Skip to content

feat(PDRIVE-687): add mypy-based pre-commit hook for SafeCmdString ty… #123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hoberger-rh wants to merge 1 commit into
base: main
Choose a base branch
from
+27 −0
Open

feat(PDRIVE-687): add mypy-based pre-commit hook for SafeCmdString ty… #123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,13 @@ repos:
types: [python]
files: ^src/in_cluster_checks/

- id: safecmdstring-mypy-check
name: check SafeCmdString types with mypy
entry: mypy
language: system
types: [python]
files: ^src/in_cluster_checks/

- id: pytest-coverage
name: pytest with coverage
entry: python -m pytest
Expand Down
19 changes: 19 additions & 0 deletions mypy.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
[mypy]
python_version = 3.12
check_untyped_defs = True
show_error_codes = True

# Only report SafeCmdString type errors
disable_error_code = assignment,var-annotated,no-untyped-def,return-value,import-untyped,no-any-return,attr-defined
Comment on lines +6 to +7

@coderabbitai coderabbitai Bot Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- mypy.ini ---\n'
cat -n mypy.ini

printf '\n--- SafeCmdString references ---\n'
rg -n "SafeCmdString|run_rsh_cmd|SafeCmd" -S .

printf '\n--- candidate files containing run_rsh_cmd or SafeCmdString ---\n'
python3 - <<'PY'
import os
matches = []
for root, dirs, files in os.walk('.'):
    if '.git' in dirs:
        dirs.remove('.git')
    for f in files:
        if f.endswith(('.py', '.pyi', '.ini', '.toml', '.md', '.yaml', '.yml')):
            path = os.path.join(root, f)
            try:
                with open(path, 'r', encoding='utf-8', errors='ignore') as fh:
                    txt = fh.read()
                if 'SafeCmdString' in txt or 'run_rsh_cmd' in txt:
                    matches.append(path)
            except Exception:
                pass
print('\n'.join(sorted(set(matches))))
PY

Repository: RedHatInsights/incluster-checks

Length of output: 260

🌐 Web query:

mypy error code assignment return-value disable suppress incompatible assignment return type documentation

💡 Result:

To suppress or disable specific mypy error codes, such as those related to assignment or return values, you can use inline comments or configuration file settings [1][2]. To suppress errors on a specific line, append an inline comment with the relevant error code in brackets [3]: # type: ignore[assignment] # type: ignore[return-value] Using specific codes is recommended over a bare # type: ignore, as it prevents you from accidentally silencing other, unrelated errors on the same line [4][3]. To identify the exact error code being triggered, you can enable them in your output by setting show_error_codes = True in your mypy configuration file (mypy.ini or pyproject.toml) [4]. If you wish to disable an error code for an entire file, you can place a special comment at the top of the file [1][5]: # mypy: disable-error-code="assignment, return-value" You can also manage error codes globally or per-module via your configuration file [1][2]: [mypy] disable_error_code = assignment, return-value [mypy-my_module.*] disable_error_code = assignment For reference, common error codes include: - [assignment]: Used for incompatible types in assignment [6]. - [return-value]: Used when a function returns a value incompatible with its return type annotation [6]. - [method-assign]: A subcode of [assignment] that triggers when an assignment target is a method [6]. If an error code is a subcode of a broader category, ignoring the broader code (e.g., [assignment]) will typically suppress the narrower subcode as well [1][3].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- mypy.ini ---'
cat -n mypy.ini

echo
echo '--- SafeCmdString / run_rsh_cmd references ---'
rg -n "SafeCmdString|run_rsh_cmd|disable_error_code|show_error_codes" -S . || true

echo
echo '--- likely source files containing SafeCmdString ---'
python3 - <<'PY'
import os
paths=[]
for root, dirs, files in os.walk('.'):
    if '.git' in dirs:
        dirs.remove('.git')
    for fn in files:
        if fn.endswith(('.py','.pyi','.md','.ini','.toml','.yaml','.yml')):
            p=os.path.join(root,fn)
            try:
                txt=open(p,'r',encoding='utf-8',errors='ignore').read()
            except Exception:
                continue
            if 'SafeCmdString' in txt or 'run_rsh_cmd' in txt:
                paths.append(p)
for p in sorted(set(paths)):
    print(p)
PY

Repository: RedHatInsights/incluster-checks

Length of output: 50387

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- src/in_cluster_checks/utils/safe_cmd_string.py ---'
wc -l src/in_cluster_checks/utils/safe_cmd_string.py
cat -n src/in_cluster_checks/utils/safe_cmd_string.py | sed -n '1,260p'

echo
echo '--- src/in_cluster_checks/utils/oc_api_utils.py (run_rsh_cmd area) ---'
cat -n src/in_cluster_checks/utils/oc_api_utils.py | sed -n '460,520p'

echo
echo '--- any mypy plugin / strict config references ---'
rg -n "plugin|plugins|SafeCmdString|disable_error_code|assignment|return-value" mypy.ini pyproject.toml setup.cfg tox.ini .pre-commit-config.yaml src tests -S | sed -n '1,220p'

Repository: RedHatInsights/incluster-checks

Length of output: 46068

Keep assignment and return-value enabled for SafeCmdString
These global suppressions also hide plain str flowing through SafeCmdString-annotated assignments and returns. Narrow the suppression instead of disabling those codes project-wide.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@mypy.ini` around lines 6 - 7, Update the mypy configuration’s
disable_error_code list to stop suppressing assignment and return-value errors
globally, while retaining the other existing suppressions. Keep assignment and
return-value diagnostics enabled so SafeCmdString type violations remain
visible.


# Ignore third-party modules without stubs
ignore_missing_imports = True

# Files to check
files = src/in_cluster_checks/

[mypy-openshift_client.*]
ignore_missing_imports = True

[mypy-dateutil.*]
ignore_missing_imports = True
1 change: 1 addition & 0 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ dev = [
"black>=24.1.1",
"flake8>=7.0.0",
"isort>=5.13.2",
"mypy>=1.0.0",
]

[project.scripts]
Expand Down
Loading