From 406712ffa3e7a0658932207ea519fc9b648286d6 Mon Sep 17 00:00:00 2001
From: "Pablo Fernandez Guerra (PFE)"
 <148432447+pfe-nazaries@users.noreply.github.com>
Date: Tue, 16 Jun 2026 15:09:24 +0200
Subject: [PATCH] chore: scope prek pre-push hook to TruffleHog only (#11609)

Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .pre-commit-config.yaml    | 8 ++++++++
 ui/.pre-commit-config.yaml | 5 +++++
 2 files changed, 13 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 4e79141bb7..1e9d74c973 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -7,6 +7,10 @@
 #   P50 — dependency validation
 
 default_install_hook_types: [pre-commit]
+# Hooks run on commit only by default;
+# NOTE: default_stages does NOT override a hook's manifest stages, so fixers shipping pre-push in their
+# manifest need an explicit stages: ["pre-commit"] below to stay off push.
+default_stages: [pre-commit]
 
 repos:
   ## GENERAL (prek built-in — no external repo needed)
@@ -21,13 +25,16 @@ repos:
       - id: check-json
         priority: 10
       - id: end-of-file-fixer
+        stages: ["pre-commit"]
         priority: 0
       - id: trailing-whitespace
+        stages: ["pre-commit"]
         priority: 0
       - id: no-commit-to-branch
         priority: 10
       - id: pretty-format-json
         args: ["--autofix", --no-sort-keys, --no-ensure-ascii]
+        stages: ["pre-commit"]
         priority: 10
 
   ## TOML
@@ -82,6 +89,7 @@ repos:
         name: "SDK - isort"
         files: { glob: ["{prowler,tests,dashboard,util,scripts}/**/*.py"] }
         args: ["--profile", "black"]
+        stages: ["pre-commit"]
         priority: 20
 
   - repo: https://github.com/psf/black
diff --git a/ui/.pre-commit-config.yaml b/ui/.pre-commit-config.yaml
index eab333ceea..3bc0c3b5e6 100644
--- a/ui/.pre-commit-config.yaml
+++ b/ui/.pre-commit-config.yaml
@@ -1,5 +1,10 @@
 orphan: true
 
+# Hooks run on commit only by default;
+# NOTE: default_stages does NOT override a hook's manifest stages, so fixers shipping pre-push in their
+# manifest need an explicit stages: ["pre-commit"] below to stay off push.
+default_stages: [pre-commit]
+
 repos:
   - repo: local
     hooks: