this derivation will be built: /nix/store/q2jknv7ns2n3lw73wlzkqz02w3swsxyk-treefmt-check.drv building '/nix/store/q2jknv7ns2n3lw73wlzkqz02w3swsxyk-treefmt-check.drv' treefmt-check> tribuchet: building on jamie treefmt-check> treefmt v2.5.0ERRO formatter | ruff-check: failed to apply with options '[check --fix]': exit status 1 treefmt-check> treefmt-check> warning: #ruff:ignore comment found but not active, enable preview mode treefmt-check> SIM115 Use a context manager for opening files treefmt-check> --> nixpkgs_review/buildenv.py:24:31 treefmt-check> | treefmt-check> 22 | raise RuntimeError(msg) treefmt-check> 23 | treefmt-check> 24 | self.nixpkgs_config = NamedTemporaryFile(suffix=".nix") # ruff:ignore[open-file-with-context-handler] treefmt-check> | ^^^^^^^^^^^^^^^^^^ treefmt-check> 25 | self.old_cwd: Path | None = None treefmt-check> 26 | self.environ: dict[str, str] | None = None treefmt-check> | treefmt-check> treefmt-check> DTZ007 Naive datetime constructed using `datetime.datetime.strptime()` without %z treefmt-check> --> nixpkgs_review/cli/comments.py:165:12 treefmt-check> | treefmt-check> 163 | def parse_time(string: str) -> datetime: treefmt-check> 164 | # Should we care about timezone here? %z treefmt-check> 165 | return datetime.strptime(string, "%Y-%m-%dT%H:%M:%SZ") # ruff:ignore[call-datetime-strptime-without-zone] treefmt-check> | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ treefmt-check> | treefmt-check> help: Call `.replace(tzinfo=)` or `.astimezone()` to convert to an aware datetime treefmt-check> treefmt-check> S310 Audit URL open for permitted schemes. Allowing use of `file:` or custom schemes is often unexpected. treefmt-check> --> nixpkgs_review/github.py:114:15 treefmt-check> | treefmt-check> 112 | body = json.dumps(data).encode("ascii") treefmt-check> 113 | treefmt-check> 114 | req = urllib.request.Request( # ruff:ignore[suspicious-url-open-usage] treefmt-check> | _______________^ treefmt-check> 115 | | url, treefmt-check> 116 | | headers=self.headers, treefmt-check> 117 | | method=method, treefmt-check> 118 | | data=body, treefmt-check> 119 | | ) treefmt-check> | |_________^ treefmt-check> 120 | with http_requests.urlopen(req) as resp: treefmt-check> 121 | result: JSONType = json.loads(resp.read()) treefmt-check> | treefmt-check> treefmt-check> S310 Audit URL open for permitted schemes. Allowing use of `file:` or custom schemes is often unexpected. treefmt-check> --> nixpkgs_review/github.py:251:15 treefmt-check> | treefmt-check> 249 | raise RuntimeError(msg) treefmt-check> 250 | treefmt-check> 251 | req = urllib.request.Request(new_url) # ruff:ignore[suspicious-url-open-usage] treefmt-check> | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ treefmt-check> 252 | with ( treefmt-check> 253 | http_requests.urlopen(req) as new_resp, treefmt-check> | treefmt-check> treefmt-check> S310 Audit URL open for permitted schemes. Allowing use of `file:` or custom schemes is often unexpected. treefmt-check> --> nixpkgs_review/http_requests.py:32:33 treefmt-check> | treefmt-check> 30 | raise ValueError(msg) treefmt-check> 31 | treefmt-check> 32 | return cast("HTTPResponse", urllib.request.urlopen(url, timeout=timeout)) # ruff:ignore[suspicious-url-open-usage] treefmt-check> | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ treefmt-check> | treefmt-check> treefmt-check> S108 Probable insecure usage of temporary file or directory: "/tmp" treefmt-check> --> nixpkgs_review/nix.py:216:16 treefmt-check> | treefmt-check> 214 | *bind("/"), treefmt-check> 215 | *bind("/dev", dev=True), treefmt-check> 216 | *tmpfs("/tmp"), # ruff:ignore[hardcoded-temp-file] treefmt-check> | ^^^^^^ treefmt-check> 217 | # Required for evaluation treefmt-check> 218 | *bind(config.nixpkgs_config), treefmt-check> | treefmt-check> treefmt-check> S108 Probable insecure usage of temporary file or directory: "/tmp/.X11-unix" treefmt-check> --> nixpkgs_review/nix.py:228:15 treefmt-check> | treefmt-check> 226 | *bind(nixpkgs_config_dir, try_=True), treefmt-check> 227 | # For X11 applications treefmt-check> 228 | *bind("/tmp/.X11-unix", try_=True), # ruff:ignore[hardcoded-temp-file] treefmt-check> | ^^^^^^^^^^^^^^^^ treefmt-check> 229 | *bind(xauthority, try_=True), treefmt-check> 230 | # GitHub treefmt-check> | treefmt-check> treefmt-check> SIM115 Use a context manager for opening files treefmt-check> --> nixpkgs_review/nix.py:314:17 treefmt-check> | treefmt-check> 312 | build_config: BuildConfig, treefmt-check> 313 | ) -> dict[System, list[Attr]]: treefmt-check> 314 | attr_json = NamedTemporaryFile(mode="w+", delete=False) # ruff:ignore[open-file-with-context-handler] treefmt-check> | ^^^^^^^^^^^^^^^^^^ treefmt-check> 315 | delete = True treefmt-check> 316 | try: treefmt-check> | treefmt-check> treefmt-check> S314 Using `xml` to parse untrusted data is known to be vulnerable to XML attacks; use `defusedxml` equivalents treefmt-check> --> nixpkgs_review/review.py:723:15 treefmt-check> | treefmt-check> 721 | current_pkg: Package | None = None treefmt-check> 722 | treefmt-check> 723 | context = ET.iterparse(stdout, events=("start", "end")) # ruff:ignore[suspicious-xml-element-tree-usage] treefmt-check> | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ treefmt-check> 724 | for event, elem in context: treefmt-check> 725 | if elem.tag == "item" and event == "start": treefmt-check> | treefmt-check> treefmt-check> S105 Possible hardcoded password assigned to: "GITHUB_TOKEN" treefmt-check> --> tests/test_github_actions.py:19:38 treefmt-check> | treefmt-check> 18 | os.environ["PR"] = "1" treefmt-check> 19 | os.environ["GITHUB_TOKEN"] = "foo" # ruff:ignore[hardcoded-password-string] treefmt-check> | ^^^^^ treefmt-check> 20 | os.environ["NIXPKGS_REVIEW_ROOT"] = str(root) treefmt-check> 21 | mock_urlopen.side_effect = [mock_open(read_data="{}")()] treefmt-check> | treefmt-check> treefmt-check> S105 Possible hardcoded password assigned to: "GITHUB_TOKEN" treefmt-check> --> tests/test_github_actions.py:32:38 treefmt-check> | treefmt-check> 30 | root = nixpkgs.path.parent treefmt-check> 31 | os.environ["PR"] = "1" treefmt-check> 32 | os.environ["GITHUB_TOKEN"] = "foo" # ruff:ignore[hardcoded-password-string] treefmt-check> | ^^^^^ treefmt-check> 33 | os.environ["NIXPKGS_REVIEW_ROOT"] = str(root) treefmt-check> 34 | mock_urlopen.side_effect = [ treefmt-check> | treefmt-check> treefmt-check> S105 Possible hardcoded password assigned to: "GITHUB_TOKEN" treefmt-check> --> tests/test_github_actions.py:50:38 treefmt-check> | treefmt-check> 48 | with helpers.save_environ(): treefmt-check> 49 | os.environ["PR"] = "1" treefmt-check> 50 | os.environ["GITHUB_TOKEN"] = "foo" # ruff:ignore[hardcoded-password-string] treefmt-check> | ^^^^^ treefmt-check> 51 | mock_urlopen.side_effect = [mock_open(read_data="{}")()] treefmt-check> 52 | main("nixpkgs-review", ["approve"]) treefmt-check> | treefmt-check> treefmt-check> Found 12 errors. treefmt-check> treefmt-check> traversed 62 files treefmt-check> emitted 46 files for processing treefmt-check> formatted 13 files (0 changed) in 150ms treefmt-check> Error: failed to finalise formatting: formatting failures detected error: Cannot build '/nix/store/q2jknv7ns2n3lw73wlzkqz02w3swsxyk-treefmt-check.drv'. Reason: builder failed with exit code 1. Output paths: /nix/store/svnzijrc94h8xi6dlriqsb2bql8s98ih-treefmt-check Last 25 log lines: > 30 | root = nixpkgs.path.parent > 31 | os.environ["PR"] = "1" > 32 | os.environ["GITHUB_TOKEN"] = "foo" # ruff:ignore[hardcoded-password-string] > | ^^^^^ > 33 | os.environ["NIXPKGS_REVIEW_ROOT"] = str(root) > 34 | mock_urlopen.side_effect = [ > | > > S105 Possible hardcoded password assigned to: "GITHUB_TOKEN" > --> tests/test_github_actions.py:50:38 > | > 48 | with helpers.save_environ(): > 49 | os.environ["PR"] = "1" > 50 | os.environ["GITHUB_TOKEN"] = "foo" # ruff:ignore[hardcoded-password-string] > | ^^^^^ > 51 | mock_urlopen.side_effect = [mock_open(read_data="{}")()] > 52 | main("nixpkgs-review", ["approve"]) > | > > Found 12 errors. > > traversed 62 files > emitted 46 files for processing > formatted 13 files (0 changed) in 150ms > Error: failed to finalise formatting: formatting failures detected For full logs, run: nix log /nix/store/q2jknv7ns2n3lw73wlzkqz02w3swsxyk-treefmt-check.drv