Vito Sansevero
2d9dd6e6ba
The lint job installs black==26.10.1 and flake8==7.4.1 from requirements-dev.txt (the versions CI resolved on main today), so a new release cannot turn CI red with no code change. The local bandit hook ran 'bash -c ... "$@"; true': it could never fail, and bash bound the first staged file to $0 so it was never scanned. It now runs 'bandit -lll -q' directly, failing on high severity exactly like code-quality.yml. The frontend modules job's setup-node caches npm keyed on tools/vendor/package-lock.json.
31 lines
815 B
YAML
31 lines
815 B
YAML
repos:
|
|
- repo: local
|
|
hooks:
|
|
- id: black
|
|
name: black
|
|
entry: black --line-length=88 --target-version=py310
|
|
language: system
|
|
types: [python]
|
|
|
|
- id: flake8
|
|
name: flake8
|
|
entry: flake8 --show-source
|
|
language: system
|
|
types: [python]
|
|
|
|
# Fails at the severity CI enforces (code-quality.yml: -lll, high only), never stricter.
|
|
# pre-commit appends the staged files, so no shell wrapper can drop the first one.
|
|
- id: bandit
|
|
name: bandit
|
|
entry: bandit -lll -q
|
|
language: system
|
|
types: [python]
|
|
exclude: ^(tests/|reference/)
|
|
|
|
- id: tests
|
|
name: tests
|
|
entry: python -m tests.run_suite -q
|
|
language: system
|
|
pass_filenames: false
|
|
stages: [pre-push]
|