more pre-commit stuff

.envrc

···
-watch_file modules/flake/dev-shell/default.nix
-watch_file modules/flake/formatter/default.nix
+watch_file modules/flake/**/*
 
 use flake

modules/flake/default.nix

···
     ./dev-shell
     ./formatter
     ./lib
+    ./pre-commit
   ];
 
   perSystem.pkgsDirectory = ../../pkgs;

modules/flake/dev-shell/default.nix

···
     {
       devShells.default = pkgs.mkShell {
         shellHook = config.pre-commit.installationScript;
-        buildInputs = with pkgs; [
-          sops
-          age
-        ];
+
+        buildInputs =
+          with pkgs;
+          [
+            sops
+            age
+          ]
+          ++ config.pre-commit.settings.enabledPackages;
       };
     };
 }

modules/flake/formatter/default.nix

···
-{ inputs, ... }:
 {
-  imports = [ inputs.git-hooks.flakeModule ];
-
   perSystem =
-    { pkgs, config, ... }:
+    { pkgs, ... }:
     {
-      pre-commit.settings.hooks.treefmt = {
-        enable = true;
-        package = config.formatter;
-      };
-
       formatter = pkgs.treefmt.withConfig {
         runtimeInputs = with pkgs; [
           # keep-sorted start

modules/flake/pre-commit/default.nix

···
+{ inputs, ... }:
+{
+  imports = [ inputs.git-hooks.flakeModule ];
+
+  perSystem =
+    { config, ... }:
+    {
+      pre-commit.settings.hooks = {
+        treefmt = {
+          enable = true;
+          package = config.formatter;
+        };
+        pre-commit-hook-ensure-sops.enable = true;
+        ripsecrets.enable = true;
+      };
+    };
+}