chore: enable ruff security rules and update dependencies (CLIM-1536)

pyproject.toml

@@ -27,7 +27,7 @@ dependencies = [
   "geojson-pydantic>=2.1.1",
   "typer>=0.24.2",
   "jinja2>=3.1.6",
-  "servicekit>=3.0.1,<4",
+  "servicekit>=3.1.0,<4",
   "httpx>=0.28.1",
   "jsonschema>=4.26.0",
 ]
@@ -80,18 +80,22 @@ exclude = ["*.md"]
 
 [tool.ruff.lint]
 fixable = ["ALL"]
-select = ["E", "W", "F", "I", "D"]
+select = ["E", "W", "F", "I", "D", "S"]
 ignore = ["D203", "D213"]
 
 [tool.ruff.lint.pydocstyle]
 convention = "google"
 
 [tool.ruff.lint.per-file-ignores]
-"tests/**/*.py" = ["D"]
+# Tests assert, run subprocesses, unpickle their own fixtures and bind test servers; fine outside product code.
+"tests/**/*.py" = ["D", "S101", "S104", "S301", "S311", "S603", "S607"]
+"scripts/**/*.py" = ["S108", "S603", "S607"]
 "src/chapkit/alembic/**/*.py" = ["D"]
 "**/__init__.py" = ["D104"]
 "src/**/*.py" = ["D102", "D105", "D107"]
-"examples/**/*.py" = []
+"examples/**/*.py" = ["S104", "S311"]
+# Seeded synthetic test data, not cryptography.
+"src/chapkit/data/generator.py" = ["S311"]
 
 [tool.ruff.format]
 quote-style = "double"

src/chapkit/cli/artifact.py

@@ -277,9 +277,10 @@ def list_command(
     # Fetch artifacts
     if database is not None:
         success, error, artifacts = asyncio.run(_list_from_database(database))
-    else:
-        assert url is not None  # Guaranteed by mutual exclusivity check above
+    elif url is not None:
         success, error, artifacts = _list_from_url(url)
+    else:
+        raise typer.Exit(code=1)  # Unreachable: the mutual exclusivity check above requires one of them
 
     if not success:
         typer.echo(f"Error: {error}", err=True)
@@ -424,16 +425,15 @@ def download_command(
     # Fetch content
     if database is not None:
         success, error, content = asyncio.run(_fetch_from_database(database, ulid))
-    else:
-        assert url is not None  # Guaranteed by mutual exclusivity check above
+    elif url is not None:
         success, error, content = _fetch_from_url(url, ulid)
+    else:
+        raise typer.Exit(code=1)  # Unreachable: the mutual exclusivity check above requires one of them
 
-    if not success:
+    if not success or content is None:
         typer.echo(f"Error: {error}", err=True)
         raise typer.Exit(code=1)
 
-    assert content is not None  # Guaranteed by success=True
-
     # Save or extract
     if extract:
         success, message = _extract_zip_content(content, output_path)

src/chapkit/cli/cli.py

@@ -34,8 +34,8 @@ def _find_chapkit_project() -> Path | None:
                 deps = data.get("project", {}).get("dependencies", [])
                 if any("chapkit" in dep for dep in deps):
                     return parent
-            except Exception:
-                pass
+            except (OSError, tomllib.TOMLDecodeError):
+                continue
     return None
 
 

src/chapkit/cli/export.py

@@ -93,7 +93,7 @@ def load_service_module(path: Path) -> ModuleType:
         code = compile(path.read_text(encoding="utf-8"), str(path), "exec")
         # Whatever the module prints while it builds its app (startup logs) goes to stderr, keeping stdout ours.
         with _inside(path.parent), redirect_stdout(sys.stderr):
-            exec(code, module.__dict__)
+            exec(code, module.__dict__)  # noqa: S102 -- running the project's own main.py is what export does
     except Exception as error:
         raise MLProjectError(f"Importing {path} failed: {type(error).__name__}: {error}") from error
     finally:

src/chapkit/cli/test/command.py

@@ -156,7 +156,7 @@ def test_command(
     runner = TestRunner(url, timeout=timeout, verbose=verbose, debug=debug)
     # A negative seed means "fresh random data each run"; report the chosen seed so
     # a failing run can be reproduced with `--seed <value>`.
-    actual_seed = random.randrange(1, 2**31) if seed < 0 else seed
+    actual_seed = random.randrange(1, 2**31) if seed < 0 else seed  # noqa: S311 -- a data seed, not a secret
     if seed < 0:
         typer.echo(f"Using random seed {actual_seed} (re-run with --seed {actual_seed} to reproduce)")
         typer.echo()

src/chapkit/ml/manager.py

@@ -420,7 +420,7 @@ def _check_training_workspace(
             return diagnostics
 
         try:
-            pickle.loads(pickle_bytes)
+            pickle.loads(pickle_bytes)  # noqa: S301 -- the service's own training workspace
         except (
             pickle.UnpicklingError,
             EOFError,
@@ -617,7 +617,7 @@ async def _predict_task(self, request: PredictRequest, artifact_id: ULID) -> ULI
                     model_pickle_path = extracted_workspace / "model.pickle"
                     if model_pickle_path.exists():
                         try:
-                            trained_model = pickle.loads(model_pickle_path.read_bytes())
+                            trained_model = pickle.loads(model_pickle_path.read_bytes())  # noqa: S301 -- the service's own training workspace
                         except (pickle.UnpicklingError, EOFError, TypeError) as e:
                             raise ValueError(
                                 f"Failed to load model from {model_pickle_path}: "