.pre-commit-config.yaml

exclude: "/migrations/|frontend/|.idea/|README.md|pytest.xml|pytest-coverage.txt"
default_stages: [pre-commit]

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v5.0.0
    hooks:
      - id: trailing-whitespace
      - id: end-of-file-fixer
      # Compose files carry Docker's own YAML tags (``!override``, ``!reset``),
      # which ``safe_load`` cannot construct -- so the default hook fails on a
      # perfectly valid compose file. Rather than weaken the check everywhere
      # with ``--unsafe``, compose files get a syntax-only pass (which still
      # catches malformed YAML, just without resolving tags) and everything
      # else stays strictly validated.
      - id: check-yaml
        name: check yaml
        exclude: ^(local|production|test)[\w.-]*\.ya?ml$
      - id: check-yaml
        name: check yaml (compose, syntax only)
        args: ["--unsafe"]
        files: ^(local|production|test)[\w.-]*\.ya?ml$

  - repo: local
    hooks:
      # Validate changelog fragments (changelog.d/<slug>.<type>.md). PRs add a
      # fragment instead of editing CHANGELOG.md directly, so concurrent PRs
      # never collide on the changelog. See changelog.d/README.md.
      - id: changelog-fragments
        name: validate changelog fragments
        entry: python scripts/collate_changelog.py --check
        language: system
        files: ^changelog\.d/
        pass_filenames: false

  - repo: https://github.com/asottile/pyupgrade
    rev: v3.20.0
    hooks:
      - id: pyupgrade
        args: [--py39-plus]

  - repo: https://github.com/psf/black
    rev: 26.1.0
    hooks:
      - id: black

  - repo: https://github.com/PyCQA/isort
    rev: 6.0.1
    hooks:
      - id: isort

  - repo: https://github.com/PyCQA/flake8
    rev: 7.2.0
    hooks:
      - id: flake8
        args: ["--config=setup.cfg"]
        # Both pins are load-bearing, for the reason spelled out on the mypy
        # hook below: `rev` is the only thing autoupdate bumps, and
        # additional_dependencies are re-resolved from scratch every time the
        # hook env is rebuilt, so an unpinned entry silently floats.
        # flake8-isort re-implements the isort check *inside* flake8 using
        # whatever isort it happens to resolve. Left unpinned it drifted to
        # isort 9.x while the standalone `isort` hook above stayed on the
        # 6.0.1 it is `rev`-pinned to. The two then disagreed about repeated
        # `from X import (...)` statements (the shape isort 6 itself emits for
        # aliased imports), so `isort` rewrote files into a layout `flake8`
        # rejected as I001/I005 — CI red on an unchanged tree.
        # isort here MUST track the `isort` hook's rev above.
        additional_dependencies:
          - flake8-isort==7.0.0
          - isort==6.0.1

  - repo: https://github.com/pre-commit/mirrors-mypy
    rev: v2.0.0
    hooks:
      - id: mypy
        # Always check the full project surface, not just staged files —
        # the Django plugin is a per-project load so partial runs miss
        # cross-module errors. See docs/typing/README.md.
        pass_filenames: false
        args: ["--config-file=mypy.ini", "opencontractserver", "config"]
        # mypy-django-plugin imports config.settings.mypy at startup, which
        # pulls in most of INSTALLED_APPS. Pinning the Django + stub runtime
        # here keeps the hook self-contained (contributors don't need the
        # full dev env installed locally).
        # pre-commit autoupdate only bumps `rev`; additional_dependencies
        # are resolved fresh every time the hook env is (re)built, so
        # anything less than `==` can drift. Direct dependencies whose
        # API surface mypy actually checks against are `==`-pinned and
        # MUST match requirements/base.txt + requirements/local.txt. The
        # admin autodiscover that django-stubs triggers transitively
        # imports most of the project, which is why the list is long.
        # A handful of transitive deps (python-docx, openpyxl,
        # python-pptx, spacy) are left unpinned or range-pinned — they
        # are import-only (mypy never follows into their types with
        # ignore_missing_imports=True), so a compatible bump cannot
        # introduce new type errors. Range pins upper-bound known
        # major breakages (e.g. pypdf 7, openai 3) for the same reason.
        additional_dependencies:
          # --- Type stubs -----------------------------------------------
          - django-stubs==6.1.0
          - djangorestframework-stubs==3.18.0
          - types-requests==2.33.0.20260408
          - types-PyYAML==6.0.12.20260408
          # --- Django runtime (must match requirements/base.txt) --------
          - django==5.2.13
          - django-environ==0.13.0
          - django-redis==6.0.0
          - django-filter==25.1
          - django-storages[boto3,google]==1.14.6
          - django-tree-queries[admin]==0.24.0
          - django-cte==3.0.0
          - django-guardian==3.3.1
          - django-celery-beat==2.9.0
          - django-cors-headers==4.9.0
          - djangorestframework==3.17.1
          - drf-extra-fields==3.7.0
          - whitenoise==6.12.0
          - channels==4.3.2
          - channels-redis==4.3.0
          - daphne==4.2.1
          - celery==5.6.3
          - pgvector==0.4.2
          - strawberry-graphql==0.323.2
          - pydantic==2.13.3
          - psycopg2-binary==2.9.11
          # --- Pulled in transitively by app admin autodiscover ---------
          - Pillow>=10.4.0
          - pypdf>=4.0.0,<7
          - plasmapdf==0.1.3
          - pdfplumber>=0.10.0
          - pdf2image>=1.16.0
          - shapely>=2.0.0
          - opencv-python-headless==4.13.0.92
          - filetype==1.2.0
          - python-docx
          - openpyxl
          - python-pptx
          - openai>=2.11.0,<3
          # Mirrors the narrow-extras pin in requirements/base.txt; using the
          # bare ``pydantic-ai`` meta-package would fan out to all ~20
          # provider extras and break this hook the moment any one of those
          # provider SDKs disappears from PyPI (see the mistralai 404 on
          # 2026-05-12). Keep this extras list in lockstep with base.txt.
          - pydantic-ai-slim[openai,anthropic,google,mcp]>=1.56.0,<2
          # NOT from base.txt: anthropic is a direct requirement of
          # requirements/analyzers/claude_highlighter.txt, which both
          # Dockerfiles glob into the image. Mirrored here so mypy checks the
          # same major the image ships -- without it this hook resolves
          # anthropic transitively and independently, which is how 1.0.0
          # turned main red with no commit touching the code. The ceiling is
          # <1, not <2 (1.0.0 satisfies <2). Keep in lock-step with that file;
          # migration off the 0.x line is tracked in #2273.
          - anthropic>=0.45.2,<1
          - spacy
          - tokenizers>=0.21,<0.23
          - posthog==7.12.0
          # Range matches requirements/base.txt's runtime pin exactly.
          # opencontractserver/mcp/server.py targets the python-sdk 2.x
          # API (on_*= handler kwargs, snake_case type fields); a hook env
          # resolving a different major than the runtime turns main red
          # with no commit touching mcp. Bump both pins together.
          - mcp>=2.2.0,<3
          - argon2-cffi==25.1.0
          - cryptography==46.0.7
          - pyjwt==2.12.1
          - requests>=2.32.2
          - httpx>=0.27.0,<1
          - redis==7.4.0

# sets up .pre-commit-ci.yaml to ensure pre-commit dependencies stay up to date
ci:
  autoupdate_schedule: weekly
  skip: []
  submodules: false