Pre-Commit Hook Rollout Template¶

pip install pre-commit

# .pre-commit-config.yaml — AGT governance hooks
# See https://github.com/microsoft/agent-governance-toolkit

repos:
  # ── AGT policy validation ────────────────────────────────
  - repo: local
    hooks:
      - id: agt-validate
        name: AGT Policy Validation
        entry: bash -c 'python -m agent_os.cli validate --strict'
        language: system
        files: '(governance\.ya?ml|policies/.*\.ya?ml)$'
        pass_filenames: false

      - id: agt-doctor
        name: AGT Health Check
        entry: bash -c 'python -m agent_os.cli doctor --quiet'
        language: system
        pass_filenames: false
        stages: [pre-push]

  # ── Governance metadata ───────────────────────────────────
  - repo: local
    hooks:
      - id: agency-json-required
        name: Plugin agency.json Check
        entry: bash -c '
          for dir in plugins/*/; do
            if [ -d "$dir" ] && [ ! -f "${dir}agency.json" ]; then
              echo "❌ Missing agency.json in $dir"
              exit 1
            fi
          done
        '
        language: system
        pass_filenames: false

  # ── Secret scanning ──────────────────────────────────────
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.5.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']

  # ── Quality gates (mirroring CI) ─────────────────────────
  - repo: local
    hooks:
      - id: no-stubs
        name: No TODO/FIXME Stubs
        entry: bash -c '
          PATTERN="TODO|FIXME|HACK|XXX|raise NotImplementedError|todo!()|unimplemented!()"
          STAGED=$(git diff --cached --diff-filter=ACMR -U0 -- "*.py" "*.ts" "*.rs" "*.cs" "*.go" ":!*test*" | grep -E "^\+[^+]" || true)
          if [ -n "$STAGED" ]; then
            HITS=$(echo "$STAGED" | grep -iE "$PATTERN" || true)
            if [ -n "$HITS" ]; then
              echo "❌ Stub markers in staged code:"
              echo "$HITS"
              exit 1
            fi
          fi
        '
        language: system
        pass_filenames: false

      - id: no-custom-crypto
        name: No Raw Crypto Outside Security Modules
        entry: bash -c '
          PATTERN="from cryptography|from Crypto\.|import hashlib|import hmac|crypto\.subtle|crypto\.createHash|use ring::|use ed25519_dalek|System\.Security\.Cryptography"
          STAGED=$(git diff --cached --diff-filter=ACMR -U0 -- "*.py" "*.ts" "*.rs" "*.cs" "*.go" ":!agent-governance-python/agent-mesh/**" ":!*encryption*" ":!*security*" ":!*test*" | grep -E "^\+[^+]" || true)
          if [ -n "$STAGED" ]; then
            HITS=$(echo "$STAGED" | grep -E "$PATTERN" || true)
            if [ -n "$HITS" ]; then
              echo "❌ Raw crypto outside security modules:"
              echo "$HITS"
              exit 1
            fi
          fi
        '
        language: system
        pass_filenames: false

pre-commit install
pre-commit install --hook-type pre-push

pre-commit run --all-files