use ruff, start remediating ruff errors

.github/scripts/urlshortener/test_update_urls.py

@@ -46,22 +46,22 @@ def test_handler(mock_put_item: Mock):
         call(
             table=table,
             id_val="runway/latest/linux",
-            target="https://test-bucket.s3-us-west-2.amazonaws.com/" "runway/1.0.0/linux/runway",
+            target="https://test-bucket.s3-us-west-2.amazonaws.com/runway/1.0.0/linux/runway",
         ),
         call(
             table=table,
             id_val="runway/1.0.0/linux",
-            target="https://test-bucket.s3-us-west-2.amazonaws.com/" "runway/1.0.0/linux/runway",
+            target="https://test-bucket.s3-us-west-2.amazonaws.com/runway/1.0.0/linux/runway",
         ),
         call(
             table=table,
             id_val="runway/latest/osx",
-            target="https://test-bucket.s3-us-west-2.amazonaws.com/" "runway/1.0.0/osx/runway",
+            target="https://test-bucket.s3-us-west-2.amazonaws.com/runway/1.0.0/osx/runway",
         ),
         call(
             table=table,
             id_val="runway/1.0.0/osx",
-            target="https://test-bucket.s3-us-west-2.amazonaws.com/" "runway/1.0.0/osx/runway",
+            target="https://test-bucket.s3-us-west-2.amazonaws.com/runway/1.0.0/osx/runway",
         ),
         call(
             table=table,
@@ -82,14 +82,14 @@ def test_handler(mock_put_item: Mock):
         call(
             table=table,
             id_val="runway/1.1.0/linux",
-            target="https://test-bucket.s3-us-east-1.amazonaws.com/" "runway/1.1.0/linux/runway",
+            target="https://test-bucket.s3-us-east-1.amazonaws.com/runway/1.1.0/linux/runway",
         )
     )
     calls.append(
         call(
             table=table,
             id_val="runway/1.1.0/osx",
-            target="https://test-bucket.s3-us-east-1.amazonaws.com/" "runway/1.1.0/osx/runway",
+            target="https://test-bucket.s3-us-east-1.amazonaws.com/runway/1.1.0/osx/runway",
         )
     )
     calls.append(

.github/scripts/urlshortener/update_urls.py

@@ -119,7 +119,7 @@ def handler(
     "table_name",
     metavar="<table>",
     required=True,
-    help="Name of the DynamoDB table containing entries for the URL " "shortener.",
+    help="Name of the DynamoDB table containing entries for the URL shortener.",
 )
 @click.option(
     "--version",

Makefile

@@ -30,14 +30,14 @@ build-pyinstaller-folder: clean create-tfenv-ver-file version ## build Pyinstall
 	bash ./.github/scripts/cicd/build_pyinstaller.sh folder
 
 clean: ## remove generated file from the project directory
-	rm -rf build/
-	rm -rf dist/
-	rm -rf runway.egg-info/
-	rm -rf tmp/
-	rm -rf src/
-	rm -rf postinstall.js preuninstall.js .coverage .npmignore
-	find . -name ".runway" -type d -prune -exec rm -rf '{}' +
-	@make -C docs clean
+	rm -rf ./build/ ./dist/ ./src/ ./tmp/ ./runway.egg-info/;
+	rm -rf ./.pytest_cache ./.venv;
+	find . -type d -name ".venv" -prune -exec rm -rf '{}' +;
+	find . -type d -name "node_modules" -prune -exec rm -rf '{}' +;
+	find . -type d -name ".runway" -prune -exec rm -rf '{}' +;
+	find . -type f -name "*.py[co]" -delete;
+	find . -type d -name "__pycache__" -prune -exec rm -rf '{}' +;
+	@$(MAKE) --no-print-directory -C docs clean;
 
 cov-report: ## display a report in the terminal of files missing coverage
 	@poetry run coverage report \
@@ -59,15 +59,26 @@ create-tfenv-ver-file: ## create a tfenv version file using the latest version
 	curl --silent https://releases.hashicorp.com/index.json | jq -r '.terraform.versions | to_entries | map(select(.key | contains ("-") | not)) | sort_by(.key | split(".") | map(tonumber))[-1].key' | egrep -o '^[0-9]*\.[0-9]*\.[0-9]*' > runway/templates/terraform/.terraform-version
 
 docs: ## delete current HTML docs & build fresh HTML docs
-	@make -C docs docs
+	@$(MAKE) --no-print-directory -C docs docs
 
 docs-changes: ## build HTML docs; only builds changes detected by Sphinx
-	@make -C docs html
+	@$(MAKE) --no-print-directory -C docs html
+
+fix: fix-ruff fix-black run-pre-commit ## run all automatic fixes
 
 fix-black: ## automatically fix all black errors
 	@poetry run black .
 
