chore: migrate formatting to ruff, update CI/CD and bump to v0.20.3

.github/workflows/release.yml

@@ -10,11 +10,11 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install Poetry
         run: pipx install poetry
       - name: Set up Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.12'
       - name: Verify versioning
@@ -28,4 +28,4 @@ jobs:
         run: poetry build
       - name: Publish to PyPI
         if: ${{ github.event_name == 'release' }}
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/schema.yml

@@ -15,18 +15,22 @@ jobs:
         runs-on: ubuntu-latest
         steps:
           - name: Checkout repository
-            uses: actions/checkout@v4
+            uses: actions/checkout@v5
+
+          - name: Install Poetry
+            run: pipx install poetry
 
           - name: Set up Python
-            uses: actions/setup-python@v5
+            uses: actions/setup-python@v6
             with:
               python-version: '3.12'
+              cache: poetry
 
-          - name: Install check-jsonschema
-            run: pip install check-jsonschema
+          - name: Install dependencies
+            run: poetry install --no-interaction
 
           - name: Validate JSON files
             run: |
-                check-jsonschema --schemafile ./json-schema/schema_sigmahq_taxonomy.json ./tools/sigmahq_taxonomy.json  
-                check-jsonschema --schemafile ./json-schema/schema_sigmahq_filename.json ./tools/sigmahq_filename.json 
-                check-jsonschema --schemafile ./json-schema/schema_sigmahq_windows_validator.json ./tools/sigmahq_windows_validator.json
+                poetry run check-jsonschema --schemafile ./json-schema/schema_sigmahq_taxonomy.json ./tools/sigmahq_taxonomy.json
+                poetry run check-jsonschema --schemafile ./json-schema/schema_sigmahq_filename.json ./tools/sigmahq_filename.json
+                poetry run check-jsonschema --schemafile ./json-schema/schema_sigmahq_windows_validator.json ./tools/sigmahq_windows_validator.json

.github/workflows/test.yml

@@ -24,8 +24,10 @@ jobs:
           cache: poetry
       - name: Install dependencies
         run: poetry install
-      - name: Lint with black
-        run: poetry run black --check .
+      - name: Install ruff
+        run: pip install "ruff>=0.12,<1"
+      - name: Lint with ruff
+        run: ruff format --check .
       - name: Run tests
         run: poetry run pytest --cov=sigma --cov-report term --cov-report xml:cov.xml -vv
       - name: Store coverage for badge

.pre-commit-config.yaml

@@ -1,5 +1,7 @@
-repos:
-  - repo: https://github.com/psf/black
-    rev: 24.4.2
-    hooks:
-      - id: black
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.12.0
+    hooks:
+      - id: ruff
+        args: [--fix]
+      - id: ruff-format

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pySigma-validators-sigmahq"
-version = "0.20.2"
+version = "0.20.3"
 description = "pySigma SigmaHQ validators"
 license = "LGPL-2.1-only"
 readme = "README.md"
@@ -10,16 +10,16 @@ authors = [
     {name = "François Hubaut", email = "frack113@users.noreply.github.com" }
 ]
 
-maintainers =[
+maintainers = [
     {name = "François Hubaut", email = "frack113@users.noreply.github.com" },
     {name = "Christian Burkard", email = "phantinuss@users.noreply.github.com" }
 ]
 
 keywords = [ "pySigma", "SigmaHQ", "validators"]
 
 dependencies = [
-    "pysigma >=1.0",
-    "requests >=2.32"
+    "pysigma >=1.3",
+    "requests >=2.34"
 ]
 
 [project.urls]
@@ -31,15 +31,44 @@ packages = [
 ]
 
 [tool.poetry.group.dev.dependencies]
-black = "^25.0"
+ruff = ">=0.12,<1"
 defusedxml = "^0.7"
-pytest = "^9.0"
-pytest-cov = "^7.0"
-mypy = "^1.18"
-types-requests = "^2.32"
+pytest = "^9.1"
+pytest-cov = "^7.1"
+mypy = "^2.0"
+check-jsonschema = "^0.29"
 
-[tool.black]
+[tool.ruff]
 line-length = 100
+target-version = "py310"
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I001"]
+ignore = ["E501", "W291", "W293", "W29"]
+
+[tool.ruff.lint.per-file-ignores]
+"__init__.py" = ["F401"]
+"tests/**" = ["S101", "PLR2004"]
+"tools/**" = ["S101"]
+
+[tool.ruff.format]
+quote-style = "double"
+indent-style = "space"
+
+[tool.mypy]
+python_version = "3.10"
+warn_return_any = false
+warn_unused_configs = false
+disallow_untyped_defs = false
+disallow_incomplete_defs = false
+check_untyped_defs = false
+disallow_untyped_decorators = false
+no_implicit_optional = false
+ignore_missing_imports = true
+
+[[tool.mypy.overrides]]
+module = ["pytest.*"]
+ignore_missing_imports = true
 
 [build-system]
 requires = ["poetry-core"]

sigma/validators/sigmahq/__init__.py

@@ -1,8 +1,8 @@
+import re
 from importlib import import_module
+from inspect import getmembers, isabstract, isclass
 from pathlib import Path
 from pkgutil import iter_modules
-from inspect import getmembers, isabstract, isclass
-import re
 
 from sigma.validators.base import SigmaRuleValidator
 

sigma/validators/sigmahq/author.py

@@ -1,8 +1,8 @@
 from dataclasses import dataclass
 from typing import ClassVar, List
 
