From 0e7ad599ed108a2ee897019a90a0df9e458849b0 Mon Sep 17 00:00:00 2001 From: Deep Kumar Singh Kushwah Date: Sun, 24 May 2026 12:30:22 +0530 Subject: [PATCH] chore(ci): lint scripts/ + ignore S603/S607 in scripts/** MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two related fixes that surfaced when the rebased Step 1.1c PR (#46) ran CI for the first time after #47 merged: 1. `scripts/check_schema_drift.py` (added in #47) tripped ruff S603 + S607 — bandit subprocess rules. Dev tooling under scripts/ invokes known executables (git, uv) with fixed argument lists, mirroring the existing T201 carve-out for stdout/stderr. Extend the per-file ignore so this class of script doesn't need scattered `# noqa` comments. 2. The `python` paths-filter that gates `Lint & Test` did not include `scripts/**`. That's why #47's CI passed without exercising ruff on the new script — the lint job was skipped entirely. Add `scripts/**` so future changes under scripts/ are linted at PR time. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/ci.yml | 1 + pyproject.toml | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ba795bc..9b974e7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,6 +33,7 @@ jobs: - 'packages/**' - 'apps/**' - 'tests/**' + - 'scripts/**' - 'pyproject.toml' - 'uv.lock' infra: diff --git a/pyproject.toml b/pyproject.toml index 6870f10..12947b4 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -46,7 +46,9 @@ unfixable = ["B"] "**/cli.py" = ["B008"] "**/ragctl/main.py" = ["B008"] # Scripts, code generators, and infra setup legitimately write to stdout/stderr. -"scripts/**/*.py" = ["T201"] +# S603/S607 are also ignored for scripts/: dev tooling invokes known executables +# (git, uv, etc.) on PATH with fixed argument lists — not user input. +"scripts/**/*.py" = ["T201", "S603", "S607"] "infra/**/*.py" = ["T201"] "**/gen_schema*.py" = ["T201"]