Antoine Van Elstraete
2f6184df0b
Sécurité : - ical_url : str → SecretStr | None (masquage dans str/repr/model_dump_json) - En-têtes Authorization/Proxy-Authorization : masquage complet de la valeur - _URL_PATTERN : insensible à la casse (HTTPS:// reconnu) - redact_url() : masquage du nom d'utilisateur (userinfo complet) Configuration : - Sous-configs : Field(default_factory=...) pour rechargement à chaque appel - Suppression du singleton settings (injection de dépendances) - .env.example : ajout AI_PROVIDER et CALDAV_CALENDAR_PATH - Guide : BLOG_RSS_ENABLED → BLOG_ENABLED, AI_MODEL=None par défaut - .secrets.baseline : ligne décalée 5112 → 5117 (faux positif audité) - pre-commit : ajout de pytest aux additional_dependencies du hook mypy Tests : 15 tests (config + redaction) couvrant rechargement, masquage SecretStr, en-têtes Authorization, URL auth intégrée et casse variable. Co-authored-by: opencode/coder <coder@agents.invalid> Co-authored-by: opencode/test-engineer <test-engineer@agents.invalid>
61 lines
1.7 KiB
YAML
61 lines
1.7 KiB
YAML
# Hooks pre-commit pour pronote-sync
|
|
# Installation : pre-commit install
|
|
# Exécution manuelle : pre-commit run --all-files
|
|
default_language_version:
|
|
python: python3
|
|
|
|
repos:
|
|
# Outils du venv (ruff, mypy, bandit) — exécutés dans l'environnement géré par pre-commit
|
|
- repo: local
|
|
hooks:
|
|
- id: ruff-check
|
|
name: ruff check
|
|
entry: ruff check
|
|
language: python
|
|
additional_dependencies: ["ruff>=0.4.0"]
|
|
types: [python]
|
|
|
|
- id: ruff-format
|
|
name: ruff format
|
|
entry: ruff format
|
|
language: python
|
|
additional_dependencies: ["ruff>=0.4.0"]
|
|
types: [python]
|
|
|
|
- id: mypy
|
|
name: mypy
|
|
entry: mypy
|
|
language: python
|
|
additional_dependencies: ["mypy>=1.10.0", "pydantic>=2.0.0", "pydantic-settings>=2.0.0", "pytest>=8.0.0"]
|
|
types: [python]
|
|
pass_filenames: true
|
|
|
|
- id: bandit
|
|
name: bandit
|
|
entry: bandit
|
|
args: [-c, pyproject.toml, -r]
|
|
language: python
|
|
additional_dependencies: ["bandit>=1.7.0"]
|
|
types: [python]
|
|
|
|
# Hooks standard de pre-commit
|
|
- repo: https://github.com/pre-commit/pre-commit-hooks
|
|
rev: v5.0.0
|
|
hooks:
|
|
- id: trailing-whitespace
|
|
exclude: 'GUIDE_DEV_PYTHON\.md'
|
|
- id: end-of-file-fixer
|
|
exclude: 'GUIDE_DEV_PYTHON\.md'
|
|
- id: check-yaml
|
|
- id: check-added-large-files
|
|
args: [--maxkb=500]
|
|
exclude: 'GUIDE_DEV_PYTHON\.md'
|
|
- id: check-merge-conflict
|
|
|
|
# Détection de secrets
|
|
- repo: https://github.com/Yelp/detect-secrets
|
|
rev: v1.5.0
|
|
hooks:
|
|
- id: detect-secrets
|
|
args: [--baseline, .secrets.baseline]
|