pyproject.toml

[tool.ruff]
line-length = 88
target-version = 'py39'

[tool.ruff.lint]
select = [
    'B',    # flake8-bugbear (potential bugs)
    'C4',   # flake8-comprehensions
    'E',    # pycodestyle errors
    'F',    # pyflakes (logic errors)
    'I',    # isort (import sorting)
    'RUF',  # Ruff-specific rules
    'SIM',  # flake8-simplify
    'UP',   # pyupgrade (modernize syntax for py39+)
    'W',    # pycodestyle warnings
]
ignore = [
    'E501',    # line too long (handled by code review, not auto-enforcement)
    'RUF002',  # ambiguous Unicode in docstrings (typographic quotes from docs)
    'RUF003',  # ambiguous Unicode in comments (en dashes in ASCII art)
    'SIM102',  # nested if statements (sometimes clearer than combined conditions)
    'SIM105',  # contextlib.suppress (try/except/pass is more explicit)
    'UP009',   # UTF-8 encoding declaration (we keep our standard file header)
    'UP015',   # redundant open() mode (we keep explicit modes for clarity)
]

[tool.ruff.lint.per-file-ignores]
# example plugin: unused imports/vars are intentional (skeleton demonstrating patterns)
'check-plugins/example/example' = ['F401', 'F841', 'RUF059', 'SIM102']
# metabase-stats: known broken, tracked in issue #1069 (rewrite needed)
'check-plugins/metabase-stats/metabase-stats' = ['F821', 'B006']

[tool.ruff.format]
docstring-code-format = true
quote-style = 'single'

[tool.bandit]
# B110 (try/except/pass) and B112 (try/except/continue): intentional patterns in
# monitoring plugins for graceful degradation - cleanup errors must not crash a
# check, and loops must continue past one broken item.
# B311 (pseudo-random): monitoring plugins use `random` for non-cryptographic
# purposes only (transaction IDs, random MACs for DHCP tests, test data).
skips = ['B110', 'B112', 'B311']

[tool.bandit.assert_used]
# A test suite may assert with the bare statement, so B101 does not apply under
# tests/. bandit still scans the directory for every other finding.
# The first two patterns are the ones shared with the other Linuxfabrik repos, whose
# tests live in `tests/*.py`. This repository runs its suites as extension-less
# `unit-test/run` scripts, which neither pattern matches, so that layout is listed
# as well.
skips = ['*/tests/*.py', 'tests/*.py', '*/unit-test/run']

[tool.vulture]
# No `paths` here, unlike the other Linuxfabrik repos. vulture only walks a
# directory for `*.py`, and 581 of the 583 Python files in this repo are
# extension-less shebang scripts (the plugins themselves). A `paths` entry would
# therefore analyse two files and report success for the rest, so the pre-commit
# hook passes the staged files explicitly instead (`pass_filenames: true`). At
# min_confidence 80 vulture only reports file-local findings - unused imports,
# unused arguments, unreachable code - so per-file is the right granularity. It is
# in fact stricter than the whole-repo sweep in `tools/run-linter-checks`: vulture
# collects used names across everything it is handed at once, so an import no file
# needs stays hidden as long as any other file happens to use the same name.
min_confidence = 80
# The example plugin is a skeleton that demonstrates the patterns a plugin uses,
# so its unused imports are the point. ruff ignores F401 there for the same
# reason; vulture has no per-file rule, so the file is excluded outright.
exclude = ['*/check-plugins/example/example']