Have ruff apply to securedrop/scripts/ too

[legoktm]

Status

Ready for review

Description of Changes

These need explicit mentioning since they don't have a .py extension.

The E402 error now applies to the imports following the sys.path.append() call, so move them around.

KOG Update:

• added a fix for make typelint fails locally due to path interpolation #6930 as make lint was failing locally
• updated the precommit hook to stay limited to .py files, as ruff got indigestion trying to lint a bash script.
• recusing myself from review as a result :(

Testing

• Visual review
• CI passes

Checklist

• Linting (make lint) and tests (make test) pass in the development container

[legoktm]

updated the precommit hook to stay limited to .py files, as ruff got indigestion trying to lint a bash script.

This shouldn't be necessary, running ruff check . should only lint Python files already, since that's what make ruff does...

[legoktm]

I edited the commit message to fix the issue. I kept the precommit hook commit, but I think it should be dropped or needs more detail on what went wrong.

[zenmonkeykstop]

Oh - iirc it was trying to lint the run-mypy bash script (which was also a problem due to a bad regex in the original hook).

[rocodes]

I'm also mildly confused-- reverting to 3f4353e (so no changes to the pre-commit hook) also works just fine for me, and make typelint, make lint, make rust-lint etc are all perfectly happy without that change.

[zenmonkeykstop]

I'm also mildly confused-- reverting to 3f4353e (so no changes to the pre-commit hook) also works just fine for me, and make typelint, make lint, make rust-lint etc are all perfectly happy without that change.

The error is only triggered if there's a change in run-mypy. Try:

• reverting the commit with the hook change
• adding a trivial change (# i'm a comment!) in securedrop/bin/run-mypy
• adding and committing it

It's happening because the hook only checks anything if there is a match for *py files, and ruff is trying to parse run-mypy as a .py file. Changing the regex to match *.py and running ruff on only matching files solves that. (Yes it's super edge-casey.)

[legoktm]

Thanks for the details:

and ruff is trying to parse run-mypy as a .py file

This is the real problem IMO because it means that even make ruff could trigger it. So I'll look into fixing that filtering and having the git hook continue to call plain ruff check .

[legoktm]

@zenmonkeykstop what's the output of ruff check . --show-files on your machine? On mine it doesn't include run-mypy so ruff really shouldn't be linting it...

[rocodes]

(I'm not kev, but I am chiming in to say that run-mypy is also not in my list of files checked by ruff per ruff check . --show-files)

[zenmonkeykstop]

I'm so dumb - the failure comes from the black check immediately beforehand in the hook, which does take a list of files. Sooo the regex still needs fixing for that case, but the resultant list of files is fed to black, not ruff.

[rocodes]

(Ready for re-review)

[legoktm]

This comment should be left as it was originally

[legoktm]

LGTM! (can't approve my own PR)

[zenmonkeykstop]

also LGTM