Vito Sansevero
2d9dd6e6ba
The lint job installs black==26.10.1 and flake8==7.4.1 from requirements-dev.txt (the versions CI resolved on main today), so a new release cannot turn CI red with no code change. The local bandit hook ran 'bash -c ... "$@"; true': it could never fail, and bash bound the first staged file to $0 so it was never scanned. It now runs 'bandit -lll -q' directly, failing on high severity exactly like code-quality.yml. The frontend modules job's setup-node caches npm keyed on tools/vendor/package-lock.json.
19 lines
267 B
Plaintext
19 lines
267 B
Plaintext
# Runtime dependencies
|
|
watchdog>=6.0.0
|
|
Pillow>=12.3.0
|
|
aiohttp>=3.14.5
|
|
|
|
# Tests and coverage
|
|
coverage>=7.16.2
|
|
numpy>=2.2.6 # WD14 engine tests
|
|
|
|
# Code quality
|
|
black==26.10.1
|
|
flake8==7.4.1
|
|
|
|
# Security scanning
|
|
bandit[toml]>=1.9.4
|
|
|
|
# Pre-commit hooks
|
|
pre-commit>=4.6.2
|