SystemNix/.pre-commit-config.yaml at master · LarsArtmann/SystemNix · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
# Nix Pre-commit Hooks Configuration
# Runs static analysis and linting on every commit

repos:
  # Local hooks (system commands)
  - repo: local
    hooks:
      # Security: Detect leaked secrets
      - id: gitleaks
        name: gitleaks
        entry: gitleaks
        args: [detect, --source, .]
        language: system
        pass_filenames: false

      # Format: Remove trailing whitespace
      - id: trailing-whitespace
        name: Remove trailing whitespace
        entry: bash
        args:
          [
            -c,
            'find . -name "*.md" -o -name "*.yaml" -o -name "*.yml" -o -name "*.txt" -o -name "*.sh" -o -name "*.nix" | grep -v ".git" | xargs -I {} /run/current-system/sw/bin/sed -i "s/[[:space:]]*$//" "{}"',
          ]
        language: system
        pass_filenames: false

      # Nix: Dead code detection
      - id: deadnix
        name: deadnix (dead code detector)
        entry: bash
        args: [-c, "nix shell nixpkgs#deadnix --command deadnix"]
        language: system
        files: \.nix$
        pass_filenames: true

      # Nix: Linter and antipattern detection
      # Note: W04 "Assignment instead of inherit" is excluded — false positive
      # on mkDerivation attrs like nativeBuildInputs = [pkg].
      # statix only accepts one target, so loop through files individually.
      # grep -q returns 1 on no match, which would falsely fail the hook —
      # so we use an explicit result variable instead.
      - id: statix
        name: statix (Nix linter)
        entry: bash
        args:
          [
            -c,
            'for f in "$@"; do result=$(statix check -o errfmt "$f" 2>&1 | grep -v ":E:0:"); if [ -n "$result" ]; then echo "$result"; exit 1; fi; done',
            bash,
          ]
        language: system
        files: \.nix$
        pass_filenames: true

      # Nix: Code formatting check
      - id: alejandra
        name: alejandra (Nix formatter)
        entry: bash
        args: [-c, "nix shell nixpkgs#alejandra --command alejandra --check ."]
        language: system
        pass_filenames: false

      # Nix: Syntax and build validation
      - id: nix-check
        name: nix check (flake validation)
        entry: bash
        args: [-c, "nix flake check --no-build"]
        language: system
        files: \.nix$
        pass_filenames: false

      # JSON: Validate flake.lock integrity
      - id: flake-lock-validate
        name: flake.lock validation (JSON + merge conflicts)
        entry: bash
        args:
          [
            -c,
            'jq empty flake.lock && ! grep -qE "^<{7} |^={7}$$|^>{7} " flake.lock || { echo "ERROR: flake.lock is invalid JSON or contains merge conflicts"; exit 1; }',
          ]
        language: system
        files: ^flake\.lock$
        pass_filenames: false

      # Shell: Static analysis for shell scripts
      - id: shellcheck
        name: shellcheck (shell script linter)
        entry: bash
        args: [
          -c,
          "shellcheck --severity=warning --exclude=SC2312 scripts/*.sh",
        ]
        language: system
        files: ^scripts/.*\.sh$
        pass_filenames: false

      # Merge conflict detection across all files
      - id: check-merge-conflicts
        name: check for merge conflicts
        entry: bash
        args:
          [
            -c,
            "! grep -rnE '^<{7} |^={7}$$|^>{7} ' --include='*.nix' --include='*.lock' --include='*.json' --include='*.yaml' --include='*.yml' . || { echo 'ERROR: Found merge conflict markers - resolve before committing'; exit 1; }",
          ]
        language: system
        pass_filenames: false

      # Systemd hardening audit: warn when harden{} (defaults ProtectHome=true)
      # is used alongside /home paths without an explicit ProtectHome override.
      # Catches the crush-daily class of silent data-access failure.
      - id: protect-home-audit
        name: ProtectHome audit (harden + /home pattern)
        entry: bash
        args:
          [
            -c,
            'exitcode=0; for f in $(find modules/ -name "*.nix" | sort); do if grep -q "harden {" "$f" && ! grep -q "hardenUser {" "$f" && grep -qE "/home/" "$f"; then if ! grep -q "ProtectHome = false" "$f"; then echo "WARNING: $f uses harden {} (defaults ProtectHome=true) and references /home — verify ProtectHome override needed"; exitcode=1; fi; fi; done; exit $exitcode',
          ]
        language: system
        files: \.nix$
        pass_filenames: false

# Hook Execution Order:
# 1. gitleaks             - Security check
# 2. trailing-whitespace  - Cleanup formatting
# 3. deadnix              - Detect dead code
# 4. statix               - Lint and detect antipatterns
# 5. alejandra            - Check code formatting
# 6. nix-check            - Validate syntax and build
# 7. flake-lock-validate  - Validate flake.lock JSON integrity
# 8. shellcheck           - Lint shell scripts in scripts/
# 9. check-merge-conflicts - Catch unresolved merge markers
#
# Tools Used:
# - gitleaks   (secret detection)
# - deadnix    (dead code detection)
# - statix     (linter, 20+ rules)
# - alejandra  (code formatter)
# - shellcheck (shell script analysis)
# - nix flake check (validation)
#
# All hooks use `--check` mode to enforce standards.
# To auto-fix issues manually, run:
#   nix shell nixpkgs#alejandra nixpkgs#statix nixpkgs#deadnix
#   alejandra .      # auto-format
#   statix fix .     # auto-fix linting
#   deadnix --edit . # remove dead code