diff --git a/.aspect/bazelrc/correctness.bazelrc b/.aspect/bazelrc/correctness.bazelrc
index a23818444..84b51c258 100644
--- a/.aspect/bazelrc/correctness.bazelrc
+++ b/.aspect/bazelrc/correctness.bazelrc
@@ -46,7 +46,7 @@ build --incompatible_strict_action_env
 # Propagate tags from a target declaration to the actions' execution requirements.
 # Ensures that tags applied in your BUILD file, like `tags=["no-remote"]`
 # get propagated to actions created by the rule.
-# Without this option, you rely on rules authors to manually check the tags you passed 
+# Without this option, you rely on rules authors to manually check the tags you passed
 # and apply relevant ones to the actions they create.
 # See https://github.com/bazelbuild/bazel/issues/8830 for details.
 # Docs: https://bazel.build/reference/command-line-reference#flag--experimental_allow_tags_propagation
diff --git a/.bazelignore b/.bazelignore
index 255941333..b1e3af62d 100644
--- a/.bazelignore
+++ b/.bazelignore
@@ -1 +1 @@
-e2e/
\ No newline at end of file
+e2e/
diff --git a/.github/workflows/ci.bazelrc b/.github/workflows/ci.bazelrc
index c5e73e539..4b359efdb 100644
--- a/.github/workflows/ci.bazelrc
+++ b/.github/workflows/ci.bazelrc
@@ -25,4 +25,4 @@ build:rbe --remote_executor=grpcs://tourmaline.cluster.engflow.com
 build:rbe --modify_execution_info=GoCompilePkg=+no-remote-exec
 
 # These files are written during CI setup, using secrets registered with the CI platforms
-build:rbe --tls_client_certificate=engflow.crt --tls_client_key=engflow.key
\ No newline at end of file
+build:rbe --tls_client_certificate=engflow.crt --tls_client_key=engflow.key
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index cd740bd53..4754debc9 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -24,3 +24,15 @@ repos:
     rev: "v2.4.0"
     hooks:
       - id: prettier
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.4.0
+    hooks:
+      - id: check-added-large-files
+      - id: check-byte-order-marker
+      - id: check-case-conflict
+      - id: check-symlinks
+      - id: destroyed-symlinks
+      - id: end-of-file-fixer
+        exclude: &exclude_pattern "^(docs|e2e|lib/tests)/"
+      - id: mixed-line-ending
+      - id: trailing-whitespace
diff --git a/.prettierignore b/.prettierignore
index 51ed124e4..260349414 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -4,4 +4,4 @@ lib/tests/jq/*.json
 lib/tests/yq/empty.yaml
 lib/lib/tests/write_source_files/*.js
 lib/lib/tests/write_source_files/subdir/*.js
-lib/lib/tests/write_source_files/subdir/subsubdir/*.js
\ No newline at end of file
+lib/lib/tests/write_source_files/subdir/subsubdir/*.js
diff --git a/LICENSE b/LICENSE
index e454a5258..f433b1a53 100644
--- a/LICENSE
+++ b/LICENSE
@@ -175,4 +175,3 @@
       of your accepting any such warranty or additional liability.
 
    END OF TERMS AND CONDITIONS
-
diff --git a/docs/copy_to_directory.md b/docs/copy_to_directory.md
index cf0723461..36eff7957 100644
--- a/docs/copy_to_directory.md
+++ b/docs/copy_to_directory.md
@@ -61,7 +61,7 @@ for more information on supported globbing patterns.
 | <a id="copy_to_directory-include_srcs_packages"></a>include_srcs_packages |  List of Bazel packages (with glob support) to include in output directory.<br><br>Files in srcs are only copied to the output directory if the Bazel package of the file matches one of the patterns specified.<br><br>Forward slashes (<code>/</code>) should be used as path separators. A first character of <code>"."</code> will be replaced by the target's package path.<br><br>Defaults to <code>["**"]</code> which includes sources from all packages.<br><br>Files that have matching Bazel packages are subject to subsequent filters and transformations to determine if they are copied and what their path in the output directory will be.<br><br>Globs are supported (see rule docstring above).   | List of strings | optional | ["**"] |
 | <a id="copy_to_directory-include_srcs_patterns"></a>include_srcs_patterns |  List of paths (with glob support) to include in output directory.<br><br>Files in srcs are only copied to the output directory if their output directory path, after applying <code>root_paths</code>, matches one of the patterns specified.<br><br>Forward slashes (<code>/</code>) should be used as path separators.<br><br>Defaults to <code>["**"]</code> which includes all sources.<br><br>Files that have matching output directory paths are subject to subsequent filters and transformations to determine if they are copied and what their path in the output directory will be.<br><br>Globs are supported (see rule docstring above).   | List of strings | optional | ["**"] |
 | <a id="copy_to_directory-out"></a>out |  Path of the output directory, relative to this package.<br><br>If not set, the name of the target is used.   | String | optional | "" |
-| <a id="copy_to_directory-replace_prefixes"></a>replace_prefixes |  Map of paths prefixes (with glob support) to replace in the output directory path when copying files.<br><br>If the output directory path for a file starts with or fully matches a a key in the dict then the matching portion of the output directory path is replaced with the dict value for that key. The final path segment matched can be a partial match of that segment and only the matching portion will be replaced. If there are multiple keys that match, the longest match wins.<br><br>Forward slashes (<code>/</code>) should be used as path separators. <br><br>Replace prefix transformation are the final step in the list of filters and transformations. The final output path of a file being copied into the output directory is determined at this step.<br><br>Globs are supported (see rule docstring above).   | <a href="https://bazel.build/docs/skylark/lib/dict.html">Dictionary: String -> String</a> | optional | {} |
+| <a id="copy_to_directory-replace_prefixes"></a>replace_prefixes |  Map of paths prefixes (with glob support) to replace in the output directory path when copying files.<br><br>If the output directory path for a file starts with or fully matches a a key in the dict then the matching portion of the output directory path is replaced with the dict value for that key. The final path segment matched can be a partial match of that segment and only the matching portion will be replaced. If there are multiple keys that match, the longest match wins.<br><br>Forward slashes (<code>/</code>) should be used as path separators.<br><br>Replace prefix transformation are the final step in the list of filters and transformations. The final output path of a file being copied into the output directory is determined at this step.<br><br>Globs are supported (see rule docstring above).   | <a href="https://bazel.build/docs/skylark/lib/dict.html">Dictionary: String -> String</a> | optional | {} |
 | <a id="copy_to_directory-root_paths"></a>root_paths |  List of paths (with glob support) that are roots in the output directory.<br><br>If any parent directory of a file being copied matches one of the root paths patterns specified, the output directory path will be the path relative to the root path instead of the path relative to the file's workspace. If there are multiple root paths that match, the longest match wins.<br><br>Matching is done on the parent directory of the output file path so a trailing '**' glob patterm will match only up to the last path segment of the dirname and will not include the basename. Only complete path segments are matched. Partial matches on the last segment of the root path are ignored.<br><br>Forward slashes (<code>/</code>) should be used as path separators.<br><br>A <code>"."</code> value expands to the target's package path (<code>ctx.label.package</code>).<br><br>Defaults to <code>["."]</code> which results in the output directory path of files in the target's package and and sub-packages are relative to the target's package and files outside of that retain their full workspace relative paths.<br><br>Globs are supported (see rule docstring above).   | List of strings | optional | ["."] |
 | <a id="copy_to_directory-srcs"></a>srcs |  Files and/or directories or targets that provide <code>DirectoryPathInfo</code> to copy into the output directory.   | <a href="https://bazel.build/docs/build-ref.html#labels">List of labels</a> | optional | [] |
 | <a id="copy_to_directory-verbose"></a>verbose |  If true, prints out verbose logs to stdout   | Boolean | optional | False |
diff --git a/docs/expand_make_vars.md b/docs/expand_make_vars.md
index 70fa24a6d..5c59b393e 100644
--- a/docs/expand_make_vars.md
+++ b/docs/expand_make_vars.md
@@ -11,7 +11,7 @@ expand_template(<a href="#expand_template-name">name</a>, <a href="#expand_templ
 </pre>
 