-from sigma.rule import SigmaRule
 from sigma.correlations import SigmaCorrelationRule
+from sigma.rule import SigmaRule
 from sigma.validators.base import (
     SigmaRuleValidator,
     SigmaValidationIssue,

sigma/validators/sigmahq/condition.py

@@ -1,12 +1,13 @@
-from dataclasses import dataclass
 import re
+from dataclasses import dataclass
 from typing import ClassVar, List
+
 from sigma.correlations import SigmaCorrelationRule
 from sigma.rule import SigmaRule
 from sigma.validators.base import (
+    SigmaRuleValidator,
     SigmaValidationIssue,
     SigmaValidationIssueSeverity,
-    SigmaRuleValidator,
 )
 
 

sigma/validators/sigmahq/config.py

@@ -1,19 +1,21 @@
 import json
 from pathlib import Path
 from typing import Dict, List, Optional
+
+import requests
 from sigma.rule import SigmaLogSource
+
 from .data.sigmahq_data import (
-    taxonomy_version,
-    ref_sigmahq_logsource_filepattern,
     file_pattern_version,
     ref_sigmahq_fieldsname,
-    ref_sigmahq_redundant_field,
     ref_sigmahq_logsource_definition,
-    windows_version,
-    ref_windows_provider_name,
+    ref_sigmahq_logsource_filepattern,
+    ref_sigmahq_redundant_field,
     ref_windows_no_eventid,
+    ref_windows_provider_name,
+    taxonomy_version,
+    windows_version,
 )
-import requests
 
 
 def core_logsource(source: SigmaLogSource) -> SigmaLogSource:

sigma/validators/sigmahq/correlation.py

@@ -23,8 +23,11 @@ class SigmahqCorrelationRulesMinimumValidator(SigmaRuleValidator):
 
     def validate(self, rule: SigmaRule | SigmaCorrelationRule) -> List[SigmaValidationIssue]:
         if isinstance(rule, SigmaCorrelationRule):
-            if rule.type in [SigmaCorrelationType.TEMPORAL, SigmaCorrelationType.TEMPORAL_ORDERED]:
-                if len(rule.rules) < 2:
+            if rule.type in [
+                SigmaCorrelationType.TEMPORAL,
+                SigmaCorrelationType.TEMPORAL_ORDERED,
+            ]:
+                if len(rule.rules) < 2:  # type: ignore[arg-type]
                     return [SigmahqCorrelationRulesMinimumIssue([rule])]
         return []
 

sigma/validators/sigmahq/data/sigmahq_data.py

@@ -1,6 +1,6 @@
-from typing import Dict, List
+from typing import Dict, List, Optional
+
 from sigma.rule import SigmaLogSource
-from typing import Optional
 
 file_pattern_version: str = "20251205"
 ref_sigmahq_logsource_filepattern: Dict[SigmaLogSource, str] = {
@@ -1055,7 +1055,14 @@
         definition=None,
         source=None,
         custom_attributes=None,
-    ): ["CreationUtcTime", "Image", "ProcessGuid", "ProcessId", "TargetFilename", "User"],
+    ): [
+        "CreationUtcTime",
+        "Image",
+        "ProcessGuid",
+        "ProcessId",
+        "TargetFilename",
+        "User",
+    ],
     SigmaLogSource(
         category="network_connection",
         product="linux",
@@ -1477,7 +1484,14 @@
         definition=None,
         source=None,
         custom_attributes=None,
-    ): ["CreationUtcTime", "Image", "ProcessGuid", "ProcessId", "TargetFilename", "User"],
+    ): [
+        "CreationUtcTime",
+        "Image",
+        "ProcessGuid",
+        "ProcessId",
+        "TargetFilename",
+        "User",
+    ],
     SigmaLogSource(
         category="process_creation",
         product="macos",
@@ -2153,7 +2167,14 @@
         definition=None,
         source=None,
         custom_attributes=None,
-    ): ["Channel", "Computer", "EventID", "Provider_Name", "Security_UserID", "subjectName"],
+    ): [
+        "Channel",
+        "Computer",
+        "EventID",
+        "Provider_Name",
+        "Security_UserID",
+        "subjectName",
+    ],
     SigmaLogSource(
         category=None,
         product="windows",
@@ -2469,7 +2490,15 @@
         definition=None,
         source=None,
         custom_attributes=None,
-    ): ["Channel", "Computer", "EventID", "payload", "process", "Provider_Name", "Security_UserID"],
+    ): [
+        "Channel",
+        "Computer",
+        "EventID",
+        "payload",
+        "process",
+        "Provider_Name",
+        "Security_UserID",
+    ],
     SigmaLogSource(
         category=None,
         product="windows",

sigma/validators/sigmahq/date.py

@@ -1,8 +1,8 @@
 from dataclasses import dataclass
 from typing import ClassVar, List
 
-from sigma.rule import SigmaRule
 from sigma.correlations import SigmaCorrelationRule
+from sigma.rule import SigmaRule
 from sigma.validators.base import (
     SigmaRuleValidator,
     SigmaValidationIssue,

sigma/validators/sigmahq/description.py

@@ -1,9 +1,8 @@
 from dataclasses import dataclass
 from typing import ClassVar, List, Tuple
 
-
-from sigma.rule import SigmaRule
 from sigma.correlations import SigmaCorrelationRule
+from sigma.rule import SigmaRule
 from sigma.validators.base import (
     SigmaRuleValidator,
     SigmaValidationIssue,