cleveragents/cleveragents-core
4
0
Fork 3
Code Issues 6.0k Pull Requests 115 Actions Packages Projects Releases Wiki Activity

refactor: changes requested by Rui

Browse Source 
Removed `run-semgrep.sh` and automatically run setup-dev.sh
This commit is contained in:
Brent Edwards
2026-02-11 00:59:58 +00:00
parent 395df78b94
commit 7caac2714e
4 changed files with 8492 additions and 7913 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.devcontainer/post-create.sh
Executable
+11
View File
@@ -0,0 +1,11 @@
#!/usr/bin/env bash
# Post-create hook for the VS Code Dev Container.
# Called automatically by devcontainer.json after the container is created.
# Delegates to the shared developer-setup script so that the logic lives in
# one place.
set -euo pipefail
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
exec bash "$REPO_ROOT/scripts/setup-dev.sh"
docs/development/quality-automation.md
+47 -40
View File
@@ -31,24 +31,24 @@ Pre-commit hooks run automatically on every `git commit`. They are configured in
### Installed Hooks
| Hook | Tool | Purpose | Auto-fix |
|------|------|---------|----------|
| `no-commit-to-branch` | pre-commit-hooks | Prevents commits to `main` | No |
| `check-yaml` | pre-commit-hooks | Validates YAML syntax | No |
| `check-toml` | pre-commit-hooks | Validates TOML syntax | No |
| `check-json` | pre-commit-hooks | Validates JSON syntax | No |
| `check-merge-conflict` | pre-commit-hooks | Detects merge conflict markers | No |
| `check-added-large-files` | pre-commit-hooks | Prevents files >500KB | No |
| `end-of-file-fixer` | pre-commit-hooks | Ensures files end with newline | Yes |
| `trailing-whitespace` | pre-commit-hooks | Removes trailing whitespace | Yes |
| `debug-statements` | pre-commit-hooks | Detects `pdb`/`breakpoint` | No |
| `ruff-format` | ruff | Code formatting | Yes |
| `ruff` | ruff | Linting with safe auto-fixes | Yes |
| `bandit` | bandit | Security scanning | No |
| `vulture` | vulture | Dead code detection | No |
| `pyright` | pyright | Type checking (src/ only) | No |
| `semgrep-eval-exec` | semgrep | eval/exec detection (optional) | No |
| `commitizen` | commitizen | Commit message format (commit-msg stage) | No |
| Hook | Tool | Purpose | Auto-fix |
| ------------------------- | ---------------- | ---------------------------------------- | -------- |
| `no-commit-to-branch` | pre-commit-hooks | Prevents commits to `main` | No |
| `check-yaml` | pre-commit-hooks | Validates YAML syntax | No |
| `check-toml` | pre-commit-hooks | Validates TOML syntax | No |
| `check-json` | pre-commit-hooks | Validates JSON syntax | No |
| `check-merge-conflict` | pre-commit-hooks | Detects merge conflict markers | No |
| `check-added-large-files` | pre-commit-hooks | Prevents files >500KB | No |
| `end-of-file-fixer` | pre-commit-hooks | Ensures files end with newline | Yes |
| `trailing-whitespace` | pre-commit-hooks | Removes trailing whitespace | Yes |
| `debug-statements` | pre-commit-hooks | Detects `pdb`/`breakpoint` | No |
| `ruff-format` | ruff | Code formatting | Yes |
| `ruff` | ruff | Linting with safe auto-fixes | Yes |
| `bandit` | bandit | Security scanning | No |
| `vulture` | vulture | Dead code detection | No |
| `pyright` | pyright | Type checking (src/ only) | No |
| `semgrep-eval-exec` | semgrep | eval/exec detection (optional) | No |
| `commitizen` | commitizen | Commit message format (commit-msg stage) | No |
### Running Hooks Manually
@@ -71,21 +71,21 @@ The CI pipeline runs on **Forgejo Actions** (`.forgejo/workflows/ci.yml`).
