1 files changed, 48 insertions, 3 deletions
diff --git a/pre_commit/clientlib.py b/pre_commit/clientlib.py
index 20d4492..8f35057 100644
--- a/pre_commit/clientlib.py
+++ b/pre_commit/clientlib.py
@@ -1,6 +1,7 @@
 import argparse
 import functools
 import logging
+import re
 import shlex
 import sys
 from typing import Any
@@ -112,7 +113,26 @@ LOCAL = 'local'
 META = 'meta'
 
 
-class OptionalSensibleRegex(cfgv.OptionalNoDefault):
+# should inherit from cfgv.Conditional if sha support is dropped
+class WarnMutableRev(cfgv.ConditionalOptional):
+    def check(self, dct: Dict[str, Any]) -> None:
+        super().check(dct)
+
+        if self.key in dct:
+            rev = dct[self.key]
+
+            if '.' not in rev and not re.match(r'^[a-fA-F0-9]+$', rev):
+                logger.warning(
+                    f'The {self.key!r} field of repo {dct["repo"]!r} '
+                    f'appears to be a mutable reference '
+                    f'(moving tag / branch).  Mutable references are never '
+                    f'updated after first install and are not supported.  '
+                    f'See https://pre-commit.com/#using-the-latest-version-for-a-repository '  # noqa: E501
+                    f'for more details.',
+                )
+
+
+class OptionalSensibleRegexAtHook(cfgv.OptionalNoDefault):
     def check(self, dct: Dict[str, Any]) -> None:
         super().check(dct)
 
@@ -124,6 +144,17 @@ class OptionalSensibleRegex(cfgv.OptionalNoDefault):
             )
 
 
+class OptionalSensibleRegexAtTop(cfgv.OptionalNoDefault):
+    def check(self, dct: Dict[str, Any]) -> None:
+        super().check(dct)
+
+        if '/*' in dct.get(self.key, ''):
+            logger.warning(
+                f'The top-level {self.key!r} field is a regex, not a glob -- '
+                f"matching '/*' probably isn't what you want here",
+            )
+
+
 class MigrateShaToRev:
     key = 'rev'
 
@@ -239,8 +270,8 @@ CONFIG_HOOK_DICT = cfgv.Map(
         for item in MANIFEST_HOOK_DICT.items
         if item.key != 'id'
     ),
-    OptionalSensibleRegex('files', cfgv.check_string),
-    OptionalSensibleRegex('exclude', cfgv.check_string),
+    OptionalSensibleRegexAtHook('files', cfgv.check_string),
+    OptionalSensibleRegexAtHook('exclude', cfgv.check_string),
 )
 CONFIG_REPO_DICT = cfgv.Map(
     'Repository', 'repo',
@@ -261,6 +292,14 @@ CONFIG_REPO_DICT = cfgv.Map(
     ),
 
     MigrateShaToRev(),
+    WarnMutableRev(
+        'rev',
+        cfgv.check_string,
+        '',
+        'repo',
+        cfgv.NotIn(LOCAL, META),
+        True,
+    ),
     cfgv.WarnAdditionalKeys(('repo', 'rev', 'hooks'), warn_unknown_keys_repo),
 )
 DEFAULT_LANGUAGE_VERSION = cfgv.Map(
@@ -297,9 +336,15 @@ CONFIG_SCHEMA = cfgv.Map(
             'exclude',
             'fail_fast',
             'minimum_pre_commit_version',
+            'ci',
         ),
         warn_unknown_keys_root,
     ),
+    OptionalSensibleRegexAtTop('files', cfgv.check_string),
+    OptionalSensibleRegexAtTop('exclude', cfgv.check_string),
+
+    # do not warn about configuration for pre-commit.ci
+    cfgv.OptionalNoDefault('ci', cfgv.check_type(dict)),
 )