build: pin ruff lint rule set to pre-0.16 defaults

ruff 0.16.0 broadened the default rule set and reports 317 findings
across the tree (65 auto-fixable) on code that 0.15.1 accepted
cleanly. Explicitly select the previous defaults ("E4", "E7", "E9",
"F") so this dep bump is behaviour-neutral; enabling the new rules
belongs in its own cleanup, not bundled into the version bump (per
the project's dep-bump convention).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Justin Bollinger
2026-07-27 14:00:27 -04:00
co-authored by Claude Opus 4.7
parent 447849e2b3
commit fd28b3fcae
2 changed files with 7 additions and 1 deletions
+6
View File
@@ -50,6 +50,12 @@ exclude = [
"rules", "rules",
] ]
[tool.ruff.lint]
# Pin to the pre-0.16.0 default rule set so future ruff bumps stay
# behaviour-neutral. Broadening the ruleset is a separate cleanup, not
# a dep-bump side effect.
select = ["E4", "E7", "E9", "F"]
[tool.bandit] [tool.bandit]
# hate_crack shells out to hashcat and its helper binaries extensively, so the # hate_crack shells out to hashcat and its helper binaries extensively, so the
# scan produces many low-severity subprocess/shlex findings. These are reviewed # scan produces many low-severity subprocess/shlex findings. These are reviewed