.pre-commit-hooks.yaml

# We set `pass_filenames` to `false` because ggshield gets filenames from commit IDs.
- id: ggshield
  name: ggshield (pre-commit)
  entry: ggshield
  description: Runs ggshield to detect hardcoded secrets.
  stages: [pre-commit]
  args: ['secret', 'scan', 'pre-commit']
  language: python
  pass_filenames: false
  minimum_pre_commit_version: 3.2.0

- id: docker-ggshield
  name: ggshield (pre-commit,docker)
  language: docker_image
  entry: -e GITGUARDIAN_API_KEY gitguardian/ggshield:latest ggshield secret scan pre-commit
  description: Runs ggshield to detect hardcoded secrets in docker images.
  pass_filenames: false

- id: ggshield-push
  name: ggshield (pre-push)
  entry: ggshield
  description: Runs ggshield to detect hardcoded secrets.
  args: ['secret', 'scan', 'pre-push']
  stages: [pre-push]
  language: python
  pass_filenames: false
  minimum_pre_commit_version: 3.2.0

- id: docker-ggshield-push
  name: ggshield (pre-push,docker)
  language: docker_image
  entry: -e GITGUARDIAN_API_KEY gitguardian/ggshield:latest ggshield secret scan pre-push
  description: Runs ggshield to detect hardcoded secrets in docker images.
  pass_filenames: false