Skip to content

Update linting settings #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mernst merged 7 commits into from
Jul 23, 2026
Merged

Update linting settings #52

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
60b3b25
Update linting settings
mernst Jul 23, 2026
9fe0156
Resolve linting errors
mernst Jul 23, 2026
afe53ea
Add Ruff configuration file
mernst Jul 23, 2026
e033602
Update linting settings
mernst Jul 23, 2026
3ab59c3
Update linting settings
mernst Jul 23, 2026
31fe3b9
Remove old style checking
mernst Jul 23, 2026
4aa718d
Remove old style checking
mernst Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .github/workflows/prek.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
name: Prek checks
"on": [push, pull_request]
jobs:
prek:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: j178/prek-action@v2
Comment on lines +3 to +8

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Repository files matching workflow/config context:"
git ls-files | rg '(^\.github/workflows/|\.pre-commit-config\.(yaml|yml)|pyproject\.toml|tox\.ini|setup\.cfg|Pipfile|poetry\.lock|package\.json|package-lock\.json)$' || true

echo
echo "Workflow contents:"
if [ -f .github/workflows/prek.yaml ]; then
  nl -ba .github/workflows/prek.yaml | sed -n '1,120p'
else
  echo "missing .github/workflows/prek.yaml"
fi

echo
echo "All action references in workflows:"
rg -n "uses:\s*[^#]+" .github/workflows || true

echo
echo "Security-relevant checkout/config keys in workflows:"
rg -n "permissions:|persist-credentials|permissions=|github-token|persist-credentials" .github/workflows || true

Repository: plume-lib/git-scripts

Length of output: 286

🌐 Web query:

actions/checkout README v4 v2 persist-credentials default false

💡 Result:

In the actions/checkout GitHub Action, the persist-credentials input has a default value of true [1][2][3]. This behavior is consistent across versions, including v2 [3][4][5] and v4 [6][1][2]. When persist-credentials is set to true (the default), the action configures the authentication token or SSH key in the local git configuration [1][2][4]. This allows subsequent steps in the workflow to perform authenticated git commands (e.g., git fetch, git push) [6][3][4]. To disable this behavior, you must explicitly set persist-credentials to false in your workflow step configuration [6][3][4]. It is important to note that while the default remains true, the underlying implementation has evolved. Recent versions, such as v6.0.0 and later, have improved security by storing the credentials in a separate file under $RUNNER_TEMP rather than directly in the local.git/config file [7][8][9]. Regardless of the implementation, the token or key is removed during the post-job cleanup [6][10][3].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "pyproject workflow/action references:"
sed -n '1,220p' pyproject.toml 2>/dev/null || true

echo
echo "All occurrences of prek/pre-commit/github/token:"
rg -n "prek|pre-commit|github-token|GITHUB_TOKEN|permissions|persist-credentials|actions/checkout|j178/prek-action" . || true

echo
echo "Files at root/workflows/config:"
find . -maxdepth 3 -type f \( -path '.github/*' -o -name '*.yaml' -o -name '*.yml' -o -name 'pyproject.toml' \) -print | sort

Repository: plume-lib/git-scripts

Length of output: 1331

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo ".github/workflows/prek.yaml:"
cat -n .github/workflows/prek.yaml

echo
echo ".github/workflows/style.yml:"
cat -n .github/workflows/style.yml

echo
echo ".github/workfiles/test.yml:"
cat -n .github/workflows/test.yml

echo
echo "prek.toml:"
cat -n prek.toml

Repository: plume-lib/git-scripts

Length of output: 9323

🌐 Web query:

pymarkdownlnt version 0.9.33 support Python 3.14

💡 Result:

No, pymarkdownlnt version 0.9.33 does not provide support for Python 3.14. Version 0.9.33 of the PyMarkdown Linter was released on October 22, 2025 [1][2]. While Python 3.14.0 was released shortly before that on October 7, 2025 [3][4], the release notes for version 0.9.33 explicitly state that the project's testing efforts at that time were focused on upgrading the minimum supported Python version from 3.9 to 3.10 [2]. There is no mention of support for Python 3.14 in the version 0.9.33 changelog [1][2]. As of July 23, 2026, newer versions of pymarkdownlnt (such as 0.9.37 and later) are available [5], and users requiring compatibility with newer Python releases should update to the latest version of the package [5].

