version: 0.1
cli:
  version: 1.25.0
plugins:
  sources:
    - id: trunk
      ref: v1.10.0
      uri: https://github.com/trunk-io/plugins
lint:
  enabled:
    - checkov@3.2.529
    - renovate@43.150.0
    - prettier@3.8.3
    - trufflehog@3.95.3
    - yamllint@1.38.0
    - bandit@1.9.4
    - trivy@0.70.0
    - taplo@0.10.0
    - ruff@0.15.13
    - isort@8.0.1
    - markdownlint@0.48.0
    - oxipng@10.1.1
    - svgo@4.0.1
    - actionlint@1.7.12
    - flake8@7.3.0
    - hadolint@2.14.0
    - shfmt@3.6.0
    - shellcheck@0.11.0
    - black@26.5.1
    - git-diff-check
    - gitleaks@8.30.1
    - clang-format@16.0.3
  ignore:
    - linters: [ALL]
      paths:
        - bin/**
    # Fake-NodeDB fixture JSONL files contain deterministic synthetic
    # public_key_hex (64-char hex) values that gitleaks misidentifies as
    # generic-api-key. These are not secrets — they're test fixtures
    # produced by bin/gen-fake-nodedb-seed.py with a fixed RNG seed.
    - linters: [gitleaks]
      paths:
        - test/fixtures/nodedb/seed_v25_*.jsonl
runtimes:
  enabled:
    - python@3.14.4
    - go@1.21.0
    - node@22.16.0
actions:
  disabled:
    - trunk-announce
  enabled:
    - trunk-fmt-pre-commit
    - trunk-check-pre-push
    - trunk-upgrade-available