.pre-commit-hooks.yaml

- id: keyhog
  name: KeyHog Secret Scanner
  entry: keyhog scan --fast --git-staged --backend cpu
  # `language: system` runs the keyhog already on PATH. Install it first via
  # the one-line installer (see README). The previous `language: rust` had
  # pre-commit `cargo install` keyhog with default features, which links
  # libhyperscan-dev (the `simd` feature) - absent on most dev machines, so
  # the hook failed to BUILD on first use for nearly every adopter. Using the
  # installed binary is fast, needs no toolchain, and matches the documented
  # drop-in recipe (docs/src/workflows/precommit.md).
  language: system
  # `keyhog scan --git-staged` self-discovers the staged blobs and scans their
  # STAGED content (not the working tree). The pre-commit framework otherwise
  # appends the changed filenames as positional args, and `keyhog scan` takes
  # only ONE positional [PATH] - a second filename aborts with clap exit 2
  # ("unexpected argument"), failing EVERY commit. Suppress the filename pass.
  pass_filenames: false
  # Re-run once for the whole commit, not per-file: --git-staged already
  # covers the entire staged set in a single invocation.
  # Run even when pre-commit classifies every staged path as non-text. The
  # staged source must then surface those unreadable blobs as coverage gaps;
  # silently skipping the hook would misreport the commit as checked.
  always_run: true
  require_serial: true
  stages: [pre-commit]