chore(tooling): improve linting, CI caching, and maintenance automation (#1892)

tetienne · web-flow · commit f729a5d76a38 · 2026-01-25T15:24:39.000+01:00
## Summary

Improves code quality tooling and CI efficiency.

**Code quality:**
- Enable additional ruff rules: ASYNC, S (security), T (print
detection), C4 (comprehensions)
- Add actionlint pre-commit hook to validate GitHub workflow files

**CI efficiency:**
- Add UV caching to lint and test workflows
- Fix shellcheck warnings in release workflow

**Maintenance:**
- Change dependabot from daily to weekly updates
- Remove unused tox dependency
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -3,14 +3,14 @@ updates:
   - package-ecosystem: "uv"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
       time: "08:00"
     open-pull-requests-limit: 10
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
       time: "08:00"
     open-pull-requests-limit: 10
 
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
@@ -20,6 +20,9 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-suffix: ${{ matrix.python-version }}
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -30,10 +30,10 @@ jobs:
       - name: Retrieve version from tag name
         id: retrieve-version
         run: |
-            tag=${{ github.event.release.tag_name }}
-            version_number=${tag#?}
-            echo version: $version_number
-            echo "version=$version_number" >> $GITHUB_OUTPUT
+            tag="${{ github.event.release.tag_name }}"
+            version_number="${tag#?}"
+            echo "version: $version_number"
+            echo "version=$version_number" >> "$GITHUB_OUTPUT"
 
       - name: Bump project version in pyproject.toml and commit changes to current branch and tag
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -20,6 +20,9 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-suffix: ${{ matrix.python-version }}
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -22,6 +22,10 @@ repos:
     -   id: no-commit-to-branch
         stages: [pre-commit]
         args: [--branch, main]
+-   repo: https://github.com/rhysd/actionlint
+    rev: v1.7.7
+    hooks:
+    -   id: actionlint
 -   repo: local
     hooks:
       - id: mypy
diff --git a/pyoverkiz/const.py b/pyoverkiz/const.py
@@ -17,7 +17,8 @@
 
 SOMFY_API = "https://accounts.somfy.com"
 SOMFY_CLIENT_ID = "0d8e920c-1478-11e7-a377-02dd59bd3041_1ewvaqmclfogo4kcsoo0c8k4kso884owg08sg8c40sk4go4ksg"
-SOMFY_CLIENT_SECRET = "12k73w1n540g8o4cokg0cw84cog840k84cwggscwg884004kgk"
+# OAuth client secrets are public by design (embedded in mobile apps)
+SOMFY_CLIENT_SECRET = "12k73w1n540g8o4cokg0cw84cog840k84cwggscwg884004kgk"  # noqa: S105
 
 LOCAL_API_PATH = "/enduser-mobile-web/1/enduserAPI/"
 
diff --git a/pyoverkiz/enums/command.py b/pyoverkiz/enums/command.py
@@ -1,5 +1,8 @@
 """Command-related enums and parameters used by device commands."""
 
+# ruff: noqa: S105
+# Enum values contain "PASS" in API names (e.g. PassAPC), not passwords
+
 import sys
 from enum import unique
 
diff --git a/pyoverkiz/enums/general.py b/pyoverkiz/enums/general.py
@@ -1,5 +1,8 @@
 """General-purpose enums like product types, data types and event names."""
 
+# ruff: noqa: S105
+# Enum values contain "TOKEN" in API event names, not passwords
+
 import logging
 import sys
 from enum import IntEnum, unique
diff --git a/pyoverkiz/enums/state.py b/pyoverkiz/enums/state.py
@@ -1,5 +1,8 @@
 """State and attribute enums describing Overkiz device states and attributes."""
 
+# ruff: noqa: S105
+# Enum values contain "PASS" or "TOKEN" in API names, not passwords
+
 import sys
 from enum import unique
 
diff --git a/pyoverkiz/enums/ui.py b/pyoverkiz/enums/ui.py
@@ -1,5 +1,8 @@
 """UI enums for classes and widgets used to interpret device UI metadata."""
 
+# ruff: noqa: S105
+# Enum values contain "PASS" in API names (e.g. PassAPC), not passwords
+
 import logging
 import sys
 from enum import unique
diff --git a/pyproject.toml b/pyproject.toml
@@ -29,7 +29,6 @@ repository = "https://github.com/iMicknl/python-overkiz-api"
 
 [dependency-groups]
 dev = [
-    "tox<5.0.0,>=4.17.1",
     "pytest>=8.3.2,<10.0.0",
     "pytest-cov>=5,<8",
     "pre-commit<5.0,>=3.8",
@@ -44,7 +43,7 @@ select = [
     # pydocstyle
     "D",
     # flake8-async
-    # "ASYNC",
+    "ASYNC",
     # pycodestyle
     "E",
     # Pyflakes
@@ -59,6 +58,12 @@ select = [
     "I",
     # ruff
     "RUF",
+    # flake8-bandit (security)
+    "S",
+    # flake8-print
+    "T",
+    # flake8-comprehensions
+    "C4",
 ]
 ignore = ["E501"] # Line too long
 
diff --git a/tests/test_client.py b/tests/test_client.py
@@ -1,5 +1,9 @@
 """Unit tests for the high-level OverkizClient behaviour and responses."""
 
+# ruff: noqa: S101, ASYNC230
+# S101: Tests use assert statements
+# ASYNC230: Blocking open() is acceptable for reading test fixtures
+
 from __future__ import annotations
 
 import json
diff --git a/tests/test_enums.py b/tests/test_enums.py
@@ -1,5 +1,8 @@
 """Tests for enum helper behaviour and expected values."""
 
+# ruff: noqa: S101
+# Tests use assert statements
+
 from pyoverkiz.enums import (
     EventName,
     ExecutionSubType,
diff --git a/tests/test_models.py b/tests/test_models.py
@@ -1,5 +1,8 @@
 """Unit tests for models (Device, State and States helpers)."""
 
+# ruff: noqa: S101
+# Tests use assert statements
+
 from __future__ import annotations
 
 import humps
diff --git a/tests/test_obfuscate.py b/tests/test_obfuscate.py
@@ -1,5 +1,8 @@
 """Tests for the obfuscation utilities used in fixtures and logging."""
 
+# ruff: noqa: S101
+# Tests use assert statements
+
 import pytest
 
 from pyoverkiz.obfuscate import obfuscate_email, obfuscate_sensitive_data
diff --git a/tests/test_utils.py b/tests/test_utils.py
@@ -1,5 +1,8 @@
 """Tests for utility helper functions like server generation and gateway checks."""
 
+# ruff: noqa: S101
+# Tests use assert statements
+
 import pytest
 
 from pyoverkiz.utils import generate_local_server, is_overkiz_gateway
diff --git a/utils/mask_fixtures.py b/utils/mask_fixtures.py
@@ -1,5 +1,8 @@
 """Simple helper script to mask sensitive fields in JSON fixtures."""
 
+# ruff: noqa: T201
+# Utility scripts can use print for CLI output
+
 from __future__ import annotations
 
 import glob
diff --git a/uv.lock b/uv.lock
