refactor(lint): read through the cached helpers instead of around them

Three modules reimplemented what utils.cache already offers, and each paid
for it with a suppression.

test_compose_override_services_defined carried a yaml.SafeLoader subclass
whose only job was to swallow compose's own tags, plus a noqa for the
yaml.load rule it then tripped. load_yaml_any handles !override and !reset
already, so the loader and the suppression both go.

test_compose_bind_sources_exist read default.env directly and argued in a
nocheck marker that once per session is fine. Reading it through
utils.cache.files makes the argument unnecessary.

test_gpu_gate loaded the role's vars and meta files with raw yaml over
hand-assembled paths; it now uses load_yaml with ROLE_FILE_VARS_MAIN and
ROLE_FILE_META_SERVICES, the way 50a13c755b did for the playwright
multipliers.

gpu_count drops a noqa ruff no longer raises, and the development env module
an import nothing uses, which lint-python rejects.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/administration/deploy/development/env.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import os
-import subprocess
 
 from utils.distros import distro_names
 

tests/lint/repository/test_compose_bind_sources_exist.py

@@ -18,6 +18,7 @@ from pathlib import Path
 from typing import ClassVar
 
 from utils import PROJECT_ROOT
+from utils.cache.files import read_text
 from utils.cache.yaml import load_yaml_any
 
 FILES = ("compose.yml", "compose.cache-consumer.yml", "compose/*.yml", "i18n/*.yml")
@@ -27,9 +28,7 @@ INTERPOLATION = re.compile(r"\$\{([A-Za-z_][A-Za-z0-9_]*)(?:[:?-][^}]*)?\}")
 
 def _defaults(root: Path) -> dict[str, str]:
     values: dict[str, str] = {}
-    for line in (
-        (root / DEFAULT_ENV).read_text(encoding="utf-8").splitlines()
-    ):  # nocheck: cache-read - read once per session by this module only
+    for line in read_text(str(root / DEFAULT_ENV)).splitlines():
         if line.startswith("#") or "=" not in line:
             continue
         key, value = line.split("=", 1)

tests/lint/repository/test_compose_override_services_defined.py

@@ -12,23 +12,15 @@ import unittest
 from pathlib import Path
 from typing import ClassVar
 
-import yaml
-
 from utils import PROJECT_ROOT
+from utils.cache.yaml import load_yaml_any
 
 BASES = ("compose.yml",)
 OVERRIDES = ("compose/*.override.yml", "i18n/*.override.yml")
 
 
-class _ComposeLoader(yaml.SafeLoader):
-    """SafeLoader that tolerates compose's own tags, such as ``!reset``."""
-
-
-_ComposeLoader.add_multi_constructor("!", lambda loader, suffix, node: None)
-
-
 def _load(path: Path) -> dict:
-    return yaml.load(path.read_text(encoding="utf-8"), _ComposeLoader) or {}  # noqa: S506 - _ComposeLoader derives from SafeLoader
+    return load_yaml_any(str(path), default_if_missing={}) or {}
 
 
 def _services(path: Path) -> set[str]:

tests/unit/python/roles/web-svc-libretranslate/test_gpu_gate.py

@@ -11,15 +11,17 @@ import unittest
 from pathlib import Path
 from typing import ClassVar
 
-import yaml
 from jinja2 import Environment, StrictUndefined
 
 from plugins.filter.resource_filter import resource_filter
 from utils import PROJECT_ROOT
+from utils.cache.yaml import load_yaml
+from utils.roles.mapping import ROLE_FILE_META_SERVICES, ROLE_FILE_VARS_MAIN
 
 ROLE = "web-svc-libretranslate"
-VARS = Path(PROJECT_ROOT) / "roles" / ROLE / "vars" / "main.yml"
-SERVICES = Path(PROJECT_ROOT) / "roles" / ROLE / "meta" / "services.yml"
+ROLE_DIR = Path(PROJECT_ROOT) / "roles" / ROLE
+VARS = ROLE_DIR / ROLE_FILE_VARS_MAIN
+SERVICES = ROLE_DIR / ROLE_FILE_META_SERVICES
 
 
 def _ansible_bool(value) -> bool:
@@ -29,7 +31,7 @@ def _ansible_bool(value) -> bool:
 
 
 class TestGpuGate(unittest.TestCase):
-    services: ClassVar[dict] = yaml.safe_load(SERVICES.read_text(encoding="utf-8"))
+    services: ClassVar[dict] = load_yaml(str(SERVICES))
 
     def _render(self, expression: str, applications: dict) -> str:
         env = Environment(undefined=StrictUndefined, autoescape=False)  # noqa: S701 - renders an ansible var expression, not markup
@@ -42,20 +44,18 @@ class TestGpuGate(unittest.TestCase):
         self.assertTrue(self.services["libretranslate"].get("gpu"))
 
     def test_the_declared_flag_reaches_the_gate(self) -> None:
-        expression = yaml.safe_load(VARS.read_text(encoding="utf-8"))[
-            "LIBRETRANSLATE_GPU"
-        ]
+        expression = load_yaml(str(VARS))["LIBRETRANSLATE_GPU"]
         rendered = self._render(expression, {ROLE: {"services": self.services}})
 
         self.assertTrue(_ansible_bool(rendered))
 
     def test_a_service_without_the_flag_keeps_the_gate_closed(self) -> None:
-        expression = yaml.safe_load(VARS.read_text(encoding="utf-8"))[
-            "LIBRETRANSLATE_GPU"
-        ]
-        plain = {"libretranslate": {k: v for k, v in
-                                    self.services["libretranslate"].items()
-                                    if k != "gpu"}}
+        expression = load_yaml(str(VARS))["LIBRETRANSLATE_GPU"]
+        plain = {
+            "libretranslate": {
+                k: v for k, v in self.services["libretranslate"].items() if k != "gpu"
+            }
+        }
         rendered = self._render(expression, {ROLE: {"services": plain}})
 
         self.assertFalse(_ansible_bool(rendered))

utils/env/handlers/infinito/gpu_count.py

@@ -14,7 +14,7 @@ COMMENT = "GPUs the compose services reserve: 'all' on an NVIDIA host, else 0."
 
 
 def apply(eb: EnvBuilder, ctx: BuildContext) -> None:
-    runtimes = subprocess.run(  # noqa: S607 - docker resolves from PATH as in every other env handler
+    runtimes = subprocess.run(
         ["docker", "info", "--format", "{{json .Runtimes}}"],
         capture_output=True,
         text=True,