diff --git a/.claude/rules/copier-template.md b/.claude/rules/copier-template.md index 61277e6..05e41f2 100644 --- a/.claude/rules/copier-template.md +++ b/.claude/rules/copier-template.md @@ -60,6 +60,14 @@ reason above it. Neither escape ruff suggests is available, since keyword-only arguments answer `PLR0917` but not `PLR0913`, and folding the arguments into one object breaks the one-argument-per-option mapping the framework relies on. +`ARG002` is settled on the same grounds, one argument further in: a method the +framework calls has the signature the framework declares, so an argument the +implementation does not need cannot be dropped - a workflow task with no input +ports never reads `inputs`. Suppress it on the argument, again with the reason +above it. Renaming it to `_inputs` silences ruff as well, and is wrong here: +the name belongs to an API the caller may use by keyword, as this project's own +tests do. + ## Every user visible change gets a changelog entry `CHANGELOG.md` follows [Keep a Changelog](https://keepachangelog.com/). Add an diff --git a/.claude/skills/plugin-implementation/SKILL.md b/.claude/skills/plugin-implementation/SKILL.md index 7897ada..3903efa 100644 --- a/.claude/skills/plugin-implementation/SKILL.md +++ b/.claude/skills/plugin-implementation/SKILL.md @@ -350,6 +350,33 @@ start failing on it without anything in the task changing. Suppress it on the constructor only - it stays a real finding on an ordinary function, which is why it is not in the `ignore` list in `pyproject.toml`. +## An argument the task never reads + +`ARG002` complains about an unused method argument, and a task declaring +`FixedNumberOfInputs([])` generates its own entities - so `execute()` never +reads `inputs`, while `WorkflowPlugin` decides the signature all the same. A +`TransformPlugin` or a `PluginAction` ignoring an argument the framework +supplies is the same case. + +This is the standing exception the lint rules describe, so it needs no fresh +decision either. Suppress the code on the argument, with the reason above it: + +```python +def execute( + self, + # This task has no input ports, so it never reads inputs - but the + # signature is the one WorkflowPlugin declares. + inputs: Sequence[Entities], # noqa: ARG002 + context: ExecutionContext, +) -> Entities: +``` + +Do not rename it to `_inputs` instead. Ruff accepts the underscore and mypy +permits the rename, but the name is part of the API the caller uses: +`execute(inputs=(), context=TestExecutionContext())` is a keyword call, which is +how `tests/test_example.py` and the `plugin-testing` skill invoke a task, and it +raises `TypeError` against a renamed argument. + ## Parameters that carry secrets A password, token or API key is typed, never a plain string: diff --git a/.copier-answers.yml b/.copier-answers.yml index 84462f8..f27d2bb 100644 --- a/.copier-answers.yml +++ b/.copier-answers.yml @@ -1,5 +1,5 @@ # Changes here will be overwritten by Copier -_commit: v9.9.0 +_commit: v9.10.0 _src_path: gh:eccenca/cmem-plugin-template author_mail: cmempy-developer@eccenca.com author_name: eccenca GmbH diff --git a/Taskfile.yaml b/Taskfile.yaml index aade49a..1c75d8c 100644 --- a/Taskfile.yaml +++ b/Taskfile.yaml @@ -164,10 +164,14 @@ tasks: deps: - prepare cmds: + # .claude/ is skipped because a git worktree created there is a second + # checkout inside the repository, whose lock file is scanned as if it + # were this one - on an older branch, with older findings. - > poetry run trivy fs --include-dev-deps --scanners vuln + --skip-dirs .claude --skip-files .poetry/plugins/poetry.lock --exit-code 1 . @@ -177,7 +181,12 @@ tasks: deps: - prepare cmds: - - poetry run deptry . + # deptry's default excludes cover a tests directory at the root but not + # a nested copy of one, so the worktree described above would be read as + # source and its test imports reported. + - > + poetry run deptry . + --extend-exclude '\.claude' check:ruff: desc: Complain about everything else diff --git a/poetry.lock b/poetry.lock index 3812748..7356d93 100644 --- a/poetry.lock +++ b/poetry.lock @@ -2328,14 +2328,14 @@ six = ">=1.13.0" [[package]] name = "trivy-py-ecc" -version = "0.73.0.1" +version = "0.76.0.1" description = "Python wrapper around invoking trivy (https://trivy.dev/)" optional = false python-versions = ">=3.9" groups = ["dev"] files = [ - {file = "trivy_py_ecc-0.73.0.1-py2.py3-none-manylinux2014_x86_64.whl", hash = "sha256:93e4bbd0ff677fbbfa5b58123714e2a96279da5a281826685b17927a7f75e7d5"}, - {file = "trivy_py_ecc-0.73.0.1.tar.gz", hash = "sha256:550ed85b5f7ca0230cfe0a73ad79f7acf894df8a436968c22beeff2a6ae604af"}, + {file = "trivy_py_ecc-0.76.0.1-py2.py3-none-manylinux2014_x86_64.whl", hash = "sha256:9b426f382743a37d74c693ba0dbccc01b8941cb55a69922fff2d0f1d436ad931"}, + {file = "trivy_py_ecc-0.76.0.1.tar.gz", hash = "sha256:9385d46a4a3865106aee8a64964c64b5f95cf0dff1e4e30d993fc1c50cf34a89"}, ] [[package]] @@ -2512,4 +2512,4 @@ files = [ [metadata] lock-version = "2.1" python-versions = "^3.13" -content-hash = "8cfbacf4fd274ac1e2b1f161ef76e6657f957da9706ddeb310d725b056f24cc2" +content-hash = "e105e35634199b045219312bcf9b05555db4a1bb2e0ddced9b599dc5b598c917" diff --git a/pyproject.toml b/pyproject.toml index 5d2664a..be2726d 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -41,7 +41,7 @@ pytest-dotenv = "^0.5.2" pytest-html = "^4.2.0" pytest-memray = { version = "^1.10.0", markers = "platform_system != 'Windows'" } ruff = "^0.16.2" -trivy-py-ecc = "^0.73.0.1" +trivy-py-ecc = "^0.76.0.1" [build-system] requires = ["poetry-core>=1.0.0", "poetry-dynamic-versioning"]