.pre-commit-config.yaml

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.2.0
    hooks:
      - id: check-merge-conflict
      - id: end-of-file-fixer
      - id: no-commit-to-branch
      - id: check-case-conflict
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.81.0
    hooks:
      - id: terraform_docs
        args:
          - '--args=--lockfile=false'
          - '--hook-config=--path-to-file=README.md'
          - '--hook-config=--add-to-existing-file=true'
          - '--hook-config=--create-file-if-not-exist=true'
          - '--hook-config=--recursive.enabled=true'
          - '--hook-config=--recursive.path=submodules'
      - id: terraform_fmt
      - id: terraform_tflint
        args:
          - '--args=--config=__GIT_WORKING_DIR__/.tflint.hcl'
          - '--args=--only=terraform_deprecated_interpolation'
          - '--args=--only=terraform_deprecated_index'
          - '--args=--only=terraform_unused_declarations'
          - '--args=--only=terraform_comment_syntax'
          - '--args=--only=terraform_documented_outputs'
          - '--args=--only=terraform_documented_variables'
          - '--args=--only=terraform_typed_variables'
          - '--args=--only=terraform_module_pinned_source'
          - '--args=--only=terraform_naming_convention'
          - '--args=--only=terraform_required_version'
          - '--args=--only=terraform_required_providers'
          - '--args=--only=terraform_standard_module_structure'
          - '--args=--only=terraform_workspace_remote'
          - '--args=--only=google_composer_environment_invalid_machine_type'
          - '--args=--only=google_compute_instance_invalid_machine_type'
          - '--args=--only=google_compute_instance_template_invalid_machine_type'
          - '--args=--only=google_compute_reservation_invalid_machine_type'
          - '--args=--only=google_container_cluster_invalid_machine_type'
          - '--args=--only=google_container_node_pool_invalid_machine_type'
          - '--args=--only=google_dataflow_job_invalid_machine_type'
          - '--args=--only=google_project_iam_audit_config_invalid_member'
          - '--args=--only=google_project_iam_binding_invalid_member'
          - '--args=--only=google_project_iam_member_invalid_member'
          - '--args=--only=google_project_iam_policy_invalid_member'
      - id: terraform_validate
      - id: terraform_checkov
        args:
          - '--args=--compact'
          - '--args=--quiet'
          - '--args=--skip-check CKV_GCP_24,CKV_GCP_49,CKV_GCP_41,CKV_GCP_68,CKV_GCP_22,CKV_GCP_82,CKV_GCP_69,CKV_GCP_66,CKV_GCP_65,CKV_GCP_71,CKV_GCP_13,CKV_GCP_19,CKV_GCP_67,CKV_GCP_61,CKV_GCP_29,CKV_GCP_62,CKV_GCP_76,CKV_GCP_26,CKV_GCP_84,CKV_GCP_12,CKV_CIRCLECIPIPELINES_2,CKV_CIRCLECIPIPELINES_6,CKV2_GHA_1'
      - id: terraform_tfsec
        args:
          - '--args=--exclude google-gke-enforce-pod-security-policy,google-storage-bucket-encryption-customer-key,google-compute-enable-vpc-flow-logs,google-compute-no-public-ingress,google-gke-metadata-endpoints-disabled,google-gke-no-public-control-plane,google-gke-node-metadata-security,google-gke-use-service-account,google-storage-enable-ubla,google-iam-no-project-level-service-account-impersonation,google-gke-use-cluster-labels,google-gke-enable-network-policy'
      ## Merge back the terrascan id when the following error is merged:
      ## Unsupported argument; An argument named "nullable" is not expected here.
      # - id: terrascan ## Merge back when there is a new version upstream
      #   args:
      #     - '--args=--verbose'
      #     - '--args=--skip-rules=AC_GCP_0016,AC_GCP_0234,AC_GCP_0006'