-lint: lint-black lint-pyright ## run all linters
+fix-imports: ## automatically fix all import sorting errors
+	@poetry run ruff check . --fix-only --fixable I001
+
+fix-ruff: ## automatically fix everything ruff can fix (implies fix-imports)
+	@poetry run ruff check . --fix-only
+
+fix-ruff-tests:
+	@poetry run ruff check ./tests --fix-only --unsafe-fixes
+
+lint: lint-black lint-ruff lint-pyright ## run all linters
 
 lint-black: ## run black
 	@echo "Running black... If this fails, run 'make fix-black' to resolve."
@@ -79,6 +90,11 @@ lint-pyright: ## run pyright
 	@npm run-script py-type-check
 	@echo ""
 
+lint-ruff: ## run ruff
+	@echo "Running ruff... If this fails, run 'make fix-ruff' to resolve some error automatically, other require manual action."
+	@poetry run ruff check .
+	@echo ""
+
 npm-ci: ## run "npm ci" with the option to ignore scripts - required to succeed for this project
 	@npm ci --ignore-scripts
 

infrastructure/blueprints/prevent_privilege_escalation.py

@@ -152,10 +152,8 @@ def statement_deny_onica_sso(self) -> Statement:
             Action=[Action("*")],
             Effect=Deny,
             Resource=[
-                Sub("arn:${AWS::Partition}:cloudformation:*:${AWS::AccountId}:stack/" "onica-sso"),
-                Sub(
-                    "arn:${AWS::Partition}:cloudformation:*:${AWS::AccountId}:stack/" "onica-sso-*"
-                ),
+                Sub("arn:${AWS::Partition}:cloudformation:*:${AWS::AccountId}:stack/onica-sso"),
+                Sub("arn:${AWS::Partition}:cloudformation:*:${AWS::AccountId}:stack/onica-sso-*"),
                 Sub("arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/onica-sso"),
                 Sub("arn:${AWS::Partition}:iam::${AWS::AccountId}:policy/onica-sso-*"),
                 Sub("arn:${AWS::Partition}:iam::${AWS::AccountId}:role/onica-sso"),

pyproject.toml

@@ -33,7 +33,6 @@ repository = "https://github.com/onicagroup/runway"
 [tool.poetry.dependencies]
 python = ">=3.9, <3.13"
 awacs = "*"
-"backports.cached_property" = {python = "<3.8", version = "*"}
 boto3 = "^1.16"
 cfn-lint = "*"
 cfn_flip = "^1.2"  # only used in runway._cli.commands._gen_sample.utils
@@ -43,7 +42,6 @@ docker = ">=3.0.0"  # used in runway.cfngin.hooks
 formic2 = "*"  # only used in runway.cfngin.hooks.aws_lambda
 gitpython = "*"
 igittigitt = ">=2.0.5"
-importlib-metadata = {python = "<3.8", version = "*"}
 jinja2 = ">=2.7"  # used in runway.cfngin.blueprints.raw
 moto = "3.0.5"
 packaging = "*"  # component of setuptools needed for version compare
@@ -95,6 +93,7 @@ sphinxcontrib-programoutput = "^0.17"
 
 [tool.poetry.group.lint.dependencies]
 black = "^24.4.2"
+ruff = "^0.5.1"
 
 [tool.poetry.group.types.dependencies]
 mypy-boto3 = "^1.16"  # importable boto3 type annotations
@@ -230,6 +229,118 @@ python_files = ["test_*.py"]
 python_functions = ["test_*"]
 testpaths = ["tests"]
 
