Vito Sansevero 2d9dd6e6ba ci: pin black and flake8, let the bandit hook fail, cache npm in the JS job (#352) ...

The lint job installs black==26.10.1 and flake8==7.4.1 from
requirements-dev.txt (the versions CI resolved on main today), so a new
release cannot turn CI red with no code change.

The local bandit hook ran 'bash -c ... "$@"; true': it could never
fail, and bash bound the first staged file to $0 so it was never
scanned. It now runs 'bandit -lll -q' directly, failing on high
severity exactly like code-quality.yml.

The frontend modules job's setup-node caches npm keyed on
tools/vendor/package-lock.json.

2026-10-27 18:18:23 -07:00

..

code-quality.yml

ci: run the required workflows for the merge queue (#382)

2026-10-27 16:35:01 +00:00

publish.yml

deps(actions)(deps): bump actions/checkout from 6 to 7 (#145)

2026-06-25 06:26:53 -07:00

test.yml

ci: pin black and flake8, let the bandit hook fail, cache npm in the JS job (#352)

2026-10-27 18:18:23 -07:00

viewerjs-check.yml

ci: run the required workflows for the merge queue (#382)

2026-10-27 16:35:01 +00:00

viewerjs-update.yml

feat: vendor Viewer.js reproducibly and automate release updates (#170)

2026-10-16 04:56:25 -07:00