 Template expansion
-    
+
 This performs a simple search over the template file for the keys in substitutions,
 and replaces them with the corresponding values.
 
diff --git a/docs/templates/func_html.vm b/docs/templates/func_html.vm
index 9809a4ee5..8ca66a9f8 100644
--- a/docs/templates/func_html.vm
+++ b/docs/templates/func_html.vm
@@ -46,4 +46,4 @@ ${funcInfo.getReturn().docString}
 #[[###]]# **Deprecated**
 
 ${funcInfo.getDeprecated().docString}
-#end
\ No newline at end of file
+#end
diff --git a/docs/templates/rule_html.vm b/docs/templates/rule_html.vm
index 09d259cef..a7a37efc6 100644
--- a/docs/templates/rule_html.vm
+++ b/docs/templates/rule_html.vm
@@ -34,4 +34,4 @@ ${ruleInfo.docString}
 #foreach ($attribute in $ruleInfo.getAttributeList())
 | <a id="${ruleName}-${attribute.name}"></a>$attribute.name | #if(!$attribute.docString.isEmpty()) #markdownCellFormatNoEscapeHtml( $attribute.docString ) #else - #end  | ${util.attributeTypeString($attribute)} | ${util.mandatoryString($attribute)} | $attribute.defaultValue |
 #end
-#end
\ No newline at end of file
+#end
diff --git a/internal_deps.bzl b/internal_deps.bzl
index f8caed359..5ab3aa81f 100644
--- a/internal_deps.bzl
+++ b/internal_deps.bzl
@@ -4,7 +4,7 @@ Users should *not* need to install these. If users see a load()
 statement from these, that's a bug in our distribution.
 """
 
-load("//lib:repositories.bzl", "register_jq_toolchains", "register_yq_toolchains", "register_coreutils_toolchains")
+load("//lib:repositories.bzl", "register_coreutils_toolchains", "register_jq_toolchains", "register_yq_toolchains")
 load("//lib:utils.bzl", http_archive = "maybe_http_archive")
 
 # buildifier: disable=unnamed-macro
diff --git a/lib/glob_match.bzl b/lib/glob_match.bzl
index d8d3eef99..d835ead57 100644
--- a/lib/glob_match.bzl
+++ b/lib/glob_match.bzl
@@ -3,4 +3,4 @@
 load("//lib/private:glob_match.bzl", _glob_match = "glob_match", _is_glob = "is_glob")
 
 glob_match = _glob_match
-is_glob = _is_glob
\ No newline at end of file
+is_glob = _is_glob
diff --git a/lib/private/copy_to_directory.bzl b/lib/private/copy_to_directory.bzl
index 328e5d277..5abf1cb60 100644
--- a/lib/private/copy_to_directory.bzl
+++ b/lib/private/copy_to_directory.bzl
@@ -195,7 +195,7 @@ replaced with the dict value for that key. The final path segment
 matched can be a partial match of that segment and only the matching portion will
 be replaced. If there are multiple keys that match, the longest match wins.
 
-Forward slashes (`/`) should be used as path separators. 
+Forward slashes (`/`) should be used as path separators.
 
