security-misc/.github/workflows/lint-python.yml at master · Kicksecure/security-misc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
---
## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## AI-Assisted

## Simple Python lint for fm_shim_frontend.
##
## Scope is intentionally narrow:
##   - usr/lib/python3/dist-packages/fm_shim_frontend/  (the only
##     Python in this repo)
##
## Tools:
##   flake8 --select=F  Pyflakes-class checks only (F-codes:
##                      undefined names, unused imports, unused
##                      local variables, etc.). Skips PEP8 style
##                      (E/W codes) - the codebase uses '##' block
##                      comments which would trigger E266 noise.
##                      flake8 over plain pyflakes because pyflakes
##                      does not honor '# noqa' (the standard
##                      escape-hatch for intentional violations);
##                      flake8 wraps pyflakes and adds that
##                      support. Pylint was deliberately not
##                      enabled here because pylint's interaction
##                      with PyQt5 produces a flood of
##                      'no-name-in-module' false positives (PyQt5
##                      generates its symbols dynamically; pylint
##                      cannot see them statically without a
##                      per-symbol --extension-pkg-allow-list that
##                      defeats the simplicity of this workflow).
##
## Source files in this repo carry a '#<package-tag>' suffix per
## the genmkfile convention. pyflakes discovers sources by file
## extension; ci/codeql-prepare.sh creates extension-clean symlinks
## that re-use that fix.

name: Lint Python

on:
  push:
    paths:
      - 'usr/lib/python3/dist-packages/fm_shim_frontend/**'
      - 'ci/codeql-prepare.sh'
      - '.github/workflows/lint-python.yml'
  pull_request:
    paths:
      - 'usr/lib/python3/dist-packages/fm_shim_frontend/**'
      - 'ci/codeql-prepare.sh'
      - '.github/workflows/lint-python.yml'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint Python
    runs-on: ubuntu-latest
    timeout-minutes: 10

    if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request'

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - name: Prepare apt cache directory
        run: |
          sudo mkdir -p /var/cache/apt/archives
          sudo chown -R "$(id -u):$(id -g)" /var/cache/apt/archives

      - name: Cache apt packages
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
        with:
          path: /var/cache/apt/archives
          key: ${{ runner.os }}-apt-lint-python-${{ hashFiles('.github/workflows/lint-python.yml') }}
          restore-keys: |
            ${{ runner.os }}-apt-lint-python-

      - name: Install flake8 + Hypothesis test deps
        ## python3-pyqt5 + python3-pyqt5.sip are runtime deps of
        ## fm_shim_frontend; pytest + hypothesis are needed for the
        ## property-test suite added in 2026-05.
        run: |
          sudo --non-interactive apt-get update --error-on=any
          sudo --non-interactive apt-get install --yes --no-install-recommends \
            flake8 \
            python3-pytest python3-hypothesis \
            python3-pyqt5 python3-pyqt5.sip

      - name: Prepare extension-clean Python source paths
        run: bash ci/codeql-prepare.sh

      - name: flake8 (pyflakes checks only)
        ## Pass the symlinked clean-name files explicitly. Without
        ## the explicit list, flake8 walks the directory and would
        ## see each source twice (once via the symlink, once via
        ## the original '*.py#tag') - causing duplicate findings.
        run: |
          flake8 --select=F -- \
            usr/lib/python3/dist-packages/fm_shim_frontend/__init__.py \
            usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py

      - name: Hypothesis property tests
        ## Coverage-based property fuzzing of the URI-validation
        ## chokepoint (get_path_list_from_uris). Already caught one
        ## real ENAMETOOLONG-on-long-path crash bug at introduction
        ## (see ci/tests/fm_shim_frontend/test_property.py header).
        env:
          PYTHONPATH: usr/lib/python3/dist-packages
        run: |
          python3 -m pytest --import-mode=importlib -q \
            ci/tests/fm_shim_frontend/test_property.py