chore: adopt make pre-commit workflow with full pre-commit hook suite

.cargo/config.toml

@@ -1,5 +1,4 @@
 [build]
-jobs = 4
 
 [http]
 timeout = 10                # timeout for each HTTP request, in seconds

.dockerignore

@@ -2,4 +2,3 @@ target/
 assets/
 resources/
 releases/
-

.gitattributes

@@ -0,0 +1,4 @@
+# Tell git to use the secrets-baseline merge driver for .secrets.baseline
+# so merge conflicts produce a regenerated JSON instead of conflict markers.
+# Register the driver with: make configure-git
+.secrets.baseline merge=secrets-baseline

.github/workflows/docker_image_ci.yaml

@@ -4,35 +4,34 @@ on:
   push:
    branches: [ "main" ]
    # tags: ["2.0.0"]
-    
+
 env:
   IMAGE_NAME: contextforge-data-plane
-  
+
 jobs:
 
   build:
     runs-on: ubuntu-latest
     permissions:
       packages: write
       contents: read
-    steps:    
+    steps:
     - uses: actions/checkout@v5
     - name: Set version
       id: set_version
       run: |
-        CF_VERSION=$(grep -m 1 '^version' Cargo.toml | sed 's/version\s*=\s*"\(.*\)"/\1/')                
+        CF_VERSION=$(grep -m 1 '^version' Cargo.toml | sed 's/version\s*=\s*"\(.*\)"/\1/')
         echo "CF_VERSION=${CF_VERSION}" >> "${GITHUB_ENV}"
     - name: Show version
       run: echo "${CF_VERSION}"
-    - name: Build the Docker image      
+    - name: Build the Docker image
       run: docker build . --file docker/Dockerfile --tag "${IMAGE_NAME}:latest"
     - name: Log in to registry
       run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
     - name: Push image
-      run: |        
+      run: |
         IMAGE_ID="ghcr.io/${{ github.repository_owner }}/${IMAGE_NAME}"
         docker tag "${IMAGE_NAME}:latest" "${IMAGE_ID}:v${CF_VERSION}"
         docker tag "${IMAGE_NAME}:latest" "${IMAGE_ID}:latest"
         docker push "${IMAGE_ID}:v${CF_VERSION}"
         docker push "${IMAGE_ID}:latest"
-

.gitignore

@@ -18,9 +18,16 @@ contextforge-data-plane.log.*
 # Generated by mdBook (wiki)
 _context/wiki/book/
 
+# pre-commit tool cache (hook virtualenvs and temp files)
+.cache/
+
 # RustRover
 #  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
 #  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
 #  and can be added to the global gitignore or merged into this file.  For a more nuclear
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 #.idea/
+
+
+# Personal dev tooling (wt worktree manager, etc.)
+.config/

.pre-commit-config.yaml

@@ -1,4 +1,136 @@
+# -----------------------------------------------------------------------------
+# Pre-commit Configuration — contextforge-data-plane (Rust)
+# -----------------------------------------------------------------------------
+# Install:
+#   uv tool install pre-commit
+#   pre-commit install
+#   pre-commit run --all-files
+#
+# Update hook revisions:
+#   pre-commit autoupdate
+#
+# Skip all checks for one commit:
+#   git commit -m "…" --no-verify
+#
+# NOTE: Formatters (cargo fmt) modify files and need re-staging.
+# -----------------------------------------------------------------------------
+
+exclude: 'Cargo\.lock$|\.lock$|target/'
+fail_fast: true
+
 repos:
+  # ---------------------------------------------------------------------------
+  # Security — private keys and large accidental blobs
+  # ---------------------------------------------------------------------------
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b  # v5.0.0
+    hooks:
+      - id: detect-private-key
+        name: Detect Private Key
+        exclude: 'assets/|tests/|crates/plugins/cpex-secrets-detection/'
+
+      - id: check-added-large-files
+        name: Check Added Large Files
+        stages: [pre-commit, pre-push, manual]
+
+      - id: check-merge-conflict
+        name: Check Merge Conflicts
+        types: [text]
+
+  # ---------------------------------------------------------------------------
+  # File quality — whitespace, encoding, line endings, format syntax
+  # ---------------------------------------------------------------------------
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b  # v5.0.0
+    hooks:
+      - id: end-of-file-fixer
+        name: Fix End of Files
+        types: [text]
+        exclude: '^\.gitignore$'
+        stages: [pre-commit, pre-push, manual]
+
+      - id: trailing-whitespace
+        name: Trim Trailing Whitespace
+        types: [text]
+        stages: [pre-commit, pre-push, manual]
+
+      - id: fix-byte-order-marker
+        name: Fix UTF-8 Byte Order Marker
+        types: [text]
+
+      - id: mixed-line-ending
+        name: Mixed Line Ending
+        types: [text]
+        args: [--fix=lf]
+
+      - id: check-case-conflict
+        name: Check Case Conflicts
+
+      - id: check-symlinks
+        name: Check Symlinks
+        types: [symlink]
+
+      - id: check-toml
+        name: Check TOML
+        types: [toml]
+
+      - id: check-yaml
+        name: Check YAML
+        types: [yaml]
+
+      - id: check-json
+        name: Check JSON
+        types: [json]
+
+  # ---------------------------------------------------------------------------
+  # Unicode hygiene — BiDi controls can hide malicious code
+  # ---------------------------------------------------------------------------
+  - repo: https://github.com/sirosen/texthooks
+    rev: c1a669453f31baa33e32761cb670aa1f10141937  # v0.6.8
+    hooks:
+      - id: forbid-bidi-controls
+        name: Forbid BiDi Unicode Controls
+
+  # ---------------------------------------------------------------------------
+  # AI / placeholder guards (local)
+  # ---------------------------------------------------------------------------
+  - repo: local
+    hooks:
+      - id: forbid-content-reference
+        name: Forbid :contentReference
+        entry: ':contentReference'
+        language: pygrep
+        types: [text]
+        exclude: ^\.pre-commit-config\.yaml$
+
+      - id: forbid-oai-citations
+        name: Forbid OpenAI Citations
+        entry: '\[oaicite:\?\?\d+\]'
+        language: pygrep
+        types: [text]
+        exclude: ^\.pre-commit-config\.yaml$
+
+      - id: forbid-ai-stock-phrases
+        name: Forbid AI Stock Phrases
+        entry: '(?i)(as an ai language model|i am an ai developed by|my knowledge cutoff|my training data)'
+        language: pygrep
+        types: [text]
+        exclude: ^\.pre-commit-config\.yaml$
+
+  # ---------------------------------------------------------------------------
+  # Secret scanning — IBM hardened fork
+  # ---------------------------------------------------------------------------
+  - repo: https://github.com/ibm/detect-secrets
+    rev: 076672a9a01abdfc7ecee2e7d14f08cdccb73976  # 0.13.1+ibm.64.dss
+    hooks:
+      - id: detect-secrets
+        name: IBM Detect Secrets
+        args: ['--baseline', '.secrets.baseline', '--use-all-plugins', '--fail-on-unaudited']
+        types: [text]
+
+  # ---------------------------------------------------------------------------
+  # Rust — format check, lint, supply-chain, test, build
+  # ---------------------------------------------------------------------------
   - repo: local
     hooks:
       - id: cargo-fmt
@@ -30,9 +162,3 @@ repos:
         entry: cargo build --locked --workspace
         language: system
         pass_filenames: false
-
-      - id: cargo-bench-no-run
-        name: cargo bench --no-run
-        entry: cargo bench --locked --workspace --no-run
-        language: system
-        pass_filenames: false