+[tool.ruff]  # https://docs.astral.sh/ruff/settings/#top-level
+extend-exclude = [
+  "runway/aws_sso_botocore",  # NOTE (kyle): ignoring vendored code
+  "runway/cfngin/hooks/staticsite/auth_at_edge/templates",  # TODO (kyle): resolve lint error
+  "typings",
+]
+force-exclude = true
+line-length = 120
+show-fixes = true
+target-version = "py39"  # important to set before applying fixes
+
+[tool.ruff.lint]  # https://docs.astral.sh/ruff/settings/#lint
+extend-safe-fixes = [
+  "UP007",
+  "UP038",
+  "UP040",
+]
+ignore = [
+  "ANN101",  # Missing type annotation for `self` in method
+  "ANN102",  # Missing type annotation for `cls` in classmethod
+  "ANN401",  # Dynamically typed expressions (typing.Any) are disallowed  # TODO (kyle): improve type annotations
+  "COM812",  # Trailing comma missing
+  "D203",  # 1 blank line required before class docstring
+  "D213",  # Multi-line docstring summary should start at the second line
+  "D215",  # Section underline is over-indented
+  "D403",  # First word of the first line should be capitalized
+  "D406",  # Section name should end with a newline
+  "D407",  # Missing dashed underline after section
+  "D408",  # Section underline should be in the line following the section's name
+  "D409",  # Section underline should match the length of its name
+  "DTZ",  # flake8-datetimez  # NOTE (kyle): this is fine here
+  "EM",  # flake8-errmsg
+  "ERA001",  # Found commented-out code  # NOTE (kyle): incorrectly detects cspell
+  "FA100",  # Missing `from __future__ import annotations`, but uses `typing.Optional`
+  "FBT001",  # Boolean positional arg in function definition
+  "FBT002",  # Boolean default value in function definition
+  "FBT003",  # Boolean positional value in function call
+  "FIX002",  # Line contains TODO
+  "N818",  # Exception name should be named with an Error suffix  # TODO (kyle): resolve in next major release
+  "PERF203",  # `try`-`except` within a loop incurs performance overhead
+  "PGH003",  # Use specific rule codes when ignoring type issues  # TODO (kyle): resolve this eventually
+  "RUF012",  # TODO (kyle): remove when resolved - https://github.com/astral-sh/ruff/issues/5243
+  "S105",  # (hardcoded-password-string) Possible hardcoded password
+  "S106",  # (hardcoded-password-func-arg) Possible hardcoded password
+  "S107",  # (hardcoded-password-default) Possible hardcoded password
+  "S108",  # Probable insecure usage of temporary file or directory
+  "S301",  # `pickle` and modules that wrap it can be unsafe when used to deserialize untrusted data
+  "S60",  # flake8-bandit   # NOTE (kyle): most of these are for subprocess which we don't care about right now
+  "S604",  # Function call with `shell=True` parameter identified   # NOTE (kyle): required for runway
+  "TD003",  # Missing issue link on the line following this TODO
+  "TID252",  # Relative imports from parent modules are banned
+  "TRY",  # tryceratops
+]
+select = ["ALL"]
+
+[tool.ruff.lint.extend-per-file-ignores]  # https://docs.astral.sh/ruff/settings/#lintextend-per-file-ignores
+"*.py" = [
+  "PYI024",  # Use `typing.NamedTuple` instead of `collections.namedtuple`  # NOTE (kyle): should only apply to pyi
+]
+"runway/templates/*" = [
+  "N999",  # Invalid module name  # NOTE (kyle): these are fine here
+]
+"tests/*" = [
+  "PT004",  # Fixture does not return anything, add leading underscore
+  "S101",  # Use of `assert` detected  # NOTE (kyle): this is fine here
+  "SLF001",  # Private member accessed  # NOTE (kyle): fine in tests
+]
+
+[tool.ruff.lint.flake8-annotations]  # https://docs.astral.sh/ruff/settings/#lintflake8-annotations
+allow-star-arg-any = true
+
+[tool.ruff.lint.flake8-pytest-style]  # https://docs.astral.sh/ruff/settings/#lintflake8-pytest-style
+parametrize-names-type = "csv"  # TODO (kyle): update tests to remove the need for this
+
+[tool.ruff.lint.flake8-self]
+ignore-names = [
+  "_Environ",
+  "_Hash",
+  "_session",
+]
+
+[tool.ruff.lint.flake8-type-checking]  # https://docs.astral.sh/ruff/settings/#lint_flake8-type-checking_runtime-evaluated-base-classes
+runtime-evaluated-base-classes = [
+  "pydantic.BaseModel",
+  "pydantic.BeforeValidator",
+  "runway.cfngin.hooks.base.HookArgsBaseModel",
+  "runway.config.models.base.ConfigProperty",
+  "runway.utils.BaseModel",
+]
+
+[tool.ruff.lint.isort]  # https://docs.astral.sh/ruff/settings/#lintisort
+known-local-folder = [
+  "jwks_rsa",
+  "shared",
+  "update_urls",
+]
+known-third-party = [
+  "docker",  # NOTE (kyle): the `docker/` directory confuses isort
+]
+
+[tool.ruff.lint.pydocstyle]  # https://docs.astral.sh/ruff/settings/#lintpydocstyle
+convention = "google"
+
+[tool.ruff.lint.pylint]  # https://docs.astral.sh/ruff/settings/#lintpylint
+allow-magic-value-types = ["bytes", "int", "str"]
+max-args = 15
+max-returns = 10
+max-statements = 50
+
+[tool.ruff.lint.pyupgrade]  # https://docs.astral.sh/ruff/settings/#pyupgrade-keep-runtime-typing
+keep-runtime-typing = true  # TODO (kyle): remove when dropping support for python 3.9
+
 [tool.tomlsort]
 all = true
 in_place = true

