chore(dev-tools): port bandit config to ruff#1033
Conversation
|
Auto-sync is disabled for ready for review pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
There was a problem hiding this comment.
Would it make sense to replace these in this PR?
rwgk-win11.localdomain:~/forked/cuda-python $ git grep nosec
cuda_bindings/tests/test_cuda.py: import subprocess # nosec B404
cuda_bindings/tests/test_cuda.py: ) # nosec B603, B607
cuda_bindings/tests/test_utils.py:import subprocess # nosec B404
cuda_bindings/tests/test_utils.py: subprocess.check_call( # nosec B603
cuda_core/tests/example_tests/utils.py: exec(script, env if env else {}) # nosec B102
cuda_core/tests/test_module.py:import pickle # nosec B403, B301
cuda_core/tests/test_module.py: result = pickle.loads(pickle.dumps(objcode)) # nosec B403, B301
cuda_pathfinder/cuda/pathfinder/_utils/platform_aware.py: from subprocess import list2cmdline # nosec B404
cuda_pathfinder/tests/spawned_process_runner.py: except Exception: # nosec B110
cuda_pathfinder/tests/spawned_process_runner.py: except Exception: # nosec B110
| - name: Perform Bandit Analysis using Ruff | ||
| uses: astral-sh/ruff-action@57714a7c8a2e59f32539362ba31877a1957dded1 # v3.5.1 | ||
| with: | ||
| args: "--select S --ignore S101,S311,S404 --config ruff.toml --output-format sarif --output-file results.sarif" |
There was a problem hiding this comment.
Is there any reasonable way we could consolidate the --ignore list here and the list in ruff.toml?
If not, could you please add 1-line comments in both places, to keep the lists in sync?
There was a problem hiding this comment.
We really need to avoid having so many "make sure to sync" comments littered everywhere. IME these basically never have the intended effect.
There was a problem hiding this comment.
I added a programmatic plucking of the desired ignore codes.
| - id: rst-directive-colons | ||
| - id: rst-inline-touching-normal | ||
|
|
||
| - repo: https://github.com/PyCQA/bandit |
|
Oh, sorry, you're replacing already! I overlooked change vs additions. Please disregard my other comment. |
|
There are still some |
|
Interesting, I'm not sure how those are not being picked up by ruff. Let me poke a bit. |
cpcloud
force-pushed
the
ruff-bandit
branch
from
fd365b0 to
bb79da7
Compare
|
/ok to test |
| # (ruff.toml, pyproject.toml, etc), so to avoid having keep everything | ||
| # in sync we grab them from the TOML programmatically | ||
| run: | | ||
| echo "codes=$(yj -tj < ./ruff.toml | jq '[.lint.ignore[] | select(test("^S\\d+"))] | join(",")' -r)" >> "$GITHUB_OUTPUT" |
|
/ok to test |
This comment has been minimized.
This comment has been minimized.
|
/ok to test |
|
/ok to test |
|
/ok to test |
|
|
While I complained about this change being a bit disruptive to open PRs, I do find the new linter runs a lot faster than the raw Bandit, so thanks a lot @cpcloud 🙂 |
leofang
added
enhancement
3 participants
Port our bandit config over to using ruff.