Citations:

Constrain and discard credentials before running hooks.

prek.yaml runs checkout before external hooks without explicit least-privilege permissions, so set contents: read and disable actions/checkout’s default persistent credentials.

Proposed fix 
 "on": [push,_pull_request]
+permissions:
+  contents: read
 jobs:
   prek:
@@
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
jobs:
prek:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: j178/prek-action@v2
permissions:
contents: read
jobs:
prek:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
with:
persist-credentials: false
- uses: j178/prek-action@v2
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 7-7: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 7-7: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 8-8: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[info] 4-4: workflow or action definition without a name (anonymous-definition): this job

(anonymous-definition)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/prek.yaml around lines 3 - 8, Update the prek job in the
workflow to declare least-privilege contents access with read-only permissions,
and configure the actions/checkout step with credential persistence disabled
before running j178/prek-action.

Source: Linters/SAST tools

Comment on lines +7 to +8

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow file =="
if [ -f .github/workflows/prek.yaml ]; then
  cat -n .github/workflows/prek.yaml
else
  echo "missing .github/workflows/prek.yaml"
fi

echo
echo "== version tags in workflow(s) =="
rg -n "uses:\s*[A-Za-z0-9_-]+/[A-Za-z0-9_.-]+@(v[0-9]|[0-9]+\.[0-9]+)" .github/workflows || true

echo
echo "== policy mentions =="
rg -n -i "pin|sha|commit|github actions|actions allowed|allowed|unpinned|security" . 2>/dev/null | head -n 200 || true

Repository: plume-lib/git-scripts

Length of output: 50377

🌐 Web query:

GitHub Actions managed actions actions/checkout v7

💡 Result:

As of July 23, 2026, the latest version of the GitHub Actions actions/checkout action is v7.0.1, released on July 20, 2026 [1][2]. Key updates and changes in the v7 release include: - Security Enhancements: By default, actions/checkout now refuses to check out fork pull request code when the workflow is triggered by pull_request_target or workflow_run [3]. This change helps mitigate "pwn request" vulnerabilities that can occur when executing untrusted fork code with elevated GITHUB_TOKEN permissions [3]. To opt-in to the previous behavior, users must set the new input allow-unsafe-pr-checkout: true [3]. - Architecture Update: The action has been migrated to ECMAScript Modules (ESM) to ensure compatibility with newer versions of the @actions/* packages [3]. - Dependency Updates: The release includes various updates to direct and transitive dependencies, addressing known security vulnerabilities [3]. For users who are not ready to upgrade to v7, the allow-unsafe-pr-checkout feature has been backported to versions v6.1.0 and v5.1.0 (both released on July 20, 2026) to provide similar security protections [4][5].

Citations:

Pin the actions to full commit SHAs.

actions/checkout@v7 and j178/prek-action@v2 are mutable tag references; replace them with immutable commits for repository actions that execute code in-workflow.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 7-7: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 7-7: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 8-8: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/prek.yaml around lines 7 - 8, Update the workflow action
references for actions/checkout and j178/prek-action to immutable full commit
SHAs instead of mutable version tags, preserving their current action versions
and configuration.

