# Every `rev:` is a commit SHA with the tag it came from in a `# frozen:`
# comment -- the same form `pre-commit autoupdate --freeze` writes, and the
# same trust model the repository already applies to every GitHub Action (see
# `.github/workflows/README.md` on why a tag is mutable). It matters more here
# than there: none of these tools is in `uv.lock`, so pre-commit clones them
# from this file at hook time, `ruff-check` runs with `--fix` (write access to
# the whole working tree), and `setup.sh` installs the hooks for every
# contributor -- so a re-pointed tag would rewrite source on developer
# machines, not just fail a CI check. Dependabot maintains the frozen form.
repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
    hooks:
      - id: end-of-file-fixer
      - id: mixed-line-ending
      - id: trailing-whitespace
      - id: check-json
      - id: check-merge-conflict
        args: ['--assume-in-merge']
  - repo: https://github.com/pycqa/isort
    rev: 131f4adcd5582bfc53928ab0d740eceb8b506b6c  # frozen: 9.0.1
    hooks:
      - id: isort
        args: ["--profile", "black"]
  - repo: https://github.com/psf/black
    rev: 87928e6d6761a4a6d22250e1fee5601b3998086e  # frozen: 26.5.1
    hooks:
      - id: black
  # astral-sh is the canonical home; charliermarsh/ruff-pre-commit is a
  # redirect. The hook id moved from `ruff` to `ruff-check` when `ruff format`
  # arrived and a bare `ruff` became ambiguous. The rule set is pinned in
  # pyproject.toml's [tool.ruff.lint]; see the comment there for why.
  - repo: https://github.com/astral-sh/ruff-pre-commit
    rev: 321478e58f4938179c6b86e4ddfa923d1547a49b  # frozen: v0.16.6
    hooks:
      - id: ruff-check
        args: [--fix, "--ignore=E501,F401,E722,E402,E741"]
  - repo: local
    hooks:
      - id: mypy-core
        name: mypy (strict agent, host, and orchestration contracts)
        entry: uv run mypy
        language: system
        pass_filenames: false
        always_run: true
      - id: css-tokens
        name: CSS custom-property references must be defined
        entry: uv run python scripts/check_css_tokens.py
        language: system
        pass_filenames: false
        files: '(openai4s/server/webui/style\.css|scripts/check_css_tokens\.py)$'

# Never reformat: vendored third-party assets and Skills, plus captured test
# fixtures. These trees preserve byte-exact upstream or real-world payloads.
exclude: '^(openai4s/server/webui/vendor/|openai4s/server/webui/dist/|skills/bioskills/|tests/fixtures/)'