feat: add pre-commit hooks

[greenkiwi]

Overview

Policy isn't Policy unless it's enforced.

To this end, we would like to have an easy way for developers to ensure that they are following the standards set forth in this repo.

Two things that we would like to accomplish:

• package up / collect existing pre-commit hooks that we use and ensure they are applied
• create new hooks based on the standards laid out here

Existing hooks

Our existing terraform repositories have the following pre-commit hooks:

repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.4.0 # Use the ref you want to point at
    hooks:
      - id: check-json
      - id: check-yaml
      - id: end-of-file-fixer
      - id: trailing-whitespace
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.77.2
    hooks:
      - id: terraform_fmt
        stages: [commit]
      - id: terraform_validate
        stages: [commit]
      - id: terraform_docs
        stages: [commit]
      - id: terraform_providers_lock
        stages: [commit]
        args:
          - --args=-platform=darwin_amd64
          - --args=-platform=linux_amd64
  - repo: https://github.com/pre-commit/mirrors-prettier
    rev: v2.7.1
    hooks:
      - id: prettier
        stages: [commit]
  - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
    rev: v9.5.0
    hooks:
      - id: commitlint
        stages: [commit-msg]
        additional_dependencies: ["@open-turo/commitlint-config-conventional"]
  - repo: https://github.com/rhysd/actionlint
    rev: v1.6.24
    hooks:
      - id: actionlint
  - repo: https://github.com/jumanjihouse/pre-commit-hooks
    rev: 3.0.0 # or specific git tag
    hooks:
      - id: shellcheck
      - id: shfmt

It would be great to capture some of these in this repo to ensure that they are followed and changed when versioned get updated.

This might take a tool such as common-repo to accomplish.

Enforcement of new standardards

We would also like to enforce the standards laid out here. For example, if we have a standard that says all files must use kebob-case for their name, then having a pre-commit check to enforce that will ensure that people follow it.

Some obvious checks:

• output must only show up in tf files that start with outputs.
• variable must only show up in tf files that start with variables.
• local duplication of variable without modification
• the usage of resource type in a resource name -- i.e. resource "aws_iam_policy" "pod_policy" {

[greenkiwi]

See #5