Add Python toolchain with uv, ruff, ty, and security scanning - #41
Closed
waynesun09 wants to merge 6 commits into
Closed
Add Python toolchain with uv, ruff, ty, and security scanning#41waynesun09 wants to merge 6 commits into
waynesun09 wants to merge 6 commits into
Conversation
Add pre-commit configuration with: - ruff for linting and formatting - ty for type checking (via uvx) - bandit for Python security scanning - gitleaks for secret detection - actionlint for GitHub Actions workflow validation - pre-commit-hooks for YAML/JSON/TOML validation and private key detection Add CI workflow using uv + pre-commit on GitHub Actions with explicit permissions: contents: read. Add ruff.toml and .python-version for local development. No pyproject.toml since this repo is not a Python package. Signed-off-by: Wayne Sun <gsun@redhat.com>
Auto-fix import sorting (I001), unused imports (F401), and format long lines (E501) across experiment Python code. Signed-off-by: Wayne Sun <gsun@redhat.com>
B603 (subprocess_without_shell_equals_true) flags subprocess.run with a list of args, which is the safe pattern. False positive in test code. Signed-off-by: Wayne Sun <gsun@redhat.com>
Fix pre-existing trailing whitespace in contributor-guidance.md. Skip B404 (import-subprocess) alongside B101 and B603 — flagging the subprocess import itself is noise in test code. Signed-off-by: Wayne Sun <gsun@redhat.com>
Signed-off-by: Wayne Sun <gsun@redhat.com>
Experiment code has heavy dependencies (torch, transformers, anthropic) that aren't installed in CI. ty runs locally via pre-commit where developers have their venv. The CI ty step can be added back when hack/ scripts land (PR #39) as a lightweight target. Signed-off-by: Wayne Sun <gsun@redhat.com>
This was referenced Jul 8, 2026
Open
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
permissions: contents: readWhy
The repo has Python code in
experiments/with no linting, no formatting, no type checking, and no security scanning. The CI workflow (from PR #39) doesn't install Python dependencies and has no security hardening.Design choices
pyproject.toml— this repo is not a Python package. Tool config lives inruff.tomland.pre-commit-config.yaml. When PR Add lightweight ADR process with Undecided state and CI linting #39 merges,hack/lint-adr-frontmattercan adopt PEP 723 inline script metadata souv runauto-installs its PyYAML dependency.Security scanning coverage