0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-08 03:38:23 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.8 fc77d9d265 fix(security): resolve all open code-scanning alerts and guard against recurrence

Resolve the 80 open CodeQL/code-scanning alerts on this branch.

Security-sensitive fixes:
- cli/administration/deploy/development: break the unsafe import cycle by
  extracting the env/arg helpers into a leaf module `env.py`, giving the
  load-time DAG compose -> common -> deps -> env.
- web-app-bluesky login-broker server.js: prototype-pollution guard on
  cookie parsing, CR/LF + control-char log sanitisation, HTML-escaped
  exception text, and a ReDoS-bounded handle regex.
- web-app-baserow SSO: harden the open-redirect `next` handling.
- network diagnose probes: require TLS >= 1.2.
- actionlint installer: validate tar members against path traversal.
- decidim/apt-purge lint regexes: rewrite to avoid catastrophic backtracking.
- 6x Playwright URL regexes anchored; crs-k/stale-branches pinned to a commit SHA.

Mechanical cleanups: unused imports/globals/locals, empty-except comments,
import-and-import-from, implicit-string-concat, multiple-definition,
unreachable/useless-assignment.

False positives are intentionally left in place (Django settings patches,
Odoo __manifest__, side-effect imports, cross-module symbols).

Recurrence guards:
- import-linter contract (pyproject + tests/lint) locks the dev-deploy
  package acyclic; a new cycle now fails CI instead of only CodeQL.
- new lint test requires every bandit (S###) `noqa` to carry a justification.
- BLE001 (blind-except) added to ruff as a ratchet (tests/roles exempt,
  current production offenders grandfathered).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-28 15:42:03 +02:00

lint

fix(security): resolve all open code-scanning alerts and guard against recurrence

2026-06-28 15:42:03 +02:00

__init__.py

…

github_release.py

fix(install): cap urlopen with explicit timeouts in install-lint helpers

2026-05-21 14:55:10 +02:00

npm.py

…

pip.py

…

primitives.py

fix(install): cap urlopen with explicit timeouts in install-lint helpers

2026-05-21 14:55:10 +02:00

README.md

…

system_pkg.py

fix(install): let the lint package installer wait for a busy dpkg lock

2026-06-23 12:10:02 +02:00

README.md

utils/install

This directory hosts the Python implementation behind make install-lint. For the general rules that govern READMEs in code directories see documentation.md.

Purpose

The package installs the lint toolchain (actionlint, shfmt, ruff, ansible-lint, mbake, markdownlint-cli2, eslint, shellcheck, ansible-playbook, ansible-galaxy) using the right channel per tool (system package manager, pip, npm, or GitHub release). Modules at this level are channel-agnostic primitives; per-tool policy lives one level down in lint/.

Structure

File	Role
`primitives.py`	Logging, sudo wrapping, PATH mutation, and stdlib-based URL download.
`pip.py`	Venv-aware pip installer with `--break-system-packages` and `--user` fallback.
`npm.py`	Global / local npm install with per-user `--prefix` fallback.
`github_release.py`	Latest-tag resolver and asset downloader for GitHub releases.
`system_pkg.py`	Per-manager dispatch for `pacman` / `apt-get` / `dnf` / `yum` / `brew`.
`lint/`	One module per tool, each exposing `ensure()`. See lint README.

The CLI entry point lives at __main__.py, invoked from lint.sh as python3 -m utils.install.lint. The matching dispatcher wrapper.sh routes make install-lint host vs container based on INFINITO_LINT_RUNNER.

File Naming

Module names MUST stay lowercase snake_case.
Channel-agnostic helpers MUST live directly under utils/install/.
Per-tool policy (one tool per file) MUST live under lint/ (see lint README).
Test files live in tests/unit/utils/install/ and mirror the module name with a test_ prefix.

Import Rules

primitives.py MUST NOT import from any other module in this package.
pip.py, npm.py, github_release.py, and system_pkg.py MAY import from primitives.py.
npm.py MAY import from system_pkg.py to bootstrap npm itself; no other cross-imports between these four are allowed.
Per-tool modules under lint/ MUST NOT import each other (see lint README).