### CI Jobs
| Job | Trigger | Purpose | Failure Impact |
|-----|---------|---------|----------------|
| `lint` | Push/PR | Ruff format + lint check | Blocks merge |
| `typecheck` | Push/PR | Pyright type checking | Blocks merge |
| `security` | Push/PR | Bandit + Vulture | Blocks merge |
| `quality` | Push/PR | Radon complexity check | Blocks merge (grade F) |
| `behave` | Push/PR | BDD tests (Python 3.11-3.13 matrix) | Blocks merge |
| `coverage` | Push/PR | Coverage measurement | Blocks merge (<85%) |
| `build` | Push/PR | Wheel build | Blocks release |
| `docker` | Push/PR | Docker image build + test | Blocks deployment |
| `helm` | Push/PR | Helm chart lint + template | Blocks deployment |
| Job | Trigger | Purpose | Failure Impact |
| ----------- | ------- | ----------------------------------- | ---------------------- |
| `lint` | Push/PR | Ruff format + lint check | Blocks merge |
| `typecheck` | Push/PR | Pyright type checking | Blocks merge |
| `security` | Push/PR | Bandit + Vulture | Blocks merge |
| `quality` | Push/PR | Radon complexity check | Blocks merge (grade F) |
| `behave` | Push/PR | BDD tests (Python 3.11-3.13 matrix) | Blocks merge |
| `coverage` | Push/PR | Coverage measurement | Blocks merge (<85%) |
| `build` | Push/PR | Wheel build | Blocks release |
| `docker` | Push/PR | Docker image build + test | Blocks deployment |
| `helm` | Push/PR | Helm chart lint + template | Blocks deployment |
### Nightly Quality
A nightly workflow (`.forgejo/workflows/nightly-quality.yml`) runs at midnight UTC:
A nightly workflow (`.forgejo/workflows/nightly-quality.yml`) runs on all branches at midnight UTC:
- Full lint, type check, security scan
- Complete Behave test suite with coverage
@@ -98,6 +98,7 @@ A nightly workflow (`.forgejo/workflows/nightly-quality.yml`) runs at midnight U
### Bandit Configuration
Configured in `pyproject.toml` under `[tool.bandit]`:
- Targets: `src/cleveragents` only
- Severity threshold: MEDIUM (pre-commit), HIGH (CI fail gate)
- Excludes: tests, features, build directories
@@ -105,6 +106,7 @@ Configured in `pyproject.toml` under `[tool.bandit]`:
### Semgrep Rules
Custom rules in `.semgrep.yml`:
- `no-eval`: Blocks `eval()` usage
- `no-exec`: Blocks `exec()` usage
- `no-compile-exec`: Blocks `compile()` with exec mode
@@ -120,6 +122,7 @@ Vulture checks `src/cleveragents/` for unused code with 80% confidence threshold
### False Positive Whitelist
Known false positives are listed in `vulture_whitelist.py`:
- `exc_tb`: Required by `__exit__` protocol but not used in body
- `build_data`: Required by mapping interface in legacy migrator
@@ -129,16 +132,14 @@ Add new entries when vulture flags intentionally unused code.
Radon measures cyclomatic complexity:
| Grade | Complexity | Status |
|-------|-----------|--------|
| A | 1-5 | Excellent |
| B | 6-10 | Good |
| C | 11-15 | Moderate - review recommended |
| D | 16-20 | Complex - refactoring recommended |
| E | 21-30 | Very complex - must refactor |
| F | 31+ | Extremely complex - CI fails |
Current project average: **A (3.56)**
| Grade | Complexity | Status |
| ----- | ---------- | --------------------------------- |
| A | 1-5 | Excellent |
| B | 6-10 | Good |
| C | 11-15 | Moderate - review recommended |
| D | 16-20 | Complex - refactoring recommended |
| E | 21-30 | Very complex - must refactor |
| F | 31+ | Extremely complex - CI fails |
## Quality Gate Script
@@ -149,6 +150,7 @@ python scripts/check-quality-gates.py --coverage-min 85 --complexity-max F
```
Gates checked:
1. Coverage >= 85%
2. Pyright: 0 type errors
3. Bandit: 0 high-severity security issues
@@ -158,20 +160,25 @@ Gates checked:
## Troubleshooting
### Pre-commit hooks not running
```bash
pre-commit install
pre-commit install --hook-type commit-msg
```
### Pyright errors on clean code
Check `pyrightconfig.json` for configuration. Pyright uses `strict` mode.
### Bandit false positive
If bandit flags intentionally safe code, consider if there's a safer alternative first.
Only as a last resort, add to `[tool.bandit]` `skips` in `pyproject.toml`.
### Vulture false positive
Add the symbol name to `vulture_whitelist.py` with a comment explaining why.
### Coverage below 85%
Run `nox -s coverage_report` to see which lines are uncovered, then add Behave scenarios.
implementation_plan.md
+8434 -7866
View File
File diff suppressed because it is too large Load Diff
scripts/run-semgrep.sh
-7
View File
@@ -1,7 +0,0 @@
#!/bin/sh
# Run semgrep if installed, skip gracefully if not
if command -v semgrep >/dev/null 2>&1; then
semgrep --config=.semgrep.yml --error --quiet src/
else
echo "semgrep not installed, skipping (install with: pip install semgrep)"
fi