mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 4.8
fc77d9d265
Resolve the 80 open CodeQL/code-scanning alerts on this branch. Security-sensitive fixes: - cli/administration/deploy/development: break the unsafe import cycle by extracting the env/arg helpers into a leaf module `env.py`, giving the load-time DAG compose -> common -> deps -> env. - web-app-bluesky login-broker server.js: prototype-pollution guard on cookie parsing, CR/LF + control-char log sanitisation, HTML-escaped exception text, and a ReDoS-bounded handle regex. - web-app-baserow SSO: harden the open-redirect `next` handling. - network diagnose probes: require TLS >= 1.2. - actionlint installer: validate tar members against path traversal. - decidim/apt-purge lint regexes: rewrite to avoid catastrophic backtracking. - 6x Playwright URL regexes anchored; crs-k/stale-branches pinned to a commit SHA. Mechanical cleanups: unused imports/globals/locals, empty-except comments, import-and-import-from, implicit-string-concat, multiple-definition, unreachable/useless-assignment. False positives are intentionally left in place (Django settings patches, Odoo __manifest__, side-effect imports, cross-module symbols). Recurrence guards: - import-linter contract (pyproject + tests/lint) locks the dev-deploy package acyclic; a new cycle now fails CI instead of only CodeQL. - new lint test requires every bandit (S###) `noqa` to carry a justification. - BLE001 (blind-except) added to ruff as a ratchet (tests/roles exempt, current production offenders grandfathered). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
63 lines
1.9 KiB
Python
63 lines
1.9 KiB
Python
"""Lint guard: import-linter architectural contracts MUST hold.
|
|
|
|
Background
|
|
==========
|
|
CodeQL ``py/unsafe-cyclic-import`` repeatedly flagged the dev/CI deploy
|
|
package ``cli.administration.deploy.development`` (compose <-> common <->
|
|
deps). Static linters (ruff) do not model the module-import graph, so
|
|
they cannot catch a re-introduced cycle. import-linter does.
|
|
|
|
The contracts live in ``[tool.importlinter]`` in ``pyproject.toml``; this
|
|
test runs them so a cycle regression fails CI rather than only surfacing
|
|
later in a CodeQL scan. Run them directly with ``lint-imports``.
|
|
|
|
Skip behaviour
|
|
==============
|
|
import-linter is a dev dependency (``pip install .[dev]`` /
|
|
``make install-python-dev``). Where it is absent the test skips rather
|
|
than fails, so a minimal runtime-only environment is not blocked; CI
|
|
installs the dev extra and therefore enforces the contracts.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import shutil
|
|
import subprocess
|
|
import unittest
|
|
|
|
from . import PROJECT_ROOT
|
|
|
|
_LINT_IMPORTS = shutil.which("lint-imports")
|
|
|
|
|
|
class TestImportContracts(unittest.TestCase):
|
|
"""The ``[tool.importlinter]`` contracts in ``pyproject.toml`` hold."""
|
|
|
|
@unittest.skipUnless(
|
|
_LINT_IMPORTS,
|
|
"import-linter not installed; run `make install-python-dev`",
|
|
)
|
|
def test_import_linter_contracts_hold(self) -> None:
|
|
env = dict(os.environ)
|
|
env["PYTHONPATH"] = os.pathsep.join(
|
|
p for p in (str(PROJECT_ROOT), env.get("PYTHONPATH", "")) if p
|
|
)
|
|
result = subprocess.run(
|
|
[_LINT_IMPORTS],
|
|
cwd=str(PROJECT_ROOT),
|
|
env=env,
|
|
capture_output=True,
|
|
text=True,
|
|
check=False,
|
|
)
|
|
self.assertEqual(
|
|
result.returncode,
|
|
0,
|
|
msg="import-linter contracts broken:\n" + result.stdout + result.stderr,
|
|
)
|
|
|
|
|
|
if __name__ == "__main__": # pragma: no cover
|
|
unittest.main()
|