mirror of
https://github.com/ChuckBuilds/LEDMatrix.git
synced 2026-08-01 08:48:05 +00:00
ChuckandClaude Fable 5
73a5304194
Deletions, each re-verified with a fresh repo-wide grep (core, web, scripts, docs, plugin monorepo) immediately before removal: Modules with zero live importers: - src/background_cache_mixin.py + src/generic_cache_mixin.py (134+150 LOC — referenced only by each other) - src/font_test_manager.py (134 LOC) - src/image_utils.py (22 LOC, self-documented deprecated) - src/layout_manager.py (408 LOC — only its own test imported it) + test/test_layout_manager.py - src/common/basketball_plugin_example.py (328 LOC sample) requirements.txt entries with zero importers in core (pre-plugin-era manager deps): icalevents, geopy, timezonefinder, unidecode. Plus the google-auth trio (google-auth-oauthlib, google-auth-httplib2, google-api-python-client): their only importer is the calendar PLUGIN, which declares all three in its own requirements.txt (verified in the monorepo and on an installed copy) — the plugin dependency installer owns them. Existing venvs are unaffected (removal doesn't uninstall); fresh installs get them when calendar is installed. Two stale references cleaned (a comment in test_pillow_compat.py, a directory listing in HOW_TO_RUN_TESTS.md). Full suite green except the two documented pre-existing failures (circuit_breaker mock drift, fixed in #400; clock-simple 64x32 overflow, pre-dates this series); all core entry modules verified importing cleanly under the emulator. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FqzC1nzTWL4kaqgMaQZFam
34 lines
1.3 KiB
YAML
34 lines
1.3 KiB
YAML
# bandit.yaml — LEDMatrix bandit configuration
|
|
# https://bandit.readthedocs.io/en/latest/config.html
|
|
#
|
|
# Skips are justified by the specific codebase context documented below.
|
|
# Do not remove skips without updating the justification comment.
|
|
|
|
skips:
|
|
# B104: Binding to all interfaces (0.0.0.0)
|
|
# Intentional — the Flask server binds 0.0.0.0 for LAN access on a Raspberry Pi.
|
|
# This is not internet-facing and is documented in web_interface/app.py.
|
|
- B104
|
|
|
|
# B603: subprocess call without shell=True
|
|
# All subprocess.run() calls in this codebase use list arguments (confirmed by
|
|
# grep — zero uses of shell=True in src/ or web_interface/). List args prevent
|
|
# shell injection. See src/common/permission_utils.py for the primary usage.
|
|
- B603
|
|
|
|
# B607: Starting a process with a partial executable path
|
|
# The subprocess calls invoke system utilities (systemctl, sudo, git) by name.
|
|
# These are fixed-list invocations, not user-controlled, and rely on PATH.
|
|
- B607
|
|
|
|
exclude_dirs:
|
|
- tests
|
|
- test
|
|
- venv
|
|
- .venv
|
|
- rpi-rgb-led-matrix-master
|
|
# prove_security.py intentionally contains detection patterns as string literals
|
|
# (e.g. "eval(", "exec(") to search for in other files — bandit would flag
|
|
# these as false positives.
|
|
- scripts/prove_security.py
|