 Replace prefix transformation are the final step in the list of filters and transformations.
 The final output path of a file being copied into the output directory
diff --git a/lib/private/coreutils_toolchain.bzl b/lib/private/coreutils_toolchain.bzl
index f0771b5a2..781dfaa19 100644
--- a/lib/private/coreutils_toolchain.bzl
+++ b/lib/private/coreutils_toolchain.bzl
@@ -41,24 +41,24 @@ DEFAULT_COREUTILS_VERSION = "0.0.16"
 # The integrity hashes can be automatically fetched for the coreutils releases by running
 # `tools/coreutils_mirror_release.sh`.
 COREUTILS_VERSIONS = {
-  "0.0.16": {
-    "linux_arm64": {
-      "filename": "coreutils-0.0.16-aarch64-unknown-linux-gnu.tar.gz",
-      "sha256": "sha256-6tExkcMMHe7+59M9Mp9UKeq+g0y+juO7oakZfVOtOqw="
+    "0.0.16": {
+        "linux_arm64": {
+            "filename": "coreutils-0.0.16-aarch64-unknown-linux-gnu.tar.gz",
+            "sha256": "sha256-6tExkcMMHe7+59M9Mp9UKeq+g0y+juO7oakZfVOtOqw=",
+        },
+        "darwin_amd64": {
+            "filename": "coreutils-0.0.16-x86_64-apple-darwin.tar.gz",
+            "sha256": "sha256-lQYWAuPOKS6XxwArZdiKIyczwppTVwjF4ml0iKBaB9s=",
+        },
+        "windows_amd64": {
+            "filename": "coreutils-0.0.16-x86_64-pc-windows-msvc.zip",
+            "sha256": "sha256-z5E1onYAKZoaUt2U1cv1t8UHPsJinYktEd6SpE2u07o=",
+        },
+        "linux_amd64": {
+            "filename": "coreutils-0.0.16-x86_64-unknown-linux-gnu.tar.gz",
+            "sha256": "sha256-Slf4qKf19sAWoK2pUVluAitmL3N2uz4eWpV4eibIEW0=",
+        },
     },
-    "darwin_amd64": {
-      "filename": "coreutils-0.0.16-x86_64-apple-darwin.tar.gz",
-      "sha256": "sha256-lQYWAuPOKS6XxwArZdiKIyczwppTVwjF4ml0iKBaB9s="
-    },
-    "windows_amd64": {
-      "filename": "coreutils-0.0.16-x86_64-pc-windows-msvc.zip",
-      "sha256": "sha256-z5E1onYAKZoaUt2U1cv1t8UHPsJinYktEd6SpE2u07o="
-    },
-    "linux_amd64": {
-      "filename": "coreutils-0.0.16-x86_64-unknown-linux-gnu.tar.gz",
-      "sha256": "sha256-Slf4qKf19sAWoK2pUVluAitmL3N2uz4eWpV4eibIEW0="
-    }
-  }
 }
 
 CoreUtilsInfo = provider(
@@ -99,7 +99,7 @@ coreutils_toolchain = rule(
     attrs = {
         "binary": attr.label(
             mandatory = True,
-            allow_single_file = True
+            allow_single_file = True,
         ),
     },
 )
@@ -176,7 +176,7 @@ def _coreutils_platform_repo_impl(rctx):
     filename = COREUTILS_VERSIONS[rctx.attr.version][platform]["filename"]
     url = "https://github.com/uutils/coreutils/releases/download/{}/{}".format(
         rctx.attr.version,
-        filename
+        filename,
     )
     rctx.download_and_extract(
         url = url,
diff --git a/lib/private/diff_test_tmpl.sh b/lib/private/diff_test_tmpl.sh
index c32f50fef..7660b592e 100644
--- a/lib/private/diff_test_tmpl.sh
+++ b/lib/private/diff_test_tmpl.sh
@@ -57,4 +57,3 @@ else
     fail "files \"{file1}\" and \"{file2}\" differ. {fail_msg}"
   fi
 fi
-
diff --git a/lib/private/expand_template.bzl b/lib/private/expand_template.bzl
index 2377029a6..20a0a6277 100644
--- a/lib/private/expand_template.bzl
+++ b/lib/private/expand_template.bzl
@@ -19,7 +19,7 @@ def _expand_template_impl(ctx):
 
 expand_template_lib = struct(
     doc = """Template expansion
-    
+
 This performs a simple search over the template file for the keys in substitutions,
 and replaces them with the corresponding values.
 
