Enhanced pre-commit and CI security checks | Generated by AI

Home 2026.05

All hooks installed and passing. Here’s a summary of everything added:

== CHANGES ==

  1. .pre-commit-config.yaml — added 4 new hooks:
    • check-ast — catch syntax errors before commit
    • check-added-large-files — block files >500KB (model weights, logs)
    • bandit — security scan using pyproject.toml config
    • detect-secrets — credential leak prevention
  2. pyproject.toml — added [tool.bandit] section:
    • excludes ww/ml/ and tests/
    • skips false positives: B113 (timeout), B602/B605 (subprocess shell), B301/B314 (pickle/xml), B310 (urllib), B108 (tmp), B104 (bind all), B307 (eval)
    • still catches real issues: B608 (SQL injection), B614 (unsafe pickle), B615 (unpinned HF downloads)
  3. .github/workflows/lint.yml — NEW workflow with 4 parallel jobs:
    • ruff — lint + format check
    • pyright — type checking
    • bandit — security scan
    • pip-audit — dependency CVE scanning
  4. .github/workflows/unit_test.yml — updated:
    • coverage –fail-under=60 (was no threshold)
  5. .secrets.baseline — NEW file:
    • 11 files baselined (test fixtures, config files)
    • excludes .env, .venv, ww/ml/

== WHAT BANDIT STILL CATCHES (7 real issues) == B608: 4x SQL injection in ww/photo/ module B615: 3x unpinned HF downloads in ww/embedding/ and ww/mmlu/

These are in niche modules, won’t block daily work. Fix when ready.

Generated by AI. Curating and sharing still takes effort. If you find it useful, feel free to donate. WeChat: @lzwjavaWeChat QR · X: @lzwjava · Say hi 👋

Back Donate