59 lines
2.1 KiB
YAML
59 lines
2.1 KiB
YAML
|
# B4.3 — the fast gates, before the commit rather than after the push.
|
||
|
|
#
|
||
|
|
# Only checks that run in about a second belong here. The characterization
|
||
|
|
# suite, the cross-tenant probes and the query budgets need a database and take
|
||
|
|
# a minute; they stay in CI. A pre-commit hook that takes a minute gets
|
||
|
|
# `--no-verify`d, and then none of it runs.
|
||
|
|
#
|
||
|
|
# pip install pre-commit && pre-commit install
|
||
|
|
#
|
||
|
|
# Everything here is also enforced in CI, so an uninstalled hook is a slower
|
||
|
|
# feedback loop rather than a hole.
|
||
|
|
|
||
|
|
repos:
|
||
|
|
- repo: https://github.com/pre-commit/pre-commit-hooks
|
||
|
|
rev: v5.0.0
|
||
|
|
hooks:
|
||
|
|
- id: trailing-whitespace
|
||
|
|
- id: end-of-file-fixer
|
||
|
|
- id: check-yaml
|
||
|
|
- id: check-json
|
||
|
|
- id: check-toml
|
||
|
|
- id: check-merge-conflict
|
||
|
|
- id: check-added-large-files
|
||
|
|
args: [--maxkb=512]
|
||
|
|
- id: detect-private-key
|
||
|
|
|
||
|
|
- repo: local
|
||
|
|
hooks:
|
||
|
|
# The three rules that are cheap to check and expensive to discover late.
|
||
|
|
- id: no-exception-text-in-responses
|
||
|
|
name: No exception text in HTTP responses
|
||
|
|
entry: python -m pytest tests/probes/test_error_disclosure.py::test_no_exception_text_is_returned_to_callers -q
|
||
|
|
language: system
|
||
|
|
pass_filenames: false
|
||
|
|
files: ^app/.*\.py$
|
||
|
|
description: >
|
||
|
|
`detail=f"...{e}"` sends internal errors to the caller. It reached an
|
||
|
|
unauthenticated endpoint once already.
|
||
|
|
|
||
|
|
- id: transaction-discipline
|
||
|
|
name: Route handlers do not commit
|
||
|
|
entry: python -m pytest tests/probes/test_transaction_discipline.py -q
|
||
|
|
language: system
|
||
|
|
pass_filenames: false
|
||
|
|
files: ^app/.*\.py$
|
||
|
|
description: >
|
||
|
|
The request owns the transaction. A handler that commits splits one
|
||
|
|
request into several and leaves partial state behind on failure.
|
||
|
|
|
||
|
|
- id: layering
|
||
|
|
name: Import layering contracts
|
||
|
|
entry: lint-imports
|
||
|
|
language: system
|
||
|
|
pass_filenames: false
|
||
|
|
files: ^app/.*\.py$
|
||
|
|
description: >
|
||
|
|
routes → controllers → services → repositories → models, one
|
||
|
|
direction only.
|