treefmt-check
default.checks.aarch64-darwin.treefmt
· build #44
· raw
1treefmt v2.5.0ERRO formatter | ruff-check: failed to apply with options '[check --fix]': exit status 123warning: #ruff:ignore comment found but not active, enable preview mode4SIM115 Use a context manager for opening files5 --> nixpkgs_review/buildenv.py:24:316 |722 | raise RuntimeError(msg)823 |924 | self.nixpkgs_config = NamedTemporaryFile(suffix=".nix") # ruff:ignore[open-file-with-context-handler]10 | ^^^^^^^^^^^^^^^^^^1125 | self.old_cwd: Path | None = None1226 | self.environ: dict[str, str] | None = None13 |1415DTZ007 Naive datetime constructed using `datetime.datetime.strptime()` without %z16 --> nixpkgs_review/cli/comments.py:165:1217 |18163 | def parse_time(string: str) -> datetime:19164 | # Should we care about timezone here? %z20165 | return datetime.strptime(string, "%Y-%m-%dT%H:%M:%SZ") # ruff:ignore[call-datetime-strptime-without-zone]21 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^22 |23help: Call `.replace(tzinfo=<timezone>)` or `.astimezone()` to convert to an aware datetime2425S310 Audit URL open for permitted schemes. Allowing use of `file:` or custom schemes is often unexpected.26 --> nixpkgs_review/github.py:114:1527 |28112 | body = json.dumps(data).encode("ascii")29113 |30114 | req = urllib.request.Request( # ruff:ignore[suspicious-url-open-usage]31 | _______________^32115 | | url,33116 | | headers=self.headers,34117 | | method=method,35118 | | data=body,36119 | | )37 | |_________^38120 | with http_requests.urlopen(req) as resp:39121 | result: JSONType = json.loads(resp.read())40 |4142S310 Audit URL open for permitted schemes. Allowing use of `file:` or custom schemes is often unexpected.43 --> nixpkgs_review/github.py:251:1544 |45249 | raise RuntimeError(msg)46250 |47251 | req = urllib.request.Request(new_url) # ruff:ignore[suspicious-url-open-usage]48 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^49252 | with (50253 | http_requests.urlopen(req) as new_resp,51 |5253S310 Audit URL open for permitted schemes. Allowing use of `file:` or custom schemes is often unexpected.54 --> nixpkgs_review/http_requests.py:32:3355 |5630 | raise ValueError(msg)5731 |5832 | return cast("HTTPResponse", urllib.request.urlopen(url, timeout=timeout)) # ruff:ignore[suspicious-url-open-usage]59 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^60 |6162S108 Probable insecure usage of temporary file or directory: "/tmp"63 --> nixpkgs_review/nix.py:216:1664 |65214 | *bind("/"),66215 | *bind("/dev", dev=True),67216 | *tmpfs("/tmp"), # ruff:ignore[hardcoded-temp-file]68 | ^^^^^^69217 | # Required for evaluation70218 | *bind(config.nixpkgs_config),71 |7273S108 Probable insecure usage of temporary file or directory: "/tmp/.X11-unix"74 --> nixpkgs_review/nix.py:228:1575 |76226 | *bind(nixpkgs_config_dir, try_=True),77227 | # For X11 applications78228 | *bind("/tmp/.X11-unix", try_=True), # ruff:ignore[hardcoded-temp-file]79 | ^^^^^^^^^^^^^^^^80229 | *bind(xauthority, try_=True),81230 | # GitHub82 |8384SIM115 Use a context manager for opening files85 --> nixpkgs_review/nix.py:314:1786 |87312 | build_config: BuildConfig,88313 | ) -> dict[System, list[Attr]]:89314 | attr_json = NamedTemporaryFile(mode="w+", delete=False) # ruff:ignore[open-file-with-context-handler]90 | ^^^^^^^^^^^^^^^^^^91315 | delete = True92316 | try:93 |9495S314 Using `xml` to parse untrusted data is known to be vulnerable to XML attacks; use `defusedxml` equivalents96 --> nixpkgs_review/review.py:723:1597 |98721 | current_pkg: Package | None = None99722 |100723 | context = ET.iterparse(stdout, events=("start", "end")) # ruff:ignore[suspicious-xml-element-tree-usage]101 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^102724 | for event, elem in context:103725 | if elem.tag == "item" and event == "start":104 |105106S105 Possible hardcoded password assigned to: "GITHUB_TOKEN"107 --> tests/test_github_actions.py:19:38108 |10918 | os.environ["PR"] = "1"11019 | os.environ["GITHUB_TOKEN"] = "foo" # ruff:ignore[hardcoded-password-string]111 | ^^^^^11220 | os.environ["NIXPKGS_REVIEW_ROOT"] = str(root)11321 | mock_urlopen.side_effect = [mock_open(read_data="{}")()]114 |115116S105 Possible hardcoded password assigned to: "GITHUB_TOKEN"117 --> tests/test_github_actions.py:32:38118 |11930 | root = nixpkgs.path.parent12031 | os.environ["PR"] = "1"12132 | os.environ["GITHUB_TOKEN"] = "foo" # ruff:ignore[hardcoded-password-string]122 | ^^^^^12333 | os.environ["NIXPKGS_REVIEW_ROOT"] = str(root)12434 | mock_urlopen.side_effect = [125 |126127S105 Possible hardcoded password assigned to: "GITHUB_TOKEN"128 --> tests/test_github_actions.py:50:38129 |13048 | with helpers.save_environ():13149 | os.environ["PR"] = "1"13250 | os.environ["GITHUB_TOKEN"] = "foo" # ruff:ignore[hardcoded-password-string]133 | ^^^^^13451 | mock_urlopen.side_effect = [mock_open(read_data="{}")()]13552 | main("nixpkgs-review", ["approve"])136 |137138Found 12 errors.139140traversed 62 files141emitted 46 files for processing142formatted 13 files (0 changed) in 1.873s143Error: failed to finalise formatting: formatting failures detected