Add stricter configuration defaults #157
Conversation
- Bump minimum Python to 3.11, remove 3.10 from CI matrix - Add security pre-commit hooks: shellcheck, actionlint, zizmor - Add ruff src path and docstring-code-format settings - Enable branch coverage with standard exclude patterns - Add pip-audit dependency group for vulnerability scanning Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
|
||
| # Shell script linting | ||
| - repo: https://github.com/koalaman/shellcheck-precommit | ||
| rev: v0.11.0 |
There was a problem hiding this comment.
there should be a plan for keeping these up to date
dependabot doesn't appear to support keeping these up to date AFAICT, although it might be coming soon dependabot/dependabot-core#1524 dependabot/dependabot-core#13977
also these should probably be frozen to the git hash with a comment of what the version is similar to what's being done in the github actions to mitigate supply chain attacks
There was a problem hiding this comment.
Turns out prek has this using https://prek.j178.dev/cli/#prek-auto-update so we just need to add it as a workflow
There was a problem hiding this comment.
alright claude implemented a simple auto updater in this commit 79a8adf
but we need to configure a github app id and secret and have it set org-wide
instructions on how to do that are here
https://github.com/actions/create-github-app-token?tab=readme-ov-file#usage
Summary
srcpath for first-party imports,docstring-code-formatTest plan
make lint && make testmake lint && make testuv run pip-auditruns successfully🤖 Generated with Claude Code