Install eustasy/.Normal 4.0beta9

Author: lewisgoddard

.github/dependabot.yml

@@ -1,4 +1,4 @@
-# eustasy/.Normal 4.0beta8
+# eustasy/.Normal 4.0beta9
 # To get started with Dependabot version updates, you'll need to specify which
 # package ecosystems to update and where the package manifests are located.
 # Please see the documentation for all configuration options:

.github/workflows/env.yml

@@ -1,4 +1,4 @@
-# eustasy/.Normal 4.0beta8
+# eustasy/.Normal 4.0beta9
 name: Normal (Env)
 
 on:

.github/workflows/md.yml

@@ -1,4 +1,4 @@
-# eustasy/.Normal 4.0beta8
+# eustasy/.Normal 4.0beta9
 name: Normal (Markdown)
 
 on:

.github/workflows/python.yml

@@ -1,4 +1,4 @@
-# eustasy/.Normal 4.0beta8
+# eustasy/.Normal 4.0beta9
 name: Normal (Python)
 
 on:

.github/workflows/security.yml

@@ -1,4 +1,4 @@
-# eustasy/.Normal 4.0beta8
+# eustasy/.Normal 4.0beta9
 name: Normal (Security)
 
 on:
@@ -25,4 +25,4 @@ jobs:
       - uses: qltysh/qlty-action/install@a19242102d17e497f437d7466aa01b528537e899 # v2.2.0
 
       - name: Security scan
-        run: qlty check --all --no-formatters --filter=gitleaks,trivy,bandit,osv-scanner
+        run: qlty check --all --no-formatters --filter=gitleaks,trivy,osv-scanner

.github/workflows/test-python.yml

@@ -1,4 +1,4 @@
-# eustasy/.Normal 4.0beta8
+# eustasy/.Normal 4.0beta9
 name: Test (Python)
 
 on:

.qlty/configs/ruff.toml

@@ -13,9 +13,13 @@ select = [
   "S",   # flake8-bandit (security)
   "SIM", # flake8-simplify
 ]
-ignore = [
-  "S101", # assert statements (fine in tests)
-]
+
+# flake8-bandit's S101 flags bare `assert`, idiomatic in pytest but a real bug in
+# production code (assertions are stripped under `python -O`). Allow it only under
+# tests/ so it still fires everywhere else. ruff is now the sole runner of the bandit
+# ruleset — the standalone bandit plugin was dropped as redundant with the "S" select.
+[lint.per-file-ignores]
+"**/tests/**" = ["S101"]
 
 [lint.isort]
 known-first-party = []

.qlty/qlty.toml

@@ -102,9 +102,6 @@ name = "shfmt"
 [[plugin]]
 name = "gitleaks"
 
-[[plugin]]
-name = "bandit"
-
 [[plugin]]
 name = "trivy"
 
@@ -114,7 +111,7 @@ name = "osv-scanner"
 # ── Per-plugin file excludes ─────────────────────────────────────────────────
 # qlty has no plugin-level `exclude_patterns` key (it is silently ignored); scope
 # file skips to specific plugins with [[exclude]] blocks instead. These are NOT
-# global, so dependency/security scanners (osv-scanner, gitleaks, trivy, bandit,
+# global, so dependency/security scanners (osv-scanner, gitleaks, trivy,
 # actionlint, zizmor) still see every file.
 
 # 1. Tool-managed config directories. No project source lives here — only tooling