.dockerignore

@@ -1,2 +1,3 @@
 # Ignore everything
 *
+!.pre-commit-config.yaml

.editorconfig

@@ -0,0 +1,16 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+# Non-standard
+quote_type = single
+
+[*.{diff,patch}]
+indent_style = unset
+indent_size = unset

.pre-commit-config.yaml

@@ -0,0 +1,74 @@
+exclude: |
+  (?x)
+  .drawio$|
+  ^test/.*.json$|
+  tsconfig.json$|
+  .diff$|
+  .patch$|
+  .min.|
+  ^states/common/setup/files/01-netzbegruenung.sh$|
+  ^states/common/setup/files/01-verdigado.sh$
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: check-added-large-files
+      - id: check-case-conflict
+      - id: check-executables-have-shebangs
+      - id: check-json
+      - id: check-merge-conflict
+      - id: check-symlinks
+      - id: check-xml
+      - id: check-yaml
+      - id: double-quote-string-fixer
+      - id: end-of-file-fixer
+      - id: fix-byte-order-marker
+      - id: mixed-line-ending
+      - id: no-commit-to-branch
+      - id: requirements-txt-fixer
+      - id: trailing-whitespace
+        args: [--markdown-linebreak-ext=md]
+  - repo: https://github.com/warpnet/salt-lint
+    rev: v0.9.2
+    hooks:
+      - id: salt-lint
+  - repo: https://github.com/markdownlint/markdownlint
+    rev: v0.13.0
+    hooks:
+      - id: markdownlint
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.9.0.5
+    hooks:
+      - id: shellcheck
+  - repo: local
+    hooks:
+      - id: check-ssh-keys
+        name: check SSH public keys in user pillars
+        entry: python build/check-ssh-keys.py
+        language: python
+        files: ^pillars/users/.+\.sls$
+        additional_dependencies: ['pyyaml==6.0.1'] # Renovate can't parse it, yet https://github.com/renovatebot/renovate/issues/20780 # TODO
+
+      - id: check-codeowners
+        name: check CODEOWNERS for alphabetical comment order
+        entry: python build/check-alphabetical-comments.py
+        language: python
+        files: CODEOWNERS
+
+      - id: prettier # Copied from https://github.com/pre-commit/mirrors-prettier/ instead of referencing it to not rely on their published Prettier versions
+        name: Prettier
+        description: ''
+        entry: prettier --write --ignore-unknown
+        language: node
+        'types': [text]
+        args: []
+        require_serial: false
+        additional_dependencies: ['prettier@3'] # Renovate can't parse this, either. Unspecific to prevent local installs, when global installations are available
+        minimum_pre_commit_version: '0'
+
+      - id: git-diff
+        name: git diff
+        entry: git diff --exit-code
+        language: system
+        pass_filenames: false
+        always_run: true

.prettierrc.yaml

@@ -0,0 +1,4 @@
+semi: false
+bracketSpacing: true
+trailingComma: es5
+proseWrap: preserve

.woodpecker.yaml

@@ -1,5 +1,5 @@
 when:
-  path: "*Dockerfile*"
+  path: '*Dockerfile*'
 
 steps:
   build-main:
@@ -14,12 +14,12 @@ steps:
       password:
         from_secret: gitea_token
       repo: git.verdigado.com/${CI_REPO,,}
-      tag: "latest"
+      tag: 'latest'
 
   build-branch:
     when:
       branch:
-        exclude: ["main"]
+        exclude: ['main']
     image: woodpeckerci/plugin-docker-buildx:4.0.0@sha256:9d24b71c37d7a958d79252e608c4d1a04b02f2e74d4e26003b43e0830038bde0
     pull: true
     settings:

Dockerfile

@@ -17,6 +17,9 @@ ENV PRE_COMMIT_VERSION="3.7.1"
 # renovate: datasource=rubygems depName=mdl versioning=ruby
 ENV MDL_VERSION="0.13.0"
 
+RUN mkdir /data /tmp/pre-commit
+COPY .pre-commit-config.yaml /tmp/pre-commit
+
 RUN apk add --update --no-cache \
       build-base="${BUILD_BASE_VERSION}" \
       gcc="${GCC_VERSION}" \
@@ -27,7 +30,10 @@ RUN apk add --update --no-cache \
     && \
     pip install --no-cache-dir pre-commit=="${PRE_COMMIT_VERSION}" && \
     gem install --no-document mdl -v "${MDL_VERSION}" && \
-    mkdir /data && \
-    git config --global --add safe.directory /data
+    git config --global --add safe.directory /data && \
+    cd /tmp/pre-commit && \
+    git init --initial-branch main && \
+    pre-commit install --install-hooks && \
+    rm -rf /tmp/pre-commit
 
 WORKDIR /data

renovate.json

@@ -1,8 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "local>renovate/config"
-  ],
+  "extends": ["local>renovate/config"],
   "branchPrefix": "renovate-",
   "groupName": "all dependencies",
   "groupSlug": "all",
@@ -10,18 +8,14 @@
     {
       "groupName": "all dependencies",
       "groupSlug": "all",
-      "matchPackagePatterns": [
-        "*"
-      ]
+      "matchPackagePatterns": ["*"]
     }
   ],
   "separateMajorMinor": false,
   "customManagers": [
     {
       "customType": "regex",
-      "fileMatch": [
-        "^Dockerfile$"
-      ],
+      "fileMatch": ["^Dockerfile$"],
       "matchStrings": [
         "#\\s*renovate:\\s*datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\sENV .*?_VERSION=\"(?<currentValue>.*)\"\\s"
       ],