Add pre-commit hooks for code quality, security, and secret detection

.pre-commit-config.yaml

@@ -3,3 +3,30 @@ repos:
     rev: v5.0.0
     hooks:
       - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-added-large-files
+      - id: check-yaml
+        exclude: ^helm/
+
+  - repo: https://github.com/pycqa/isort
+    rev: 5.13.2
+    hooks:
+      - id: isort
+
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.8.3
+    hooks:
+      - id: bandit
+        args: ["--skip", "B104"]
+        exclude: ^tests/
+
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v1.5.0
+    hooks:
+      - id: detect-secrets
+        args: ["--baseline", ".secrets.baseline"]
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.8.4
+    hooks:
+      - id: ruff

.secrets.baseline

@@ -0,0 +1,216 @@
+{
+  "version": "1.5.0",
+  "plugins_used": [
+    {
+      "name": "ArtifactoryDetector"
+    },
+    {
+      "name": "AWSKeyDetector"
+    },
+    {
+      "name": "AzureStorageKeyDetector"
+    },
+    {
+      "name": "Base64HighEntropyString",
+      "limit": 4.5
+    },
+    {
+      "name": "BasicAuthDetector"
+    },
+    {
+      "name": "CloudantDetector"
+    },
+    {
+      "name": "DiscordBotTokenDetector"
+    },
+    {
+      "name": "GitHubTokenDetector"
+    },
+    {
+      "name": "GitLabTokenDetector"
+    },
+    {
+      "name": "HexHighEntropyString",
+      "limit": 3.0
+    },
+    {
+      "name": "IbmCloudIamDetector"
+    },
+    {
+      "name": "IbmCosHmacDetector"
+    },
+    {
+      "name": "IPPublicDetector"
+    },
+    {
+      "name": "JwtTokenDetector"
+    },
+    {
+      "name": "KeywordDetector",
+      "keyword_exclude": ""
+    },
+    {
+      "name": "MailchimpDetector"
+    },
+    {
+      "name": "NpmDetector"
+    },
+    {
+      "name": "OpenAIDetector"
+    },
+    {
+      "name": "PrivateKeyDetector"
+    },
+    {
+      "name": "PypiTokenDetector"
+    },
+    {
+      "name": "SendGridDetector"
+    },
+    {
+      "name": "SlackDetector"
+    },
+    {
+      "name": "SoftlayerDetector"
+    },
+    {
+      "name": "SquareOAuthDetector"
+    },
+    {
+      "name": "StripeDetector"
+    },
+    {
+      "name": "TelegramBotTokenDetector"
+    },
+    {
+      "name": "TwilioKeyDetector"
+    }
+  ],
+  "filters_used": [
+    {
+      "path": "detect_secrets.filters.allowlist.is_line_allowlisted"
+    },
+    {
+      "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
+      "min_level": 2
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_indirect_reference"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_likely_id_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_lock_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_potential_uuid"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_sequential_string"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_swagger_file"
+    },
+    {
+      "path": "detect_secrets.filters.heuristic.is_templated_secret"
+    },
+    {
+      "path": "detect_secrets.filters.regex.should_exclude_file",
+      "pattern": [
+        "venv/.*"
+      ]
+    }
+  ],
+  "results": {
+    "external-services-values/argo-cd-values.yaml": [
+      {
+        "type": "Secret Keyword",
+        "filename": "external-services-values/argo-cd-values.yaml",
+        "hashed_secret": "9f7be9612bc530ef15cfc6ff8e07dad0a3278ea3",
+        "is_verified": false,
+        "line_number": 7
+      }
+    ],
+    "external-services-values/monitoring-values.yaml": [
+      {
+        "type": "Secret Keyword",
+        "filename": "external-services-values/monitoring-values.yaml",
+        "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
+        "is_verified": false,
+        "line_number": 5
+      }
+    ],
+    "helm/fastapi-gitops-starter/example-canary-with-analysis-values.yaml": [
+      {
+        "type": "Secret Keyword",
+        "filename": "helm/fastapi-gitops-starter/example-canary-with-analysis-values.yaml",
+        "hashed_secret": "962e01ff6a135d92494aac7d57464e637cd88249",
+        "is_verified": false,
+        "line_number": 16
+      }
+    ],
+    "helm/fastapi-gitops-starter/secret-example-canary-values.yaml": [
+      {
+        "type": "Secret Keyword",
+        "filename": "helm/fastapi-gitops-starter/secret-example-canary-values.yaml",
+        "hashed_secret": "962e01ff6a135d92494aac7d57464e637cd88249",
+        "is_verified": false,
+        "line_number": 16
+      },
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "helm/fastapi-gitops-starter/secret-example-canary-values.yaml",
+        "hashed_secret": "6e01f523d5b539497b7dd212e79e7182fa9a4cab",
+        "is_verified": false,
+        "line_number": 18
+      },
+      {
+        "type": "GitHub Token",
+        "filename": "helm/fastapi-gitops-starter/secret-example-canary-values.yaml",
+        "hashed_secret": "e175c6f5f2a92e8623bd9a4820edb4e8c1b0fd10",
+        "is_verified": false,
+        "line_number": 18
+      }
+    ],
+    "helm/fastapi-gitops-starter/secret-example-values.yaml": [
+      {
+        "type": "Secret Keyword",
+        "filename": "helm/fastapi-gitops-starter/secret-example-values.yaml",
+        "hashed_secret": "962e01ff6a135d92494aac7d57464e637cd88249",
+        "is_verified": false,
+        "line_number": 12
+      },
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "helm/fastapi-gitops-starter/secret-example-values.yaml",
+        "hashed_secret": "6e01f523d5b539497b7dd212e79e7182fa9a4cab",
+        "is_verified": false,
+        "line_number": 14
+      },
+      {
+        "type": "GitHub Token",
+        "filename": "helm/fastapi-gitops-starter/secret-example-values.yaml",
+        "hashed_secret": "e175c6f5f2a92e8623bd9a4820edb4e8c1b0fd10",
+        "is_verified": false,
+        "line_number": 14
+      }
+    ],
+    "helm/fastapi-gitops-starter/values.yaml": [
+      {
+        "type": "Secret Keyword",
+        "filename": "helm/fastapi-gitops-starter/values.yaml",
+        "hashed_secret": "962e01ff6a135d92494aac7d57464e637cd88249",
+        "is_verified": false,
+        "line_number": 15
+      }
+    ]
+  },
+  "generated_at": "2026-03-07T09:38:08Z"
+}

