From 4a64a37b01d6619496e4608300499ffef11984a8 Mon Sep 17 00:00:00 2001 From: ChuckBuilds Date: Mon, 7 Sep 2026 13:35:18 -0400 Subject: [PATCH] chore: add the Ruff suppression nosec/nosemgrep do not cover Ruff reports S603 on the same call Bandit and Opengrep do, and none of the three suppressions covers the others. Confirmed the precondition first: path comes from discover_plugin_tests(), which globs test files inside the repo, and the call is a fixed interpreter with a list argv and no shell. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_014RRtqXDCnvnY6EQwhT5CV9 --- scripts/run_plugin_tests.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/run_plugin_tests.py b/scripts/run_plugin_tests.py index a8f7f072..fcaa8482 100755 --- a/scripts/run_plugin_tests.py +++ b/scripts/run_plugin_tests.py @@ -115,7 +115,7 @@ def run_script_tests(test_files: list, verbose: bool = False) -> int: # discovered by globbing the repo; argument list, no shell, so # nothing is word-split or expanded. Same suppression pair the # rest of the repo uses for this shape (see permission_utils.py). - proc = subprocess.run( # nosec B603 - no shell invoked (list-form argv) # nosemgrep + proc = subprocess.run( # noqa: S603 # nosec B603 - no shell invoked (list-form argv) # nosemgrep [sys.executable, str(path)], # nosemgrep cwd=str(Path(path).parent), capture_output=True, text=True, env=env,