@biffo/cli 0.173.3 → 0.173.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -192,7 +192,21 @@ if [ -n "$PY_DIRS" ]; then
|
|
|
192
192
|
# bandit is NOT excluded: it exits non-zero on findings and it is the
|
|
193
193
|
# RUN step that fails in CI, not the artefact upload. See the exclusion
|
|
194
194
|
# audit in verify-parity.test.ts (#855).
|
|
195
|
-
|
|
195
|
+
#
|
|
196
|
+
# Scoped to the SAME paths CI scans, never wider. CI runs
|
|
197
|
+
# `-r services/api services/_plugins` -- template-owned code only --
|
|
198
|
+
# because a template-shipped check asserting over paths the template
|
|
199
|
+
# does not own reds an instance on content it neither wrote nor can
|
|
200
|
+
# repair (#325). Running `-r services` here found three B310s in
|
|
201
|
+
# biffo-platform's user-owned services/idea-scout/ and refused a push CI
|
|
202
|
+
# would have passed: the gate being stricter than CI is its own defect,
|
|
203
|
+
# and it is what drives people to BIFFO_SKIP_VERIFY.
|
|
204
|
+
bandit_paths=""
|
|
205
|
+
[ -d services/api ] && bandit_paths="$bandit_paths services/api"
|
|
206
|
+
[ -d services/_plugins ] && bandit_paths="$bandit_paths services/_plugins"
|
|
207
|
+
[ -z "$bandit_paths" ] && [ -d src ] && bandit_paths="src"
|
|
208
|
+
# shellcheck disable=SC2086
|
|
209
|
+
[ -n "$bandit_paths" ] && run_check "bandit$suffix" uv run bandit -r $bandit_paths -ll -q
|
|
196
210
|
if [ -n "$PYTEST" ]; then
|
|
197
211
|
run_check "pytest$suffix" uv run pytest -q
|
|
198
212
|
else
|
|
@@ -192,7 +192,21 @@ if [ -n "$PY_DIRS" ]; then
|
|
|
192
192
|
# bandit is NOT excluded: it exits non-zero on findings and it is the
|
|
193
193
|
# RUN step that fails in CI, not the artefact upload. See the exclusion
|
|
194
194
|
# audit in verify-parity.test.ts (#855).
|
|
195
|
-
|
|
195
|
+
#
|
|
196
|
+
# Scoped to the SAME paths CI scans, never wider. CI runs
|
|
197
|
+
# `-r services/api services/_plugins` -- template-owned code only --
|
|
198
|
+
# because a template-shipped check asserting over paths the template
|
|
199
|
+
# does not own reds an instance on content it neither wrote nor can
|
|
200
|
+
# repair (#325). Running `-r services` here found three B310s in
|
|
201
|
+
# biffo-platform's user-owned services/idea-scout/ and refused a push CI
|
|
202
|
+
# would have passed: the gate being stricter than CI is its own defect,
|
|
203
|
+
# and it is what drives people to BIFFO_SKIP_VERIFY.
|
|
204
|
+
bandit_paths=""
|
|
205
|
+
[ -d services/api ] && bandit_paths="$bandit_paths services/api"
|
|
206
|
+
[ -d services/_plugins ] && bandit_paths="$bandit_paths services/_plugins"
|
|
207
|
+
[ -z "$bandit_paths" ] && [ -d src ] && bandit_paths="src"
|
|
208
|
+
# shellcheck disable=SC2086
|
|
209
|
+
[ -n "$bandit_paths" ] && run_check "bandit$suffix" uv run bandit -r $bandit_paths -ll -q
|
|
196
210
|
if [ -n "$PYTEST" ]; then
|
|
197
211
|
run_check "pytest$suffix" uv run pytest -q
|
|
198
212
|
else
|