Source: Linters/SAST tools

with:
extra-args: '-q'
22 changes: 0 additions & 22 deletions .github/workflows/style.yml
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
name: Run Small test
on: [push, pull_request] # yamllint disable-line rule:truthy
on: [push, pull_request] # yamllint disable-line rule:truthy
Comment thread
mernst marked this conversation as resolved.
jobs:
test:
runs-on: ubuntu-latest
Expand Down
69 changes: 69 additions & 0 deletions .ruff.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,69 @@
line-length = 100
output-format = "concise"

[lint]
preview = true
extend-select = [
"I",
"D",
"DOC",
"B",
"A",
"COM",
"C4",
"DTZ",
"EM",
"EXE",
"FA",
"INT",
"ISC",
"ICN",
"PIE",
"PYI",
"Q",
"RET",
"SLF",
"SIM",
"SLOT",
"TID",
"TC",
"ARG",
"PTH",
"FLY",
"NPY",
"PD",
"N",
"PERF",
"E",
"W",
"F",
"PLC",
"PLE",
"UP",
"FURB",
"RUF",
"TRY",
]
extend-ignore = [
"COM812",
"D203",
"D213",
"D400",
"D413",
"DOC501",
"E266",
"EM101",
"PLC1901",
"RET504",
"SIM102",
"SIM108",
"TRY002",
"TRY003",
"TRY300",
]

[lint.pycodestyle]
max-line-length = 100

[format]
docstring-code-format = false
4 changes: 4 additions & 0 deletions .yamlfmt.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
formatter:
retain_line_breaks: true
scan_folded_as_literal: true
drop_unnecessary_doc_start: false
5 changes: 5 additions & 0 deletions .yamllint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
extends: default

rules:
document-start: disable
line-length: disable
8 changes: 0 additions & 8 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,3 @@ test:

clean:
${MAKE} -C tests clean

PLUME_SCRIPTS ?= .plume-scripts

# Code style; defines `style-check` and `style-fix`.
ifeq (,$(wildcard ${PLUME_SCRIPTS}))
dummy := $(shell git clone --depth=1 -q https://github.com/plume-lib/plume-scripts.git ${PLUME_SCRIPTS})
endif
include ${PLUME_SCRIPTS}/code-style.mak
234 changes: 234 additions & 0 deletions prek.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,234 @@
# Configuration file for `prek`, a git hook framework written in Rust.
# See https://prek.j178.dev for more information.
#:schema https://www.schemastore.org/prek.json

[[repos]]
repo = "builtin"
hooks = [
{ id = "check-added-large-files" },
{ id = "check-case-conflict" },
{ id = "check-executables-have-shebangs", exclude = { glob = [
"search",
] } },
{ id = "check-json" },
{ id = "check-merge-conflict" },
{ id = "check-shebang-scripts-are-executable" },
{ id = "check-symlinks", exclude = { glob = [
".subversion/auth",
"dots/.subversion/auth",
] } },
{ id = "check-toml" },
{ id = "check-vcs-permalinks" },
{ id = "check-xml" },
{ id = "check-yaml" },
{ id = "destroyed-symlinks" },
{ id = "detect-private-key" },
{ id = "end-of-file-fixer", exclude = { glob = [
"bugs/jikes-patches/*",
"**/non-conflicted-file-without-terminator.txt",
"**/native-image/**",
"**/tests/squeeze-blank-lines-test/**",
] } },
{ id = "fix-byte-order-marker" },
{ id = "forbid-new-submodules" },
{ id = "mixed-line-ending" },
{ id = "trailing-whitespace", exclude = { glob = [
"**/*.diff",
"**/*.diff3",
"**/*.patch",
"**/tests/squeeze-blank-lines-test/**",
".aspell.en.prepl",
".aspell.en.pws",
"bugs/BUGS.to-do",
"bugs/bug-mew",
"bugs/jikes-patches/*",
"dots/.aspell.en.prepl",
"dots/.aspell.en.pws",
"dots/en_US_apostrophe.aff",
"dots/enscript.st",
"emacs/bug/crypted.UUE",
"en_US_apostrophe.aff",
"enscript.st",
] } },
]

## GitHub Actions

[[repos]]
repo = "https://github.com/rhysd/actionlint"
rev = "v1.7.12"
hooks = [{ id = "actionlint" }]

