Skip to content

fix(lint): ruff linting issues - #929

Open
AtomicFS wants to merge 3 commits into
mainfrom
fix/linting
Open

fix(lint): ruff linting issues#929
AtomicFS wants to merge 3 commits into
mainfrom
fix/linting

Conversation

@AtomicFS

@AtomicFS AtomicFS commented Aug 14, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

@AtomicFS
AtomicFS requested a review from MDr164 as a code owner August 14, 2026 13:17
@AtomicFS
AtomicFS enabled auto-merge August 14, 2026 13:18
@github-actions github-actions Bot added testing Testing related bugfix Bugfix / fix python Pull requests that update Python code labels Aug 14, 2026
@github-actions

github-actions Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Max errors Warnings Elapsed time
✅ ACTION actionlint 15 0 0 0.59s
⚠️ ACTION zizmor 15 341 0 16.61s
✅ BASH bash-exec 9 0 0 0.03s
✅ BASH shellcheck 8 0 0 0.1s
✅ BASH shfmt 8 0 0 0.0s
✅ DOCKERFILE hadolint 5 0 0 0.23s
✅ EDITORCONFIG editorconfig-checker 230 0 0 0.13s
✅ GO revive 31 0 0 36.14s
✅ JSON jsonlint 14 0 0 0.92s
✅ JSON prettier 14 0 0 4.71s
✅ JSON v8r 14 0 0 7.85s
✅ MARKDOWN markdownlint 32 0 0 3.13s
✅ PYTHON black 21 0 0 2.19s
✅ PYTHON flake8 21 0 0 1.93s
✅ PYTHON isort 21 0 0 0.91s
✅ PYTHON mypy 21 0 0 10.63s
✅ PYTHON pylint 21 0 0 13.09s
✅ PYTHON pyright 21 0 0 2.05s
✅ PYTHON ruff 21 0 0 0.04s
✅ REPOSITORY betterleaks yes no no 2.46s
✅ REPOSITORY checkov yes no no 33.05s
✅ REPOSITORY git_diff yes no no 0.06s
✅ REPOSITORY grype yes no no 112.92s
❌ REPOSITORY osv-scanner yes 1 no 24.15s
✅ REPOSITORY secretlint yes no no 2.63s
✅ REPOSITORY syft yes no no 22.09s
✅ REPOSITORY trivy yes no no 20.7s
✅ REPOSITORY trivy-sbom yes no no 2.38s
❌ REPOSITORY trufflehog yes 1 no 6.33s
✅ SPELL cspell 230 0 0 5.01s
✅ YAML prettier 36 0 0 9.32s
✅ YAML v8r 36 0 0 17.86s
✅ YAML yamllint 36 0 0 8.49s

Detailed Issues

❌ REPOSITORY / osv-scanner - 1 error 
Scanning dir .
Starting filesystem walk for root: /
Scanned cmd/firmware-action/go.mod file and found 59 packages
Scanned .dagger-ci/daggerci/requirements.txt file and found 9 packages
End status: 57 dirs visited, 287 inodes visited, 2 Extract calls, 6.335527ms elapsed, 6.335707ms wall time
Loaded filter from: .dagger-ci/daggerci/osv-scanner.toml
Loaded filter from: cmd/firmware-action/osv-scanner.toml
PYSEC-2026-215 and 2 aliases have been filtered out because: idna / indirect dependency, this is also python tool to build containers, not critical
PYSEC-2018-28 and 2 aliases have been filtered out because: requests / indirect dependency, this is also python tool to build containers, not critical
PYSEC-2023-74 and 2 aliases have been filtered out because: requests / indirect dependency, this is also python tool to build containers, not critical
PYSEC-2026-1872 and 2 aliases have been filtered out because: requests / indirect dependency, this is also python tool to build containers, not critical
PYSEC-2026-1873 and 2 aliases have been filtered out because: requests / indirect dependency, this is also python tool to build containers, not critical
PYSEC-2026-2275 and 2 aliases have been filtered out because: requests / indirect dependency, this is also python tool to build containers, not critical
GO-2026-5932 has been filtered out because: Indirect dependency, and we do not use any crypto
Filtered 13 vulnerabilities from output

Total 1 package affected by 4 known vulnerabilities (0 Critical, 0 High, 0 Medium, 0 Low, 4 Unknown) from 1 ecosystem.
4 vulnerabilities can be fixed.

+------------------------------+------+-----------+---------+---------+---------------+----------------------------+
| OSV URL                      | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE                     |
+------------------------------+------+-----------+---------+---------+---------------+----------------------------+
| https://osv.dev/GO-2026-5026 |      | Go        | stdlib  | 1.26.5  | 1.26.6        | cmd/firmware-action/go.mod |
| https://osv.dev/GO-2026-5972 |      | Go        | stdlib  | 1.26.5  | 1.26.6        | cmd/firmware-action/go.mod |
| https://osv.dev/GO-2026-6090 |      | Go        | stdlib  | 1.26.5  | 1.26.6        | cmd/firmware-action/go.mod |
| https://osv.dev/GO-2026-6218 |      | Go        | stdlib  | 1.26.5  | 1.26.6        | cmd/firmware-action/go.mod |
+------------------------------+------+-----------+---------+---------+---------------+----------------------------+
❌ REPOSITORY / trufflehog - 1 error 
🐷🔑🐷  TruffleHog. Unearth your secrets. 🐷🔑🐷

