Pre-commit scaffolder

Vetrix can generate a .pre-commit-config.yaml for your repository so contributors catch secrets and lint issues locally, before the push ever reaches the pre-receive hook. Installation is client-side — the server never runs pre-commit itself.

Install on a workstation

pip install pre-commit
cd /path/to/repo
pre-commit install

After this, git commit runs every hook in .pre-commit-config.yaml on the staged diff. Rejections abort the commit before it is recorded.

Ask Vetrix to generate the config

Two equivalent routes:

• Configure UI — on /<owner>/<repo>/security/configure click Add pre-commit config. Requires PermPolicyEdit.
• API — POST /api/v1/repos/{owner}/{repo}/security/pre-commit.

Vetrix reads the repo's current .vetrix/tooling.yml (if any), derives a language subset (gofmt for Go, prettier + eslint for JS/TS, ruff for Python) alongside the unconditional gitleaks + whitespace hooks, and commits the result to the default branch.

What gets scaffolded

Source	Hook	Notes
gitleaks	gitleaks	always included
pre-commit/pre-commit-hooks	trailing-whitespace, end-of-file-fixer, check-merge-conflict	always included
.vetrix/tooling.yml SCA govulncheck / SAST gosec	gofmt (local system hook)	when any Go scanner is enabled
.vetrix/tooling.yml SAST eslint	prettier + eslint	ESLint triggers both
.vetrix/tooling.yml SAST ruff	ruff (--fix)	Python formatter + linter

Idempotency

Running the generator twice on an unchanged tooling config produces a byte-identical file (deterministic YAML field ordering, repos sorted by URL). If you already have hooks of your own, the generator merges hooks by ID within a shared repo block — your custom repos are preserved, matching hook IDs have their definition updated, new hooks append.

What the server does NOT do

• It does not install or run pre-commit. Contributors do that locally.
• It does not enforce the hook — skipping it with --no-verify is a local choice. Server-side policy enforcement lives at pre-receive (gitleaks) and CI (full scanner suite).
• It does not version-pin outside this scaffolder. Bumping rev: on any hook is a manual repo change.