grabowski
b03318210c
security.yml previously ran safety/bandit/semgrep with `|| true` and could not go red. Now: pip-audit on requirements.txt is a hard gate (dev deps reported only), bandit HIGH fails (B104 bind-all skipped: intended behind Cloudflare/Caddy), pip-licenses uploaded as a report. Weekly + on dependency/source changes. Running it locally found 29 advisories, all in pinned-and-forgotten runtime deps: starlette 0.27 (7, incl. Host-header path confusion and form DoS), fastapi 0.104, requests 2.31 (3), pymysql 1.1. Bumped to current: fastapi 0.141.1 / starlette 1.6.0, pydantic 2.13.5, uvicorn 0.52.4, requests 2.34.2, pymysql 1.2.0; dev: pytest 9.1.1, black 26.5.1. pip-audit is now clean. requires-python narrowed to 3.11 (the truth: psycopg2-binary 2.9.9 fails on 3.13; pandas 2.0.3 has no 3.12 wheels). Full suite passes; API smoke-tested (health, stations, forecast, history, stats, docs, openapi) on the new stack. black 26 reformatted 8 files.
39 lines
974 B
YAML
39 lines
974 B
YAML
# Pre-commit hooks for Northern Thailand Ping River Monitor
|
|
# See https://pre-commit.com for more information
|
|
|
|
repos:
|
|
# General file checks
|
|
- repo: https://github.com/pre-commit/pre-commit-hooks
|
|
rev: v4.5.0
|
|
hooks:
|
|
- id: trailing-whitespace
|
|
- id: end-of-file-fixer
|
|
- id: check-yaml
|
|
- id: check-json
|
|
- id: check-toml
|
|
- id: check-added-large-files
|
|
args: ['--maxkb=1000']
|
|
- id: check-merge-conflict
|
|
- id: check-case-conflict
|
|
- id: mixed-line-ending
|
|
|
|
# Python code formatting with Black
|
|
- repo: https://github.com/psf/black
|
|
rev: 26.5.1
|
|
hooks:
|
|
- id: black
|
|
language_version: python3
|
|
|
|
# Import sorting with isort
|
|
- repo: https://github.com/pycqa/isort
|
|
rev: 5.12.0
|
|
hooks:
|
|
- id: isort
|
|
|
|
# Linting with flake8
|
|
- repo: https://github.com/pycqa/flake8
|
|
rev: 6.1.0
|
|
hooks:
|
|
- id: flake8
|
|
args: ['--max-line-length=100', '--extend-ignore=E203,W503']
|