2026-08-14T14:57:32Z	info-0	trufflehog	running source	{"source_manager_worker_id": "hqczX", "with_units": true}
✅ Found verified result 🐷🔑
Detector Type: Lob
Decoder Type: PLAIN
Raw result: test__orchestrator__run_test_script_fail
Environment: test
File: .dagger-ci/daggerci/tests/test_orchestrator.py
Line: 71
Analyze: Run `trufflehog analyze` to analyze this key's permissions

2026-08-14T14:57:34Z	info-0	trufflehog	finished scanning	{"chunks": 244, "bytes": 812125, "verified_secrets": 1, "unverified_secrets": 0, "scan_duration": "2.108586163s", "trufflehog_version": "3.96.0", "verification_caching": {"Hits":0,"Misses":13,"HitsWasted":0,"AttemptsSaved":0,"VerificationTimeSpentMS":18300}}
⚠️ ACTION / zizmor - 341 errors 
it documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:70:15
   |
70 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:72:15
   |
72 |         uses: actions/setup-go@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:77:15
   |
77 |         uses: golangci/golangci-lint-action@v9
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:86:15
   |
86 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:88:15
   |
88 |         uses: goreleaser/goreleaser-action@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> .github/workflows/lint.yml:54:9
   |
 5 | / on:
 6 | |   pull_request: {}
 7 | |   pull_request_review:
 8 | |     types: ['submitted']
...  |
11 | |     branches: ['main']
12 | |     tags: ['v*']
   | |________________- generally used when publishing artifacts generated at runtime
...
54 |         - uses: actions/setup-go@v7
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/pytest.yml:41:9
   |
41 |         - name: Checkout
   |  _________^
42 | |         uses: actions/checkout@v7
43 | |         with:
44 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/pytest.yml:65:9
   |
65 |         - name: Checkout
   |  _________^
66 | |         uses: actions/checkout@v7
   | |_________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:27:15
   |
27 |         uses: re-actors/alls-green@release/v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:42:15
   |
42 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:45:15
   |
45 |       - uses: dorny/paths-filter@v4
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:60:15
   |
60 |         uses: arduino/setup-task@v3
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:62:15
   |
62 |         uses: actions/setup-python@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:66:15
   |
66 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release-prepare.yml:19:9
   |
19 |         - name: Checkout
   |  _________^
20 | |         uses: actions/checkout@v7
21 | |         with:
22 | |           fetch-depth: 0
...  |
25 | |       # Automatically determinate the next release version from Conventional Commits since the latest tag
   | |_________________________________________________________________________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

info[template-injection]: code injection via template expansion
  --> .github/workflows/release-prepare.yml:37:59
   |
36 |         run: |
   |         --- this run block
37 |           sed -i -E "s/default: 'v[0-9\.]+'/default: '${{ steps.semver.outputs.next }}'/g" action.yml
   |                                                           ^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:20:15
   |
20 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:28:15
   |
28 |         uses: ietf-tools/semver-action@v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:50:15
   |
50 |         uses: peter-evans/create-pull-request@v8
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release.yml:28:9
   |
28 |         - name: Checkout code
   |  _________^
29 | |         uses: actions/checkout@v7
30 | |         with:
31 | |           fetch-depth: 0
32 | |           fetch-tags: true
   | |__________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release.yml:87:9
   |
87 |         - name: Checkout code
   |  _________^
88 | |         uses: actions/checkout@v7
89 | |         with:
90 | |           fetch-depth: 0
91 | |           fetch-tags: true
   | |__________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

info[template-injection]: code injection via template expansion
  --> .github/workflows/release.yml:52:28
   |
51 |         run: |
   |         --- this run block
52 |           NEXT_VERSION=${{ steps.get_version.outputs.version }}
   |                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

info[template-injection]: code injection via template expansion
   --> .github/workflows/release.yml:108:27
    |
 99 |         uses: actions/github-script@v9
    |         ------------------------------ action accepts arbitrary code
...
102 |           script: |
    |           ------ via this input
...
108 |                 ref: "${{ steps.get_version.outputs.version }}",
    |                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → Low
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:29:15
   |
29 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:34:15
   |
34 |         uses: actions/setup-go@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:60:15
   |
60 |         uses: goreleaser/goreleaser-action@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:88:15
   |
88 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:99:15
   |
99 |         uses: actions/github-script@v9
   |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> .github/workflows/release.yml:34:9
   |
34 |         uses: actions/setup-go@v7
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
...
60 |         uses: goreleaser/goreleaser-action@v7
   |         ------------------------------------- runtime artifacts usually published here
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

341 findings (121 suppressed, 1 safe fixes, 158 unsafe fixes): 62 informational, 36 low, 4 medium, 118 high

(Truncated to last 13333 characters out of 108025)

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: MARKDOWN_MARKDOWN_LINK_CHECK, REPOSITORY_KICS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@10.0.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,DOCKERFILE_HADOLINT,EDITORCONFIG_EDITORCONFIG_CHECKER,GO_REVIVE,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_CSPELL,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

@AtomicFS
fix(lint): ruff linting issues
36474bc 
AI-Generated: true
AI-Model: claude-opus-4.8
Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>
@AtomicFS
chore(taskfile): add ruff linting and formatting
4014373 
Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>
@github-actions github-actions Bot added the documentation Improvements or additions to documentation label Aug 14, 2026
@AtomicFS
fix(lint): mdbook preprocessor
017e30f 
Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@MDr164 MDr164 Awaiting requested review from MDr164 MDr164 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

bugfix Bugfix / fix documentation Improvements or additions to documentation python Pull requests that update Python code testing Testing related

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@AtomicFS