repos:
  # =============================================================================
  # Ruff (lint + import sorting + formatting)
  # =============================================================================
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.4.4
    hooks:
      - id: ruff
        args: [--fix, --exit-non-zero-on-fix]
      - id: ruff-format

  # =============================================================================
  # Base repository hygiene
  # =============================================================================
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.6.0
    hooks:
      - id: check-yaml
        args: [--allow-multiple-documents]
      - id: check-json
      - id: check-toml
      - id: end-of-file-fixer
      - id: trailing-whitespace
      - id: check-merge-conflict
      - id: detect-private-key
      - id: check-added-large-files
      - id: debug-statements
      - id: check-executables-have-shebangs
      - id: requirements-txt-fixer

  # =============================================================================
  # Static typing
  # =============================================================================
  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: v1.10.0
    hooks:
      - id: mypy
        args: [--ignore-missing-imports]

  # =============================================================================
  # Security checks
  # =============================================================================
  - repo: https://github.com/PyCQA/bandit
    rev: 1.7.8
    hooks:
      - id: bandit
        args: ["-r", "src"]

  # =============================================================================
  # Secret detection
  # =============================================================================
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.5.0
    hooks:
      - id: detect-secrets