Integrate SSDLC tooling (Ruff, pip-audit, Trivy, Hadolint), update CONTRIBUTING.rst, and remove obsolete MANIFEST.in

Author: neuhaus

.github/workflows/ci.yml

@@ -31,10 +31,31 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         python -m pip install tox tox-gh-actions
-    - name: Lint
+    - name: Security & Linting
       if: matrix.python-version == '3.10'
       run: |
-        tox -e flake8
+        tox -e ruff
+        tox -e pip-audit
         tox -e mypy
     - name: Tests
       run: tox
+
+  docker-security:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Run Hadolint
+      uses: hadolint/hadolint-action@v3.1.0
+      with:
+        dockerfile: Dockerfile
+    - name: Build Docker Image
+      run: docker build -t snappass:local .
+    - name: Run Trivy vulnerability scanner
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: 'snappass:local'
+        format: 'table'
+        exit-code: '1'
+        ignore-unfixed: true
+        vuln-type: 'os,library'
+        severity: 'CRITICAL,HIGH'

CONTRIBUTING.rst

@@ -70,13 +70,12 @@ Here's how to set up ``snappass`` for local development.
 
     $ git clone git@github.com:your_name_here/snappass.git
 
-3. Install your local copy into a ``virtualenv``. Assuming you have
-   ``virtualenvwrapper`` installed, this is how you set up your fork for local
-   development::
+3. Install your local copy into a ``virtualenv``. It is recommended to use standard ``venv``::
 
-    $ mkvirtualenv snappass
+    $ python -m venv venv
+    $ source venv/bin/activate
     $ cd snappass/
-    $ python setup.py develop
+    $ pip install -e .
     $ make dev
 
 4. Create a branch for local development::
@@ -92,29 +91,19 @@ Here's how to set up ``snappass`` for local development.
 
   You now have a running instance on localhost:5000/
 
-6. Please add some tests to tests.py and run tests::
+6. Please add some tests to tests.py. When you're done making changes, check that your changes pass all tests and security linters (Ruff, Pip-Audit, etc.)::
 
     $ make test
 
-7. When you're done making changes, check that your changes pass the tests and
-   flake8::
+   (Tox will automatically run all linting, security scans, and tests with coverage output.)
 
-    $ flake8 snappass tests.py setup.py
-    $ tox
-
-8. Check that the test coverage hasn't dropped::
-
-    $ coverage run --source snappass tests.py
-    $ coverage report -m
-    $ coverage html
-
-9. Commit your changes and push your branch to GitHub::
+7. Commit your changes and push your branch to GitHub::
 
     $ git add .
     $ git commit -m "Your detailed description of your changes."
     $ git push origin name-of-your-bugfix-or-feature
 
-10. Submit a pull request through the GitHub website.
+8. Submit a pull request through the GitHub website.
 
 Pull Request Guidelines
 -----------------------

Dockerfile

@@ -8,7 +8,7 @@ RUN groupadd -r snappass && \
 
 WORKDIR $APP_DIR
 
-COPY ["pyproject.toml", "requirements.txt", "MANIFEST.in", "README.rst", "AUTHORS.rst", "LICENSE", "$APP_DIR/"]
+COPY ["pyproject.toml", "requirements.txt", "README.rst", "AUTHORS.rst", "LICENSE", "$APP_DIR/"]
 COPY ["./snappass", "$APP_DIR/snappass"]
 
 RUN pip install -r requirements.txt

MANIFEST.in

@@ -1,6 +1,7 @@
 coverage==7.6.0
 fakeredis==2.25.1
-flake8==7.1.1
+ruff==0.6.2
+pip-audit==2.7.3
 freezegun==1.5.1
 pytest==8.3.2
 pytest-cov==5.0.0

dev-requirements.txt

@@ -27,3 +27,9 @@ Homepage = "https://github.com/pinterest/snappass"
 
 [project.scripts]
 snappass = "snappass.main:main"
+
+[tool.ruff.lint]
+select = ["E", "F", "S"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests.py" = ["S105", "S101"]

pyproject.toml

@@ -48,7 +48,8 @@ def get_locale() -> typing.Optional[str]:
     redis_client = FakeStrictRedis(version=(6, 2), protocol=2)  # type: ignore
 elif os.environ.get('REDIS_URL'):
     redis_url = os.environ.get('REDIS_URL')
-    assert redis_url is not None
+    if not redis_url:
+        raise ValueError("REDIS_URL is empty")
     redis_client = redis.StrictRedis.from_url(redis_url)
 else:
     redis_host = os.environ.get('REDIS_HOST', 'localhost')
@@ -336,7 +337,7 @@ def health_check() -> typing.Dict[typing.Any, typing.Any]:
 
 @check_redis_alive
 def main() -> None:
-    app.run(host=os.environ.get('SNAPPASS_BIND_ADDRESS', '0.0.0.0'),
+    app.run(host=os.environ.get('SNAPPASS_BIND_ADDRESS', '0.0.0.0'),  # noqa: S104
             port=int(os.environ.get('SNAPPASS_PORT', 5000)))
 
 

snappass/main.py

@@ -1,5 +1,5 @@
 [tox]
-envlist = py310, py314, py315, flake8, mypy
+envlist = py310, py314, py315, ruff, pip-audit, mypy
 skip_missing_interpreters = true
 
 [testenv]
@@ -11,15 +11,18 @@ commands =
     pip install -r dev-requirements.txt
     pytest --cov=snappass --cov-report=term-missing tests.py
 
-[testenv:flake8]
+[testenv:ruff]
 commands =
    pip install -r dev-requirements.txt
-   flake8
+   ruff check .
+
+[testenv:pip-audit]
+commands =
+   pip install -r dev-requirements.txt
+   pip-audit -r requirements.txt
 
 [testenv:mypy]
 commands =
    pip install -r dev-requirements.txt
    mypy snappass
 
-[flake8]
-exclude = .tox, .git, __pycache__, .venv, venv, myenv, env