore
          - --args=--config-check=__GIT_WORKING_DIR__/.trivy/checks/terraform
          - --args=--check-namespaces=user
          - --args=--raw-config-scanners=terraform
          - --args=--tf-exclude-downloaded-modules
          - --hook-config=--parallelism-limit=1