diff --git a/lib/private/host_repo.bzl b/lib/private/host_repo.bzl
index d15c0a316..b80b34412 100644
--- a/lib/private/host_repo.bzl
+++ b/lib/private/host_repo.bzl
@@ -6,7 +6,7 @@ load(":repo_utils.bzl", "repo_utils")
 def _host_repo_impl(rctx):
     # Base BUILD file for this repository
     rctx.file("BUILD.bazel", """# @generated by @aspect_bazel_lib//lib/private:host_repo.bzl
-load("@bazel_skylib//:bzl_library.bzl", "bzl_library")    
+load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
 bzl_library(
     name = "defs",
     srcs = ["defs.bzl"],
diff --git a/lib/private/local_config_platform.bzl b/lib/private/local_config_platform.bzl
index 9af0fca89..1e755d486 100644
--- a/lib/private/local_config_platform.bzl
+++ b/lib/private/local_config_platform.bzl
@@ -32,7 +32,7 @@ exports_files([
 local_config_platform = repository_rule(
     implementation = _impl,
     doc = """Generates a repository in the same shape as the auto-generated @local_config_platform repository with an added bzl_library.
-    
+
     This is useful for rules that want to load `HOST_CONSTRAINTS` from `@local_config_platform//:constraints.bzl` and
     also want to use stardoc for generating documentation.
     """,
diff --git a/lib/private/output_files.bzl b/lib/private/output_files.bzl
index 1e7b59687..af018f6cc 100644
--- a/lib/private/output_files.bzl
+++ b/lib/private/output_files.bzl
@@ -85,4 +85,4 @@ def _find_short_path_in_files_list(files_list, short_path):
     for file in files_list:
         if file.short_path == short_path:
             return file
-    return None
\ No newline at end of file
+    return None
diff --git a/lib/private/parse_status_file.jq b/lib/private/parse_status_file.jq
index 4008f1f8b..2d63fb983 100644
--- a/lib/private/parse_status_file.jq
+++ b/lib/private/parse_status_file.jq
@@ -1,4 +1,4 @@
-[                                           
+[
   split("\n")[]                                     # Convert lines to array
   | capture("(?<key>[^\\s]+)\\s+(?<value>.*)"; "x") # capture {"key": [everything before first whitespace], "value": [remainder of line]}
 ]
diff --git a/lib/tests/glob_match_test.bzl b/lib/tests/glob_match_test.bzl
index 9d5bb41fc..4052b8d8c 100644
--- a/lib/tests/glob_match_test.bzl
+++ b/lib/tests/glob_match_test.bzl
@@ -166,7 +166,6 @@ def _mixed_wrapping_globstar(ctx):
 
 mixed_wrapper_globstar_test = unittest.make(_mixed_wrapping_globstar)
 
-
 def _is_glob(ctx):
     env = unittest.begin(ctx)
 
@@ -218,5 +217,5 @@ def glob_match_test_suite():
 
     unittest.suite(
         "is_glob",
-        partial.make(is_glob_test, timeout = "short")
+        partial.make(is_glob_test, timeout = "short"),
     )
diff --git a/renovate.json b/renovate.json
index f45d8f110..4f39080e4 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,5 +1,3 @@
 {
-  "extends": [
-    "config:base"
-  ]
+  "extends": ["config:base"]
 }
diff --git a/tools/copy_directory/mirror_release.sh b/tools/copy_directory/mirror_release.sh
index d28c0a413..19ef54f55 100755
--- a/tools/copy_directory/mirror_release.sh
+++ b/tools/copy_directory/mirror_release.sh
@@ -28,4 +28,4 @@ done
 echo "}"
 
 printf "\n"
-echo "Paste the above into lib/private/copy_directory_toolchain.bzl"
\ No newline at end of file
+echo "Paste the above into lib/private/copy_directory_toolchain.bzl"
diff --git a/tools/copy_to_directory/mirror_release.sh b/tools/copy_to_directory/mirror_release.sh
index a48aeca76..38fbdf146 100755
--- a/tools/copy_to_directory/mirror_release.sh
+++ b/tools/copy_to_directory/mirror_release.sh
@@ -28,4 +28,4 @@ done
 echo "}"
 
 printf "\n"
-echo "Paste the above into lib/private/copy_to_directory_toolchain.bzl"
\ No newline at end of file
+echo "Paste the above into lib/private/copy_to_directory_toolchain.bzl"
diff --git a/tools/coreutils_mirror_release.sh b/tools/coreutils_mirror_release.sh
index 135a68cb9..580f79236 100755
--- a/tools/coreutils_mirror_release.sh
+++ b/tools/coreutils_mirror_release.sh
@@ -4,40 +4,40 @@ set -o errexit -o nounset -o pipefail
 
