ruff-shared.toml

# Canonical shared ruff configuration for offworldlabs Python repos.
#
# Consumers copy these keys into their own pyproject.toml and the `ruff-config`
# pre-commit hook checks they have not drifted. Copying rather than referencing
# is forced: ruff's `extend` accepts only a local path, so there is no way for
# one repo to point at another's config.
#
# target-version is deliberately absent. It tracks each package's
# requires-python and is legitimately per-repo, so the checker ignores it.

[tool.ruff]
line-length = 120

[tool.ruff.lint]
select = [
    "E",   # pycodestyle errors
    "W",   # pycodestyle warnings
    "F",   # pyflakes
    "I",   # isort
    "B",   # flake8-bugbear
    "UP",  # pyupgrade
    "S",   # flake8-bandit (security)
    "SIM", # flake8-simplify
]
ignore = [
    "E501",   # line too long — handled by formatter
    "E402",   # module-level import not at top — env setup before imports is intentional
    "S101",   # assert in tests is fine
    "S104",   # binding to 0.0.0.0 is intentional (Docker)
    "S105",   # hardcoded password false positives on dev defaults
    "S106",   # hardcoded password false positives
    "S110",   # try-except-pass is used intentionally
    "S112",   # try-except-continue is intentional in iteration
    "S310",   # URL open audit — URLs are constructed internally
    "S311",   # pseudo-random is fine for non-crypto uses
    "S501",   # requests without verify — internal calls
    "S603",   # subprocess calls are in controlled scripts
    "S607",   # partial executable path is fine for scripts
    "B008",   # function call in default arg — Depends() is FastAPI pattern
    "B905",   # zip strict — not needed everywhere
    "SIM102", # nested if — readability preference
    "SIM105", # contextlib.suppress — try/except is more explicit
    "SIM108", # ternary operator — readability preference
    "SIM117", # combine with statements — readability preference
    "UP017",  # datetime.UTC — cosmetic, timezone.utc is fine
    "UP028",  # yield from — explicit loop is clearer
]

[tool.ruff.lint.per-file-ignores]
"tests/*" = ["S", "B"]
"scripts/*" = ["S", "E"]