Enforce ruff in CI + precommit, bound complexity, and clear lint baseline

[lelia]

Ruff already ran in CI, but as a job inside the Unit Tests workflow, so it inherited that workflow's paths: filter and never saw .hooks/, benchmarks/, or tests/e2e/. This moves it to its own unconditional Lint workflow, adds a pre-commit hook, bounds function complexity, and clears every resulting violation so the baseline is clean rather than suppressed.

ruff check and ruff format --check are both green across all 94 files. 523 tests pass.

Enforcement

• Lint workflow, unconditional on every PR. Not path-filtered: a filtered workflow reports "not run" rather than "passed", which blocks any PR that doesn't touch the filtered paths if it's made a required check.
• Pre-commit hook running ruff out of the project environment rather than the astral-sh/ruff-pre-commit mirror. Dependabot has no pre-commit ecosystem and will never update a mirror's rev:, so a mirror would drift from the pinned ruff==0.16.4 and produce the worst hook failure mode — clean locally, red on the PR.
• make lint now mirrors CI exactly.

Complexity

C901 at max 12, PLR0913 at max 8.

PLR0912 and PLR0915 were evaluated and rejected on evidence: PLR0912 duplicates C901 on 18 of 22 hits, and PLR0915's only unique catch is create_argument_parser — 116 statements but perfectly flat. max-args = 8 sits at the real gap in this codebase: everything is ≤7 arguments except run_reachability_analysis at 27.

The 20 functions over the limit today carry an explicit # noqa rather than a blanket per-file-ignores, so new complex functions in the same files are still caught. RUF100 fails the build once a suppression goes stale, so the backlog can only shrink — it already fired once during this work, when a refactor dropped _build_reachability_index under the limit. The worst remaining is main_code at complexity 109 / 424 statements.

Bugs fixed

These are behaviour changes, not style:

• Package.created_at was truncating timestamps. str.strip(" (Coordinated Universal Time)") treats its argument as a set of characters, not a suffix. "Tue Jan 15 ..." lost its leading T, and any timestamp without that suffix lost a trailing T. Now uses removesuffix.
• Notification calls could hang indefinitely. Slack, Teams, Jira, generic webhook and GitLab commit-status requests were sent with no timeout. requests blocks forever by default, so an unresponsive endpoint could hold a run open until the CI job itself timed out. All now pass an explicit 30s timeout. The existing GitLab tests caught this as a signature change and were updated.
• Two guards did nothing under python -O. assert is stripped in optimised mode. One was a real check on the org slug and now raises; the other was dead weight and was removed.
• A debug print was writing to stdout, which also carries SARIF. Now log.debug.
• config.py logged through the root logger, so its messages ignored the CLI's configured level and format. Now uses the socketcli logger like the rest of the package.
• Closures defined inside loops in alert_selection.py and messages.py captured loop variables by reference. Not live bugs — they were called within the same iteration — but they were hoisted and now take their inputs explicitly.

Formatting

ruff format is enforced from this PR onward. The formatting pass is bundled into the same commit as the lint fixes because they touch the same lines and can't be cleanly separated after the fact, so .git-blame-ignore-revs is added with instructions but no SHA — blame-ignoring this commit would also hide the real fixes above.

---

CodeQL: py/incomplete-url-substring-sanitization — fixed

CodeQL flagged "github.com" in diff_url at messages.py:80. The alert pre-exists on main; it surfaced here because the formatter touched that line.

Digging in turned up something more useful than a sanitization gap. diff_url is always a Socket dashboard link, built in Core as https://socket.dev/dashboard/org/{org_slug}/diff/.... Its host is always socket.dev and it carries no SCM information — which is exactly what the comment three lines below the check already said. The only variable part is the org slug, so the sniff could only fire when a Socket org slug contained "github", "gitlab" or "bitbucket". Those orgs got a link to a repository host they may not use; everyone else fell through to the Socket file view.

The branch was also nearly unreachable: CliConfig declares scm with a default of "api", so hasattr(config, "scm") is true for every real config and the elif never runs. It was observable only for a config carrying repo but no scm — with config=None the sniffed value was computed and then discarded, since every URL builder also requires a truthy config.

Now scm_type = (getattr(config, "scm", None) or "api").lower(), which covers a missing config, a config without the attribute, and an empty value.

get_manifest_file_url had no test coverage. Added 18 cases: GitHub, GitHub Enterprise, GitLab, self-hosted GitLab, Bitbucket, the Socket fallback, build-agent prefix stripping and multi-manifest paths. The three org-slug cases are regression guards — I verified they fail against the old implementation rather than assuming they would.

Removing the dead branch dropped the function under the complexity limit, so RUF100 required its # noqa: C901 be deleted. Complexity backlog: 20 → 19.

TODO: four judgment calls still to confirm

⚠️ NOTE: DO NOT MERGE until each of these items have been addressed.

The baseline is clean partly because four rule families are deliberately not enforced. Each was decided against actual call sites, but these are policy choices that should be signed off rather than inherited:

• TRY400 (35 sites) — would rewrite except APIFailure as e: log.error(...) to log.exception(), dumping tracebacks into customer CI logs for expected conditions like a missing config file. Rejected as making error reporting worse. Confirm, or accept the noisier logs.
• E501 + W291/W293 — left to ruff format, which owns line length (120) and whitespace. Everything the formatter can't reflow is a string literal, and the PR-comment markup relies on trailing double-spaces as Markdown hard line breaks. Confirm, or take on ~43 hand-wrapped strings.
• N (naming) — N815 wanted to rename the camelCase fields that mirror Socket API JSON keys (supplyChain, topLevelAncestors, manifestFiles), and N818 wanted to rename APIFailure / APIResourceNotFound, which this repo's own CI smoke test imports. Both would be breaking. Confirm.
• SIM108 / PERF401 / S603 / S607 — listed under ignore with reasons in pyproject.toml. SIM108 would delete an explanatory comment; PERF401 would push multi-line dict literals into generator expressions; S603/S607 fire on every subprocess call and this CLI shells out to git and the coana binary by design. Confirm.

Public Changelog

N/A

Ref: CE-451

---

Note

Medium Risk
Touches CI required checks, broad lint/format churn, and several CLI/runtime paths (HTTP notifications, config exit/logging, package timestamps) that affect customer pipelines.

Overview
Release 2.7.2 ships alongside a full Ruff enforcement story: linting moves out of the path-filtered Unit Tests workflow into a dedicated, unconditional Lint workflow (ruff check + ruff format --check), with matching pre-commit hooks and make lint / make hooks targets. pyproject.toml expands the rule set (bugbear, bandit, complexity C901/PLR0913, RUF100, etc.), documents intentional ignores, and clears the baseline across the repo.

Runtime fixes (not just style): Package.created_at now uses removesuffix instead of strip so timestamps are not mangled; outbound Slack/Teams/Jira/webhook/GitLab calls get a 30s requests timeout so CI cannot hang forever; config.py logs via the socketcli logger and sys.exit; duplicate SBOM packages log at debug instead of stdout; and guards that relied on assert are replaced or removed so python -O still behaves correctly.

Docs (CONTRIBUTING.md, CHANGELOG.md) and .git-blame-ignore-revs (placeholder for future format-only SHAs) support the new workflow.

^{Reviewed by Cursor Bugbot for commit ea36905. Configure here.}