lefthook.yml

# Pre-commit hooks. Activated by `lefthook install` (writes .git/hooks/pre-commit).
# All tools resolved through mise to match CI versions exactly.

pre-commit:
  # Serialized per RCA H4 — concurrent `mise exec swiftlint` + `mise exec
  # gitleaks` invocations deadlock on mise's process-level cache lock,
  # observed empirically across multiple sessions. See
  # meetings/2026-05-25_swift-test-hang-rca.md §H4 + Prevention bullet 2.
  parallel: false
  # All invocations route through `mise run <task>` (SSOT — task bodies live
  # in `mise-tasks/` as file-based tasks). To change a flag, edit the matching
  # script under `mise-tasks/`; lefthook, GH Actions, and Xcode Cloud all
  # pick it up via `mise run`.
  commands:
    gitleaks:
      run: mise run scan:secrets
    hygiene:
      # Repo hygiene: block secret-shaped files from ever entering history.
      # Folded in from plan.md §1.1 (no standalone shell script).
      run: mise run scan:hygiene
    swiftlint:
      glob: "*.{swift}"
      # Warn-only locally (strict variant runs in PR CI — see .mise.toml).
      run: mise run lint:swift -- {staged_files}