mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
984831bcab
* fix: add explicit bool filters for Ansible 12 jinja2_native compatibility Ansible 12 enables jinja2_native by default, which means string values like "true"/"false" are no longer automatically coerced to booleans in when: conditions and Jinja2 if statements. Add | bool filters to all boolean variable references in tasks, templates, and handlers. Also reformats long single-line Jinja2 conditionals into multi-line for readability, fixes GCE default() calls for native mode, adds help command to the algo script, and updates test fixtures to register the bool filter. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add j2lint for Jinja2 template linting Add j2lint (aristanetworks/j2lint) to catch syntax errors, spacing issues, and operator formatting in Jinja2 templates. Integrated into pre-commit hooks, lint.yml CI, and smart-tests.yml. Rules S3/S5/S6/S7/V1 are ignored — they enforce conventions incompatible with Ansible's config-file-embedded templates. Also fixes int+1 → int + 1 operator spacing in server.conf.j2. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: resolve all ansible-lint warnings and enforce zero-tolerance policy Fix 18 jinja[spacing] errors across 12 files by moving Jinja2 block delimiters to prevent YAML >- folding from introducing trailing spaces. Fix 27 key-order[task] warnings across 17 files by reordering task keys to canonical order (name → when → tags → environment → become → block). Promote key-order[task] and yaml[line-length] from warn_list to hard errors by removing warn_list entirely from .ansible-lint. Add zero-tolerance warning policy to CLAUDE.md explaining why warnings are unacceptable in a security tool and documenting resolution order. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
140 lines
4.1 KiB
TOML
140 lines
4.1 KiB
TOML
[build-system]
|
|
requires = ["setuptools>=68.0.0"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[project]
|
|
name = "algo"
|
|
description = "Set up a personal IPSEC VPN in the cloud"
|
|
version = "2.0.0-beta"
|
|
requires-python = ">=3.11"
|
|
dependencies = [
|
|
"ansible==12.3.0",
|
|
"jinja2>=3.1.6",
|
|
"netaddr==1.3.0",
|
|
"pyyaml>=6.0.2",
|
|
"segno>=1.6.0",
|
|
]
|
|
|
|
[tool.setuptools]
|
|
# Explicitly disable package discovery since Algo is not a Python package
|
|
py-modules = []
|
|
|
|
[project.optional-dependencies]
|
|
# Cloud provider dependencies (installed automatically based on provider selection)
|
|
aws = [
|
|
"boto3>=1.34.0",
|
|
]
|
|
azure = [
|
|
"azure-identity>=1.15.0",
|
|
"azure-mgmt-compute>=30.0.0",
|
|
"azure-mgmt-network>=25.0.0",
|
|
"azure-mgmt-resource>=23.0.0",
|
|
"msrestazure>=0.6.4",
|
|
]
|
|
gcp = [
|
|
"google-auth>=2.28.0",
|
|
"requests>=2.31.0",
|
|
]
|
|
hetzner = [
|
|
"hcloud>=1.33.0",
|
|
]
|
|
linode = [
|
|
"linode-api4>=5.15.0",
|
|
]
|
|
openstack = [
|
|
"openstacksdk>=2.1.0",
|
|
]
|
|
cloudstack = [
|
|
"cs>=3.0.0",
|
|
]
|
|
|
|
[tool.ruff]
|
|
# Ruff configuration
|
|
target-version = "py311"
|
|
line-length = 120
|
|
|
|
[tool.ruff.lint]
|
|
select = [
|
|
"E", # pycodestyle errors
|
|
"W", # pycodestyle warnings
|
|
"F", # pyflakes
|
|
"I", # isort
|
|
"B", # flake8-bugbear
|
|
"C4", # flake8-comprehensions
|
|
"UP", # pyupgrade
|
|
"S", # flake8-bandit (security)
|
|
"SIM", # flake8-simplify
|
|
"RUF", # Ruff-specific rules
|
|
"ERA", # commented-out code detection
|
|
"PTH", # pathlib recommendations
|
|
]
|
|
ignore = [
|
|
"E501", # line too long (handled by formatter)
|
|
"B011", # assert False is acceptable in test code
|
|
"S101", # assert is acceptable in test code
|
|
"S110", # try-except-pass - used intentionally for optional checks
|
|
"S112", # try-except-continue - used intentionally for skipping files
|
|
"S603", # subprocess calls - needed for Ansible modules
|
|
"S607", # partial path - needed for Ansible modules
|
|
"S701", # jinja2 autoescape - templates are for config files, not HTML
|
|
"S602", # shell=True in subprocess - needed for test mocks
|
|
"SIM102", # nested if - sometimes clearer than combined conditions
|
|
"SIM108", # ternary - sometimes if/else is more readable
|
|
"ERA001", # commented code - some comments explain regex patterns
|
|
"RUF005", # iterable unpacking - concatenation is clearer in some cases
|
|
"PTH100", # pathlib - existing code uses os.path
|
|
"PTH108", # pathlib - existing code uses os.unlink
|
|
"PTH110", # pathlib - existing code uses os.path.exists
|
|
"PTH118", # pathlib - existing code uses os.path.join
|
|
"PTH119", # pathlib - existing code uses os.path.basename
|
|
"PTH120", # pathlib - existing code uses os.path.dirname
|
|
"PTH123", # pathlib - existing code uses open()
|
|
"PTH201", # pathlib - existing code uses Path(".")
|
|
"PTH207", # pathlib - existing code uses glob
|
|
]
|
|
|
|
[tool.ruff.lint.per-file-ignores]
|
|
"library/*" = ["ALL"] # Exclude Ansible library modules (external code)
|
|
"tests/*" = ["S101"] # Allow assert in tests
|
|
|
|
[tool.ty.environment]
|
|
# Type checking configuration
|
|
python-version = "3.11"
|
|
|
|
[tool.ty.src]
|
|
# Exclude Ansible library modules and tests (test code has looser typing)
|
|
exclude = ["library/**", "tests/**"]
|
|
|
|
[tool.ty.rules]
|
|
# Ignore import warnings - ty doesn't see the venv when run via uv --with
|
|
# These are checked by Python's import system at runtime
|
|
unresolved-import = "ignore"
|
|
unknown-argument = "warn"
|
|
|
|
[tool.uv]
|
|
# Centralized uv version management
|
|
dev-dependencies = [
|
|
"pytest>=8.0.0",
|
|
"pytest-xdist>=3.0.0", # Parallel test execution
|
|
"ruff>=0.8.0", # Python linter and formatter
|
|
"yamllint>=1.35.0", # YAML linter
|
|
"ansible-lint>=24.0.0", # Ansible linter
|
|
"j2lint>=1.2.0", # Jinja2 template linter
|
|
]
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
python_files = ["test_*.py"]
|
|
python_classes = ["Test*"]
|
|
python_functions = ["test_*"]
|
|
addopts = [
|
|
"-v", # Verbose output
|
|
"--strict-markers", # Strict marker validation
|
|
"--strict-config", # Strict config validation
|
|
"--tb=short", # Short traceback format
|
|
]
|
|
markers = [
|
|
"slow: marks tests as slow (deselect with '-m \"not slow\"')",
|
|
"integration: marks tests as integration tests",
|
|
]
|