tribuchet: building on eliza
treefmt v2.5.0ERRO formatter | ruff-check: failed to apply with options '[check --fix]': exit status 1

warning: #ruff:ignore comment found but not active, enable preview mode
SIM115 Use a context manager for opening files
  --> nixpkgs_review/buildenv.py:24:31
   |
22 |             raise RuntimeError(msg)
23 |
24 |         self.nixpkgs_config = NamedTemporaryFile(suffix=".nix")  # ruff:ignore[open-file-with-context-handler]
   |                               ^^^^^^^^^^^^^^^^^^
25 |         self.old_cwd: Path | None = None
26 |         self.environ: dict[str, str] | None = None
   |

DTZ007 Naive datetime constructed using `datetime.datetime.strptime()` without %z
   --> nixpkgs_review/cli/comments.py:165:12
    |
163 | def parse_time(string: str) -> datetime:
164 |     # Should we care about timezone here? %z
165 |     return datetime.strptime(string, "%Y-%m-%dT%H:%M:%SZ")  # ruff:ignore[call-datetime-strptime-without-zone]
    |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |
help: Call `.replace(tzinfo=<timezone>)` or `.astimezone()` to convert to an aware datetime

S310 Audit URL open for permitted schemes. Allowing use of `file:` or custom schemes is often unexpected.
   --> nixpkgs_review/github.py:114:15
    |
112 |               body = json.dumps(data).encode("ascii")
113 |
114 |           req = urllib.request.Request(  # ruff:ignore[suspicious-url-open-usage]
    |  _______________^
115 | |             url,
116 | |             headers=self.headers,
117 | |             method=method,
118 | |             data=body,
119 | |         )
    | |_________^
120 |           with http_requests.urlopen(req) as resp:
121 |               result: JSONType = json.loads(resp.read())
    |

S310 Audit URL open for permitted schemes. Allowing use of `file:` or custom schemes is often unexpected.
   --> nixpkgs_review/github.py:251:15
    |
249 |             raise RuntimeError(msg)
250 |
251 |         req = urllib.request.Request(new_url)  # ruff:ignore[suspicious-url-open-usage]
    |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
252 |         with (
253 |             http_requests.urlopen(req) as new_resp,
    |

S310 Audit URL open for permitted schemes. Allowing use of `file:` or custom schemes is often unexpected.
  --> nixpkgs_review/http_requests.py:32:33
   |
30 |             raise ValueError(msg)
31 |
32 |     return cast("HTTPResponse", urllib.request.urlopen(url, timeout=timeout))  # ruff:ignore[suspicious-url-open-usage]
   |                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   |

S108 Probable insecure usage of temporary file or directory: "/tmp"
   --> nixpkgs_review/nix.py:216:16
    |
214 |         *bind("/"),
215 |         *bind("/dev", dev=True),
216 |         *tmpfs("/tmp"),  # ruff:ignore[hardcoded-temp-file]
    |                ^^^^^^
217 |         # Required for evaluation
218 |         *bind(config.nixpkgs_config),
    |

S108 Probable insecure usage of temporary file or directory: "/tmp/.X11-unix"
   --> nixpkgs_review/nix.py:228:15
    |
226 |         *bind(nixpkgs_config_dir, try_=True),
227 |         # For X11 applications
228 |         *bind("/tmp/.X11-unix", try_=True),  # ruff:ignore[hardcoded-temp-file]
    |               ^^^^^^^^^^^^^^^^
229 |         *bind(xauthority, try_=True),
230 |         # GitHub
    |

SIM115 Use a context manager for opening files
   --> nixpkgs_review/nix.py:314:17
    |
312 |     build_config: BuildConfig,
313 | ) -> dict[System, list[Attr]]:
314 |     attr_json = NamedTemporaryFile(mode="w+", delete=False)  # ruff:ignore[open-file-with-context-handler]
    |                 ^^^^^^^^^^^^^^^^^^
315 |     delete = True
316 |     try:
    |

S314 Using `xml` to parse untrusted data is known to be vulnerable to XML attacks; use `defusedxml` equivalents
   --> nixpkgs_review/review.py:723:15
    |
721 |     current_pkg: Package | None = None
722 |
723 |     context = ET.iterparse(stdout, events=("start", "end"))  # ruff:ignore[suspicious-xml-element-tree-usage]
    |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
724 |     for event, elem in context:
725 |         if elem.tag == "item" and event == "start":
    |

S105 Possible hardcoded password assigned to: "GITHUB_TOKEN"
  --> tests/test_github_actions.py:19:38
   |
18 |         os.environ["PR"] = "1"
19 |         os.environ["GITHUB_TOKEN"] = "foo"  # ruff:ignore[hardcoded-password-string]
   |                                      ^^^^^
20 |         os.environ["NIXPKGS_REVIEW_ROOT"] = str(root)
21 |         mock_urlopen.side_effect = [mock_open(read_data="{}")()]
   |

S105 Possible hardcoded password assigned to: "GITHUB_TOKEN"
  --> tests/test_github_actions.py:32:38
   |
30 |         root = nixpkgs.path.parent
31 |         os.environ["PR"] = "1"
32 |         os.environ["GITHUB_TOKEN"] = "foo"  # ruff:ignore[hardcoded-password-string]
   |                                      ^^^^^
33 |         os.environ["NIXPKGS_REVIEW_ROOT"] = str(root)
34 |         mock_urlopen.side_effect = [
   |

S105 Possible hardcoded password assigned to: "GITHUB_TOKEN"
  --> tests/test_github_actions.py:50:38
   |
48 |     with helpers.save_environ():
49 |         os.environ["PR"] = "1"
50 |         os.environ["GITHUB_TOKEN"] = "foo"  # ruff:ignore[hardcoded-password-string]
   |                                      ^^^^^
51 |         mock_urlopen.side_effect = [mock_open(read_data="{}")()]
52 |         main("nixpkgs-review", ["approve"])
   |

Found 12 errors.

traversed 62 files
emitted 46 files for processing
formatted 13 files (0 changed) in 112ms
Error: failed to finalise formatting: formatting failures detected