README.md

@@ -3,7 +3,7 @@ GitOps with FastAPI
 
 ***University of Amsterdam***
 
-# 1. Introduction 
+# 1. Introduction
 
 In this tutorial, we use GitOps practices with FastAPI, including CI/CD pipelines, code quality tools, and automated testing.
 
@@ -35,7 +35,7 @@ In this tutorial, we use GitOps practices with FastAPI, including CI/CD pipeline
 
 
 
-# 2. Tutorial 
+# 2. Tutorial
 
 The steps of this tutorial are as follows:
 - [Building REST APIs with FastAPI](#21-setting-up-the-project)
@@ -60,17 +60,17 @@ Prerequisites:
    ```
 
 * Set Up the Python Environmentt:
-   
+
    ```bash
    # Create a virtual environment
    python -m venv venv
-   
+
    # Activate the virtual environment
    # On Linux/MacOS:
    source venv/bin/activate
    # On Windows:
    venv\Scripts\activate
-   
+
    # Install dependencies
    pip install -r requirements.txt
    ```
@@ -110,7 +110,7 @@ Prerequisites:
    ```bash
    # Check for issues
    ruff check app/ tests/
-   
+
    # Fix auto-fixable issues
    ruff check app/ tests/ --fix
    ```
@@ -120,7 +120,7 @@ Prerequisites:
    ```bash
    # Check formatting
    black --check app/ tests/
-   
+
    # Format code
    black app/ tests/
    ```
@@ -134,19 +134,19 @@ Pre-commit hooks automatically run checks before each commit to ensure consisten
    ```bash
    # Install pre-commit
    pip install pre-commit
-   
+
    # Install the git hooks
    pre-commit install
    ```
 
 * Using Pre-commit:
 
    Pre-commit will now run automatically on `git commit`. You can also run it manually:
-   
+
    ```bash
    # Run on all files
    pre-commit run --all-files
-   
+
    # Run on staged files
    pre-commit run
    ```
@@ -200,14 +200,14 @@ This repository includes a Helm chart for deploying the application to Kubernete
   - Kubernetes 1.19+
   - Helm 3.0+
 
-* Install the Helm Chart: 
+* Install the Helm Chart:
 
    ```bash
    helm install my-release ./helm/fastapi-gitops-starter
    ```
 
-* Uninstall the Helm Chart: 
-   
+* Uninstall the Helm Chart:
+
    ```bash
    helm uninstall my-release
    ```
@@ -239,7 +239,7 @@ including host and paths.
    * To make sure we do not commit secrets
    * To check code style
 
-  
+
 ## 3.2 Add a New Endpoint
 
 1. Open `app/main.py`
@@ -287,4 +287,4 @@ kubectl get hpa -n default -w
 ## 3.5 Questions
 
 1. The auto-scaling did not work as expected. What could be the possible reasons?
-2. How does Horizontal Pod Autoscaling (HPA) work in Kubernetes?
+2. How does Horizontal Pod Autoscaling (HPA) work in Kubernetes?

helm/fastapi-gitops-starter/example-values.yaml

@@ -28,5 +28,3 @@ autoscaling:
   minReplicas: 1
   maxReplicas: 3
   targetCPUUtilizationPercentage: 10
-
-

helm/fastapi-gitops-starter/secret-example-values.yaml

@@ -34,5 +34,3 @@ autoscaling:
   minReplicas: 1
   maxReplicas: 3
   targetCPUUtilizationPercentage: 10
-
-