## HTML

[[repos]]
repo = "https://github.com/Lucas-C/pre-commit-hooks-java"
rev = "1.3.10"
hooks = [{ id = "validate-html", exclude = { glob = ["**/bytopic-headfoot.html"] }}]

## Makefiles

[[repos]]
repo = "https://github.com/checkmake/checkmake.git"
rev = "0.2.2"
hooks = [{ id = "checkmake" }]

## Markdown

[[repos]]
repo = "https://github.com/DavidAnson/markdownlint-cli2"
rev = "v0.23.1"
hooks = [{ id = "markdownlint-cli2" }]

## Pre-commit itself

[[repos]]
repo = "https://github.com/pre-commit/sync-pre-commit-deps"
rev = "v0.0.4"
hooks = [{ id = "sync-pre-commit-deps" }]

## Python

[[repos]]
repo = "https://github.com/astral-sh/ruff-pre-commit"
rev = "v0.15.22" # Ruff version.
hooks = [
# Run the linter.
{ id = "ruff-check", args = ["--fix"], types_or = ["python", "pyi"] },

# Run the formatter.
{ id = "ruff-format", types_or = ["python", "pyi"] },
]

[[repos]]
repo = "https://github.com/astral-sh/ty-pre-commit"
rev = "v0.0.62" # ty version.
hooks = [{ id = "ty", types_or = ["python", "pyi"] }]

[[repos]]
repo = "https://github.com/asottile/pyupgrade"
rev = "v3.21.2"
hooks = [{ id = "pyupgrade" }]

## Secrets

[[repos]]
repo = "https://github.com/gitleaks/gitleaks"
rev = "v8.24.2"
hooks = [{ id = "gitleaks", exclude = { glob = ["**/AdjacentTest*"] } }]

[[repos]]
repo = "https://github.com/Yelp/detect-secrets"
rev = "v1.5.0"
hooks = [{ id = "detect-secrets", exclude = { glob = ["**/AdjacentTest*"] } }]

## Shell scripts

[[repos]]
repo = "https://github.com/shellcheck-py/shellcheck-py"
rev = "v0.11.0.1"
hooks = [
{ id = "shellcheck", args = [
"-x",
"-P",
"SCRIPTDIR",
], exclude = { glob = [
"share/csail-athena-tickets.bash",
"share/addrfilter",
"share/print-mail",
"share/javapp",
"share/myxapps",
"cronic-orig",
"classfile_check_version",
] } },
]

[[repos]]
repo = "https://github.com/scop/pre-commit-shfmt"
rev = "v3.13.1-1"
hooks = [
{ id = "shfmt", args = [
"-i",
"2",
"-ci",
"-bn",
"-sr",
], exclude = { glob = [
"gradlew",
"share/addrfilter",
"dots/conda-initialize.sh",
"conda-initialize.sh",
] } },
]

# TODO: checkbashisms (I need to write my own).
# [[repos]]
# repo = "TODO"
# hooks = [
# { id = "checkbashisms", types = [
# "shell",
# ], exclude = { glob = [
# "share/addrfilter",
# "share/print-mail",
# "share/myxapps",
# "share/javapp",
# "gradlew",
# ] } },
# ]

# Problems:
# * False positives for E011.
# * It requires indent to be a multiple of 4.
# [[repos]]
# repo = "https://github.com/openstack/bashate"
# rev = "2.1.1"
# hooks = [
# { id = "bashate", exclude = { glob = ["share/csail-athena-tickets.bash" ] } },
# ]

## Text

# Very noisy.
# [[repos]]
# repo = "https://github.com/errata-ai/vale"
# rev = "16d3a7f"
# hooks = [ #{id = "vale", name = "vale sync", pass_filenames = false, args = ["sync"], },
# { id = "vale", args = [
# "--output=line",
# "--minAlertLevel=error",
# ] },
# ]