 JQ_FILTER=\
 'map({
-    "key": .tag_name, 
-    "value": .assets 
-        | map(select( 
-            (.name | startswith("coreutils-")) and 
+    "key": .tag_name,
+    "value": .assets
+        | map(select(
+            (.name | startswith("coreutils-")) and
             ((.name | endswith(".tar.gz")) or (.name | endswith(".zip"))) and
             (.name | contains("i686") | not) and
             (
-                ( (.name | contains("windows")) and (.name | contains("gnu") | not) ) or 
-                ( (.name | contains("windows") | not) and (.name | contains("gnu") ) and (.name | contains("gnueabihf") | not) ) or 
+                ( (.name | contains("windows")) and (.name | contains("gnu") | not) ) or
+                ( (.name | contains("windows") | not) and (.name | contains("gnu") ) and (.name | contains("gnueabihf") | not) ) or
                 ( .name | contains("darwin") )
             )
         ))
-        | map({ 
-            key: .name | 
-                ltrimstr("coreutils-") | 
-                rtrimstr(".tar.gz") | 
-                rtrimstr(".zip") | 
-                sub("-pc"; "") | 
+        | map({
+            key: .name |
+                ltrimstr("coreutils-") |
+                rtrimstr(".tar.gz") |
+                rtrimstr(".zip") |
+                sub("-pc"; "") |
                 sub("-apple"; "") |
                 sub("-unknown"; "") |
                 sub("x86_64"; "amd64") |
                 sub("aarch64"; "arm64") |
-                gsub("\\d+.\\d+.\\d+-"; "") | 
-                rtrimstr("-msvc") | 
+                gsub("\\d+.\\d+.\\d+-"; "") |
+                rtrimstr("-msvc") |
                 rtrimstr("-gnu") |
                 split("-") |
                 reverse |
                 join("_"),
             value: {
-                filename: .name, 
-                sha256: "sha256-", 
-            } 
+                filename: .name,
+                sha256: "sha256-",
+            }
         })
-        | from_entries 
+        | from_entries
 }) | from_entries
 '
 
@@ -45,9 +45,9 @@ JQ_FILTER=\
 INFO="$(curl --silent -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/uutils/coreutils/releases?per_page=1 | jq "$JQ_FILTER")"
 
 
-for VERSION in $(jq -r 'keys | join("\n")' <<< $INFO); do 
-    for PLATFORM in $(jq -r ".[\"$VERSION\"] | keys | join(\"\n\")" <<< $INFO); do 
-        FILENAME=$(jq -r ".[\"$VERSION\"][\"$PLATFORM\"].filename" <<< $INFO) 
+for VERSION in $(jq -r 'keys | join("\n")' <<< $INFO); do
+    for PLATFORM in $(jq -r ".[\"$VERSION\"] | keys | join(\"\n\")" <<< $INFO); do
+        FILENAME=$(jq -r ".[\"$VERSION\"][\"$PLATFORM\"].filename" <<< $INFO)
         SHA256=$(curl -fLs "https://github.com/uutils/coreutils/releases/download/$VERSION/$FILENAME" | sha256sum | xxd -r -p | base64)
         INFO=$(jq ".[\"$VERSION\"][\"$PLATFORM\"].sha256 = \"sha256-$SHA256\"" <<< $INFO)
     done
@@ -57,4 +57,4 @@ echo -n "COREUTILS_VERSIONS = "
 echo $INFO | jq -M
 
 echo ""
-echo "Copy the version info into lib/private/coreutils_toolchain.bzl"
\ No newline at end of file
+echo "Copy the version info into lib/private/coreutils_toolchain.bzl"
diff --git a/tools/yq_mirror_release.sh b/tools/yq_mirror_release.sh
index 261eeda35..951298e06 100755
--- a/tools/yq_mirror_release.sh
+++ b/tools/yq_mirror_release.sh
@@ -32,4 +32,4 @@ done
 echo "},"
 
 printf "\n"
-echo "Paste the above into VERSIONS in yq_toolchain.bzl."
\ No newline at end of file
+echo "Paste the above into VERSIONS in yq_toolchain.bzl."