version: 0.1 cli: version: 1.25.0 plugins: sources: - id: trunk ref: v1.10.2 uri: https://github.com/trunk-io/plugins lint: # Custom file set + formatter that rewrites Unicode em-dash (U+2014, UTF-8 # bytes e2 80 94) and en-dash (U+2013, UTF-8 bytes e2 80 93) to an ASCII # hyphen. The sed pattern matches the byte sequences under LC_ALL=C rather # than literal characters on purpose, so the rule survives editors/hooks # that themselves strip Unicode dashes. These dashes only ever appear in # comments and log/error strings (LLM-authored prose), never in code, so # the rewrite is purely cosmetic. Runs under `trunk fmt`; enforced by # `trunk check` and the trunk-fmt-pre-commit action. files: - name: ascii-dash-targets extensions: - c - cc - cpp - h - hpp - ino - md - py - sh - yaml - yml - json - toml - ini - name: cpp-sources extensions: - c - cc - cpp - cxx - h - hh - hpp - hxx - ino definitions: - name: ascii-dash files: [ascii-dash-targets] commands: - name: format output: rewrite formatter: true run: env LC_ALL=C sed -e 's/\xe2\x80\x94/-/g' -e 's/\xe2\x80\x93/-/g' ${target} success_codes: [0] # Flags preprocessor conditionals that contain too many defined() terms # (e.g. the 13-driver display chains in main.cpp). The compiler has no # warning for this; the fix is an umbrella feature macro (HAS_TFT / # HAS_SCREEN, already in src/configuration.h). Tune the limit via # MAX_DEFINED in bin/lint-ifdef-complexity.sh (default 5 -> warns at 6+). - name: too-many-defined files: [cpp-sources] commands: - name: lint output: regex parse_regex: (?P.+):(?P\d+):(?P\d+):(?P\w+):(?P.+):(?P[a-z-]+) run: ${workspace}/bin/lint-ifdef-complexity.sh ${target} success_codes: [0] read_output_from: stdout # Flags node/packet IDs logged as bare %08x instead of the 0x%08x convention in # src/mesh/RadioInterface.cpp. Emits "note", trunk's only non-blocking level, so it # advises without gating - including on the known pre-existing sites, which are left # unlisted so they get cleaned up by whoever next edits those files. - name: node-id-format files: [cpp-sources] commands: - name: lint output: regex parse_regex: (?P.+):(?P\d+):(?P\d+):(?P\w+):(?P.+):(?P[a-z-]+) run: ${workspace}/bin/lint-node-id-format.sh ${target} success_codes: [0] read_output_from: stdout # Flags a UNITY_END() not wrapped in exit(). A bare one ends the reporting, not the suite: # the runtime keeps calling loop(), so the process never exits, its sandbox is deleted # underneath it, and its .gcda and LeakSanitizer report never flush. Emits "note" because the # enforcing half is bin/pio-test-isolate.sh, which catches an actual survivor at run time. - name: unity-exit files: [cpp-sources] commands: - name: lint output: regex parse_regex: (?P.+):(?P\d+):(?P\d+):(?P\w+):(?P.+):(?P[a-z-]+) run: ${workspace}/bin/lint-unity-exit.sh ${target} success_codes: [0] read_output_from: stdout enabled: - ascii-dash@SYSTEM - too-many-defined@SYSTEM - node-id-format@SYSTEM - unity-exit@SYSTEM - checkov@3.3.8 - renovate@44.2.3 - prettier@3.9.6 - trufflehog@3.96.0 - yamllint@1.38.0 - bandit@1.9.4 - trivy@0.72.0 - taplo@0.10.0 - ruff@0.16.0 - isort@8.0.1 - markdownlint@0.49.1 - oxipng@10.1.1 - svgo@4.0.2 - actionlint@1.7.12 - flake8@7.3.0 - hadolint@2.14.0 - shfmt@3.6.0 - shellcheck@0.11.0 - black@26.5.1 - git-diff-check - gitleaks@8.30.1 - clang-format@16.0.3 ignore: - linters: [ALL] paths: - bin/** # Fake-NodeDB fixture JSONL files contain deterministic synthetic # public_key_hex (64-char hex) values that gitleaks misidentifies as # generic-api-key. These are not secrets - they're test fixtures # produced by bin/gen-fake-nodedb-seed.py with a fixed RNG seed. - linters: [gitleaks] paths: - test/fixtures/nodedb/seed_v25_*.jsonl # Deliberately broken YAML: these are the inputs to bin/test-config-check.sh, # which asserts that `meshtasticd --check` reports each planted fault. Prettier # rejects the duplicate keys and bad indentation that are the whole point of # them, so the directory is exempt. The README there is normal prose and stays # linted. - linters: [ALL] paths: - test/fixtures/portduino-config/**/*.yaml # checkov/CKV_SECRET_6 flags the commented-out "large4cats" example, # which is the public default credential for the meshtastic.org MQTT # broker rather than a real secret. Ignore the whole file so the # example config stays free of lint-suppression comments. - linters: [ALL] paths: - userPrefs.jsonc # The UA font's em/en dashes live only in trailing comments documenting # each glyph's codepoint (e.g. "8212=:2549"); rewriting them would make # those docs inaccurate. Glyph byte data is unaffected either way. - linters: [ascii-dash] paths: - src/graphics/fonts/** # millis()-wraparound tests pin dense clusters of hex boundary constants # (0xFFFFFF00u and neighbors). trufflehog's Lob detector stitches nearby # hex literals into one candidate string and the result happens to match # a Lob API key shape. Not secrets - deterministic test fixtures for the # 32-bit rollover. - linters: [trufflehog] paths: - test/test_airtime/test_main.cpp - test/test_throttle/test_main.cpp - test/test_uptime_clock/test_main.cpp runtimes: enabled: - python@3.14.4 - go@1.21.0 - node@22.16.0 actions: disabled: - trunk-announce enabled: - trunk-fmt-pre-commit - trunk-check-pre-push - trunk-upgrade-available