pyproject.toml

[tool.ruff]
target-version = 'py39'

[tool.ruff.lint]
select = [
    'B',    # flake8-bugbear (potential bugs)
    'C4',   # flake8-comprehensions
    'E',    # pycodestyle errors
    'F',    # pyflakes (logic errors)
    'I',    # isort (import sorting)
    'RUF',  # Ruff-specific rules
    'SIM',  # flake8-simplify
    'UP',   # pyupgrade (modernize syntax for py39+)
    'W',    # pycodestyle warnings
]
ignore = [
    'E501',    # line too long (handled by code review, not auto-enforcement)
    'RUF002',  # ambiguous Unicode in docstrings (typographic quotes from docs)
    'RUF003',  # ambiguous Unicode in comments (en dashes in ASCII art)
    'SIM102',  # nested if statements (sometimes clearer than combined conditions)
    'SIM105',  # contextlib.suppress (try/except/pass is more explicit)
    'UP009',   # UTF-8 encoding declaration (we keep our standard file header)
    'UP015',   # redundant open() mode (we keep explicit modes for clarity)
]

[tool.ruff.lint.per-file-ignores]
# example plugin: unused imports/vars are intentional (skeleton demonstrating patterns)
'check-plugins/example/example' = ['F401', 'F841', 'RUF059', 'SIM102']
# metabase-stats: known broken, tracked in issue #1069 (rewrite needed)
'check-plugins/metabase-stats/metabase-stats' = ['F821', 'B006']

[tool.ruff.format]
quote-style = 'single'
docstring-code-format = true

[tool.bandit]
# B110 (try/except/pass) and B112 (try/except/continue): intentional patterns in
# monitoring plugins for graceful degradation - cleanup errors must not crash a
# check, and loops must continue past one broken item.
# B311 (pseudo-random): monitoring plugins use `random` for non-cryptographic
# purposes only (transaction IDs, random MACs for DHCP tests, test data).
skips = ['B110', 'B112', 'B311']