# Pre-Commit Hooks Security Checklist

Security checks for pre-commit hook configuration. Ensures mandatory
secret-scanning and recommended linting hooks are present and version-pinned.

---

## Check: .pre-commit-config.yaml present

- **Priority**: Critical
- **What to look for**: Absence of `.pre-commit-config.yaml` at the repository root.
- **Pass condition**: `.pre-commit-config.yaml` exists at the repo root.
- **Fail example**:
  ```
  # No .pre-commit-config.yaml file at repo root
  ```
- **Remediation**: Create `.pre-commit-config.yaml` at the repo root. Install
  pre-commit (`uv add --dev pre-commit`) and activate hooks (`pre-commit install`).
  Run `pre-commit autoupdate` after creating this file to pin hooks to their latest released versions.
  ```yaml
  # .pre-commit-config.yaml (minimal secure baseline)
  repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.21.2
    hooks:
      - id: gitleaks
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.15.1
    hooks:
      - id: ruff
        args: [--fix]
      - id: ruff-format
  ```
- **Source**: Gemma internal standard (2026-04-16)

---

## Check: gitleaks hook configured

- **Priority**: Critical
- **What to look for**: No hook with `id: gitleaks` in any `repos` entry of
  `.pre-commit-config.yaml`.
- **Pass condition**: At least one hook entry with `id: gitleaks` is present. The
  parent repo URL is not verified — a fork named `gitleaks` would also pass. In
  Gemma repos the canonical `github.com/gitleaks/gitleaks` source is assumed.
- **Fail example**:
  ```yaml
  repos:
    - repo: https://github.com/astral-sh/ruff-pre-commit
      rev: v0.15.1
      hooks:
        - id: ruff
  # gitleaks hook is absent
  ```
- **Remediation**: Add gitleaks to `.pre-commit-config.yaml`.
  ```yaml
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.21.2
    hooks:
      - id: gitleaks
  ```
- **Source**: Gemma internal standard (2026-04-16)

---

## Check: ruff hook configured

- **Priority**: Recommended
- **What to look for**: No hook with `id: ruff` or `id: ruff-format` in any
  `repos` entry of `.pre-commit-config.yaml`.
- **Pass condition**: At least one hook entry with `id: ruff` or `id: ruff-format`
  is present.
- **Fail example**:
  ```yaml
  repos:
    - repo: https://github.com/gitleaks/gitleaks
      rev: v8.21.2
      hooks:
        - id: gitleaks
  # ruff hook is absent
  ```
- **Remediation**: Add ruff to `.pre-commit-config.yaml`.
  ```yaml
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: v0.15.1
    hooks:
      - id: ruff
        args: [--fix]
      - id: ruff-format
  ```
- **Source**: Gemma internal standard (2026-04-16)

---

## Check: All rev values pinned to specific versions

- **Priority**: Important
- **What to look for**: Any `rev:` field set to a floating reference: `main`,
  `master`, `HEAD`, `latest`, or an empty string.
- **Pass condition**: Every `rev:` field uses a specific version tag (e.g.
  `v8.21.2`) or a full SHA digest. No floating references.
- **Fail example**:
  ```yaml
  repos:
    - repo: https://github.com/gitleaks/gitleaks
      rev: main   # floating — pulls latest silently on next autoupdate
      hooks:
        - id: gitleaks
  ```
- **Remediation**: Replace floating refs with the latest stable tag. Run
  `pre-commit autoupdate` to find current versions, then pin.
  ```yaml
  # Before (insecure — floating ref)
  - repo: https://github.com/gitleaks/gitleaks
    rev: main

  # After (secure — pinned)
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.21.2
  ```
- **Source**: Gemma internal standard (2026-04-16); mirrors SHA-pinning
  rationale from CI/CD security research §07