RAG_Support_Assistant/.pre-commit-config.yaml at master · brownjuly2003-code/RAG_Support_Assistant · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.15.11
    hooks:
      - id: ruff-check
        args: [--fix]
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v6.0.0
    hooks:
      - id: trailing-whitespace
        exclude: ^(?:archive/|archive-legacy/|docs/audits/audit_opus_.*\.md$|codex-tasks/Archive/|docs/research/|docs/superpowers/specs/)
      - id: end-of-file-fixer
        exclude: ^(?:archive/|archive-legacy/|codex-tasks/Archive/|docs/research/|docs/superpowers/specs/|reports/|vectordb/__init__\.py$)
      - id: check-yaml
        exclude: ^deploy/helm/templates/
      - id: check-toml
      - id: check-added-large-files
        args: [--maxkb=500]
      - id: check-merge-conflict
      - id: detect-private-key
        exclude: ^(?:codex-tasks/cleanup-report\.md$|codex-tasks/Archive/task-126-hygiene-consistency-audit\.md$)

  - repo: https://github.com/PyCQA/bandit
    rev: 1.9.4
    hooks:
      - id: bandit
        args: ["-r", "-ll", "-c", "pyproject.toml"]
        additional_dependencies: ["bandit[toml]"]
        # Block commits on Medium+ severity findings only (Low triggers at the
        # CLI level: `bandit -r . -l -c pyproject.toml` for full scan).

  - repo: https://github.com/pypa/pip-audit
    rev: v2.10.0
    hooks:
      - id: pip-audit
        args: ["--strict", "--disable-pip", "--require-hashes", "--timeout", "15", "--progress-spinner", "off", "--cache-dir", ".tmp/pip-audit-cache", "--ignore-vuln", "CVE-2026-45829", "--ignore-vuln", "GHSA-f4j7-r4q5-qw2c", "--ignore-vuln", "CVE-2025-3000", "-r", "requirements.lock"]
        files: ^(?:requirements(?:-dev)?\.(?:txt|lock)|\.pre-commit-config\.yaml)$
        pass_filenames: false
        # Audit the generated lock only. requirements.txt is intentionally
        # loose and sends pip-audit through pip resolution. Use a repo-local
        # ignored cache to avoid hangs in the default pip cache location.
        # CVE-2026-45829/GHSA-f4j7-r4q5-qw2c has no fixed ChromaDB release yet;
        # the app does not expose the affected Chroma server API.
        # CVE-2025-3000 (torch): local memory corruption in torch.jit.script,
        # no fixed release as of 2026-06-12. torch is used only for local
        # sentence-transformers inference; torch.jit.script is never fed
        # untrusted input. Drop this ignore once an upstream fix ships.