quickstarts/conduit/update_env_endpoint.py

@@ -22,9 +22,9 @@ def update_api_endpoint():
     stack = cloudformation.Stack(STACK_PREFIX + environment)
     endpoint = [i["OutputValue"] for i in stack.outputs if i["OutputKey"] == "ServiceEndpoint"][0]
 
-    with open(environment_file, "r") as stream:
+    with open(environment_file) as stream:
         content = stream.read()
-    content = re.sub(r"api_url: \'.*\'$", f"api_url: '{endpoint}/api'", content, flags=re.M)
+    content = re.sub(r"api_url: \'.*\'$", f"api_url: '{endpoint}/api'", content, flags=re.MULTILINE)
     with open(environment_file, "w") as stream:
         stream.write(content)
 

runway/__init__.py

@@ -1,18 +1,12 @@
 """Set package version."""
 
 import logging
-import sys
+from importlib.metadata import PackageNotFoundError, version  # type: ignore
 
-from ._logging import LogLevels, RunwayLogger
+from ._logging import LogLevels, RunwayLogger  # noqa: F401
 
 logging.setLoggerClass(RunwayLogger)
 
-if sys.version_info < (3, 8):
-    # importlib.metadata is standard lib for python>=3.8, use backport
-    from importlib_metadata import PackageNotFoundError, version  # type: ignore
-else:
-    from importlib.metadata import PackageNotFoundError, version  # type: ignore
-
 try:
     __version__ = version(__name__)
 except PackageNotFoundError:

runway/_cli/options.py

@@ -14,7 +14,7 @@
     "--debug",
     count=True,
     envvar="DEBUG",
-    help="Supply once to display Runway debug logs. " "Supply twice to display all debug logs.",
+    help="Supply once to display Runway debug logs. Supply twice to display all debug logs.",
 )
 
 deploy_environment = click.option(

runway/_cli/utils.py

@@ -5,8 +5,9 @@
 import logging
 import os
 import sys
+from collections.abc import Iterator
 from pathlib import Path
-from typing import Any, Iterator, List, Optional, Tuple
+from typing import Any, List, Optional, Tuple
 
 import click
 import yaml
@@ -104,7 +105,7 @@ def get_runway_context(
         Args:
             deploy_environment: Object representing the current deploy environment.
 
-        Returns
+        Returns:
             RunwayContext
 
         """
@@ -229,7 +230,7 @@ def select_modules(
         LOGGER.debug("only one module detected; no selection necessary")
         if ctx.command.name == "destroy":
             LOGGER.info(
-                "Only one module detected; all modules " "automatically selected for deletion."
+                "Only one module detected; all modules automatically selected for deletion."
             )
             if not click.confirm("Proceed?"):
                 ctx.exit(0)