python/ruff

Lints every Python file with the Ruff rules for the level, security rules included.

Part of the python configuration, at the recommended level. It runs at the commit stage, per file. It runs ruff. gspot check --fix fixes what it can.

Why

Undefined names, unused code, and insecure calls fail at run time or open a security hole, and a reader misses them.

What to do

Run gspot check --fix for the rules that fix themselves. Turn one rule off with gspot ignore python/ruff --rule <code> --reason "<why>", and add --paths to limit it.

Example

eval(user_input) reports S307. Parse the input instead, and allow only known operations.

Turn it off

Turn it off for some files, or one of its lint rules, with a reason:

gspot ignore python/ruff --paths "<glob>" --reason "<why>"
gspot ignore python/ruff --rule <rule> --reason "<why>"

To silence one place, write a comment such as:

import plugins  # noqa: F401 # the module registers its plugins on import