# Very disruptive. Perhaps re-enable later.
# [[repos]]
# repo = "https://github.com/crate-ci/typos"
# rev = "v1.48.0"
# hooks = [
# { id = "typos", exclude = { glob = [".abbrev_defs", "share/mail-review-spam", "bugs/jikes-patches/*", "share/checkbashisms", "dots/.aspell.en.prepl", ".aspell.en.prepl", "dots/en_US_apostrophe.dic", "dots/.aspell.en.pws", ".aspell.en.pws", "dots/en_US_apostrophe.aff", "en_US_apostrophe.aff" ] } }
# ]

# Very noisy. Perhaps re-enable later.
# [[repos]]
# repo = "https://github.com/codespell-project/codespell"
# rev = "v2.4.1"
# hooks = [
# { id = "codespell", exclude = { glob = [ "en_US_apostrophe.dic", ".ssh/known_hosts", "enscript.st" ] } },
# ]

# proselint does not understand fenced code blocks in markdown files.
# [[repos]]
# repo = "https://github.com/amperser/proselint"
# rev = "v0.16.0"
# hooks = [{ id = "proselint", args = ["check"], }]

## YAML

[[repos]]
repo = "https://github.com/google/yamlfmt"
rev = "v0.19.0"
hooks = [{ id = "yamlfmt" }]

[[repos]]
repo = "https://github.com/adrienverge/yamllint.git"
rev = "v1.29.0"
hooks = [{ id = "yamllint" }]
Comment on lines +226 to +234

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== files =="
git ls-files | sed -n '1,220p'

echo "== prek config around lines 200-230 =="
if [ -f prek.toml ]; then
  nl -ba prek.toml | sed -n '190,240p'
fi

echo "== pmd references =="
rg -n --hidden --glob '!/.git/**' 'pmd|\.pmd-ruleset\.xml|ruleset|Pre-commit|pre-commit|prek|workflow|workflow_dispatch|push:' . || true

echo "== workflows =="
git ls-files '.github/workflows/*' | while read -r f; do
  echo "--- $f"
  nl -ba "$f" | sed -n '1,220p'
done

Repository: plume-lib/git-scripts

Length of output: 1614

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== prek config around lines 200-230 =="
if [ -f prek.toml ]; then
  awk '{printf "%6d\t%s\n", NR, $0}' prek.toml | sed -n '190,240p'
fi

echo "== PMD reference count and hits =="
rg -n --hidden '\b[pP][mM][dD]\b|\.pmd-ruleset\.xml|pmd-ruleset|sourceMainJava|java|ruleset|language/java' . || true

echo "== workflow files =="
for f in .github/workflows/prek.yaml .github/workflows/style.yml .github/workflows/test.yml; do
  [ -f "$f" ] || continue
  echo "--- $f"
  awk '{printf "%6d\t%s\n", NR, $0}' "$f" | sed -n '1,220p'
done

echo "== PMD hooks in prek.toml =="
awk 'BEGIN{RS="\n\\[\\[.*\\]\\]}{gsub(/.*\n/,""); if($0 ~ /pmd|\.pmd-ruleset\.xml|java/){print FILENAME": " $0}}' prek.toml || true

Repository: plume-lib/git-scripts

Length of output: 36710

Register PMD with prek or CI.

.prek.yaml runs prek only, and prek.toml has no PMD hook/step using .pmd-ruleset.xml, so the new Java PMD ruleset is not enforced locally or in CI. Add a PMD hook/step that explicitly consumes this ruleset and pin a compatible PMD version.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@prek.toml` around lines 217 - 225, Update prek.toml to add a pinned PMD hook
or step that runs against the Java sources and explicitly uses .pmd-ruleset.xml,
ensuring the new PMD ruleset is enforced by prek and CI alongside the existing
yamlfmt and yamllint hooks.

2 changes: 2 additions & 0 deletions tests/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
.PHONY: all clean test
Comment thread
mernst marked this conversation as resolved.

test:
${MAKE} -C git-clone-related-test test
${MAKE} -C resolve-adjacent-conflicts-test
Expand Down
Loading