rick/LEDMatrix
1
0
Fork 0
mirror of https://github.com/ChuckBuilds/LEDMatrix.git synced 2026-10-18 04:49:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: add the Ruff suppression nosec/nosemgrep do not cover

Browse Source 
Ruff reports S603 on the same call Bandit and Opengrep do, and none of
the three suppressions covers the others. Confirmed the precondition
first: path comes from discover_plugin_tests(), which globs test files
inside the repo, and the call is a fixed interpreter with a list argv
and no shell.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014RRtqXDCnvnY6EQwhT5CV9
This commit is contained in:
ChuckBuilds
2026-09-07 13:35:18 -04:00
co-authored by Claude Opus 5
parent 25d3f35b55
commit 4a64a37b01
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/run_plugin_tests.py
+1 -1
View File
@@ -115,7 +115,7 @@ def run_script_tests(test_files: list, verbose: bool = False) -> int:
# discovered by globbing the repo; argument list, no shell, so # discovered by globbing the repo; argument list, no shell, so
# nothing is word-split or expanded. Same suppression pair the # nothing is word-split or expanded. Same suppression pair the
# rest of the repo uses for this shape (see permission_utils.py). # rest of the repo uses for this shape (see permission_utils.py).
proc = subprocess.run( # nosec B603 - no shell invoked (list-form argv) # nosemgrep proc = subprocess.run( # noqa: S603 # nosec B603 - no shell invoked (list-form argv) # nosemgrep
[sys.executable, str(path)], # nosemgrep [sys.executable, str(path)], # nosemgrep
cwd=str(Path(path).parent), cwd=str(Path(path).parent),
capture_output=True, text=True, env=env, capture_output=True, text=True, env=env,