0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-10 12:47:04 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.8 fc77d9d265 fix(security): resolve all open code-scanning alerts and guard against recurrence

Resolve the 80 open CodeQL/code-scanning alerts on this branch.

Security-sensitive fixes:
- cli/administration/deploy/development: break the unsafe import cycle by
  extracting the env/arg helpers into a leaf module `env.py`, giving the
  load-time DAG compose -> common -> deps -> env.
- web-app-bluesky login-broker server.js: prototype-pollution guard on
  cookie parsing, CR/LF + control-char log sanitisation, HTML-escaped
  exception text, and a ReDoS-bounded handle regex.
- web-app-baserow SSO: harden the open-redirect `next` handling.
- network diagnose probes: require TLS >= 1.2.
- actionlint installer: validate tar members against path traversal.
- decidim/apt-purge lint regexes: rewrite to avoid catastrophic backtracking.
- 6x Playwright URL regexes anchored; crs-k/stale-branches pinned to a commit SHA.

Mechanical cleanups: unused imports/globals/locals, empty-except comments,
import-and-import-from, implicit-string-concat, multiple-definition,
unreachable/useless-assignment.

False positives are intentionally left in place (Django settings patches,
Odoo __manifest__, side-effect imports, cross-module symbols).

Recurrence guards:
- import-linter contract (pyproject + tests/lint) locks the dev-deploy
  package acyclic; a new cycle now fails CI instead of only CodeQL.
- new lint test requires every bandit (S###) `noqa` to carry a justification.
- BLE001 (blind-except) added to ruff as a ratchet (tests/roles exempt,
  current production offenders grandfathered).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-28 15:42:03 +02:00

__init__.py

feat(install/lint): Python-ize lint install + host/docker dispatcher

2026-05-20 20:40:34 +02:00

__main__.py

feat(lint): validate generated distro changelogs + harden the mirror generator

2026-06-27 21:36:30 +02:00

actionlint.py

fix(security): resolve all open code-scanning alerts and guard against recurrence

2026-06-28 15:42:03 +02:00

ansible_collections.py

feat(install/lint): Python-ize lint install + host/docker dispatcher

2026-05-20 20:40:34 +02:00

ansible_commands.py

feat(install/lint): Python-ize lint install + host/docker dispatcher

2026-05-20 20:40:34 +02:00

ansible_lint.py

feat(install/lint): Python-ize lint install + host/docker dispatcher

2026-05-20 20:40:34 +02:00

eslint.py

feat(install/lint): Python-ize lint install + host/docker dispatcher

2026-05-20 20:40:34 +02:00

markdownlint_cli2.py

feat(install/lint): Python-ize lint install + host/docker dispatcher

2026-05-20 20:40:34 +02:00

mbake.py

feat(install/lint): Python-ize lint install + host/docker dispatcher

2026-05-20 20:40:34 +02:00

packages.py

feat(lint): validate generated distro changelogs + harden the mirror generator

2026-06-27 21:36:30 +02:00

playwright.py

feat(lint): add lint-playwright for per-role spec parse checks

2026-05-22 10:24:32 +02:00

README.md

chore(lint): drop galaxy-importer lint

2026-05-20 20:40:34 +02:00

ruff.py

feat(install/lint): Python-ize lint install + host/docker dispatcher

2026-05-20 20:40:34 +02:00

shellcheck.py

feat(install/lint): Python-ize lint install + host/docker dispatcher

2026-05-20 20:40:34 +02:00

shfmt.py

feat(install/lint): Python-ize lint install + host/docker dispatcher

2026-05-20 20:40:34 +02:00

README.md

utils/install/lint

Per-tool installer policy for the lint toolchain. For the package's overall role see README.md. For general README conventions see documentation.md.

Purpose

Each module in this directory owns exactly one lint tool and exposes a single ensure() function. The CLI in __main__.py groups these ensure calls and applies the stamp-based skip for the default "all" invocation.

File Naming

A module name MUST match the lowercase snake_case of the tool it installs:
- actionlint -> actionlint.py
- markdownlint-cli2 -> markdownlint_cli2.py
- ansible-lint -> ansible_lint.py
Aggregate installers (one helper covers a tightly coupled command pair) take the topic name without a key suffix. Example: ansible_commands.py installs both ansible-playbook and ansible-galaxy via the same system-package candidates.

Module Shape

Every per-tool module MUST expose the same surface so the dispatcher can call it uniformly:

"""<one-line docstring: what gets installed and via which channel>."""

from __future__ import annotations


def ensure() -> None:
    """Install <tool> if not present. Raises RuntimeError on failure."""

ensure() MUST be idempotent: return immediately when the tool is already on PATH (or importable, for Python modules).
ensure() MUST raise RuntimeError with a descriptive message on failure.
A module MAY read tool-specific environment overrides (e.g. ACTIONLINT_VERSION, RUFF_PIP_SPEC) at call time.

Import Rules

A per-tool module MUST NOT import another per-tool module. Shared logic flows through utils.install.primitives, utils.install.pip, utils.install.npm, utils.install.github_release, and utils.install.system_pkg only.
A per-tool module MAY import from utils.cache (for PROJECT_ROOT) and from stdlib.

Group Dispatch

__main__.py maps each CLI group to a fixed set of ensure() calls:

Group	Modules called (in order)
`action`	`actionlint`
`ansible`	`ansible_commands`, `ansible_collections`, `ansible_lint`
`python`	`shfmt`, `ruff`
`shellcheck`	`shellcheck`
`markdown`	`markdownlint_cli2`
`makefile`	`mbake`
`javascript`	`eslint`
`all` (default)	every group above, in the order listed

The all mode honors a per-interpreter stamp at build/install-lint-<hash>.stamp (the suffix is the first 8 chars of sha256(sys.executable), so host and container track independently even though build/ is bind-mounted). Stamp dependencies are lint.sh and pyproject.toml. Group-targeted invocations always run and never touch the stamp.