From 351bcba6477ebd9150d49a03a190ed34d84f6ff5 Mon Sep 17 00:00:00 2001 From: jawwad-ali Date: Fri, 24 Jul 2026 13:00:16 +0500 Subject: [PATCH] ci: pin the Ruff rule set explicitly so a Ruff default-expansion can't red CI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI runs `uvx ruff check src tests`, which always resolves the LATEST Ruff. The config used `extend-select` on top of Ruff's *default* select, so a Ruff release that expands the default rule set starts failing long-standing code repo-wide — `uvx ruff check src tests` on a clean main currently reports ~1476 findings (733 I001, 161 UP006, 105 RUF012, 92 PLW1510, ...), none of which the project selects. Replace `extend-select` with an explicit `select` that reproduces Ruff's historical default (E4/E7/E9/F) plus the subprocess-security rules (S602/S604/S605) the project has always enforced. This makes the rule set version-independent: `uvx ruff check src tests` passes again, and the shell=True/os.system guards still fire (verified). No source changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.8 (1M context) --- pyproject.toml | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 60eda21d85..ff3c442540 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -79,10 +79,21 @@ show_missing = true skip_covered = false [tool.ruff.lint] -# Lock in subprocess security posture: any reintroduction of shell=True -# (or os.system / popen2) must be acknowledged with an explicit `# noqa` -# pointing at the rule, making the deviation visible in review. -extend-select = [ +# Pin the rule set explicitly instead of relying on Ruff's *default* select +# (which `extend-select` builds on). A Ruff release that expands the default +# rule set would otherwise start failing CI on long-standing code across the +# whole repo — `uvx ruff` is unpinned in CI, so it always resolves the latest +# Ruff. `select` below is Ruff's historical default (E4/E7/E9/F) plus the +# subprocess-security rules the project has always enforced. +# +# Subprocess security posture: any reintroduction of shell=True (or os.system +# / popen2) must be acknowledged with an explicit `# noqa` pointing at the +# rule, making the deviation visible in review. +select = [ + "E4", + "E7", + "E9", + "F", "S602", # subprocess-popen-with-shell-equals-true "S604", # call-with-shell-equals-true "S605", # start-process-with-a-shell