(magpie) branch fix/code-scanning-notes created (now e24eb7af)

[ze...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

zeroshade pushed a change to branch fix/code-scanning-notes
in repository https://gitbox.apache.org/repos/asf/magpie.git


      at e24eb7af chore: address CodeQL notes in contributor-metrics, jira, reproducible-archive, vetted-ops

This branch includes the following new commits:

     new e24eb7af chore: address CodeQL notes in contributor-metrics, jira, reproducible-archive, vetted-ops

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(magpie) 01/01: chore: address CodeQL notes in contributor-metrics, jira, reproducible-archive, vetted-ops

[ze...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

zeroshade pushed a commit to branch fix/code-scanning-notes
in repository https://gitbox.apache.org/repos/asf/magpie.git

commit e24eb7af8c117302248399dd649fc3b33efd49fa
Author: Matt Topol <zo...@gmail.com>
AuthorDate: Tue Oct 13 08:06:04 2026 -0400

    chore: address CodeQL notes in contributor-metrics, jira, reproducible-archive, vetted-ops
    
    Resolves code-scanning alerts 66, 69, 100, 101 and 113 without behaviour
    changes:
    - tests import the module under test one way only (`from pkg import mod
      as alias`) instead of mixing `import pkg.mod` with `from pkg.mod import`;
    - test_symlink_mode_is_platform_independent builds both archives before
      asserting, so the assert has no call with side effects;
    - the repo-tree jq program in vetted-ops is parenthesised so its
      implicit string concatenation reads as intended, not a missing comma.
    
    Generated-by: Claude Code (Opus 5.5)
---
 tools/contributor-metrics/tests/test_fetch.py                 | 4 ++--
 tools/jira/tests/test_rest.py                                 | 2 +-
 tools/reproducible-archive/tests/test_reproducible_archive.py | 5 +++--
 tools/vetted-ops/src/vetted_ops/ops.py                        | 8 +++++---
 4 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/tools/contributor-metrics/tests/test_fetch.py b/tools/contributor-metrics/tests/test_fetch.py
index 0d2199c6..fda77e03 100644
--- a/tools/contributor-metrics/tests/test_fetch.py
+++ b/tools/contributor-metrics/tests/test_fetch.py
@@ -363,7 +363,7 @@ def test_thread_is_dated_by_the_candidates_own_comment_and_dropped_outside_the_w
 
 
 def test_rate_limit_is_retried_with_backoff(fake_gh, monkeypatch):
-    import contributor_metrics.fetch as f
+    from contributor_metrics import fetch as f
 
     sleeps = []
     monkeypatch.setattr(f.time, "sleep", lambda s: sleeps.append(s))
@@ -383,7 +383,7 @@ def test_rate_limit_is_retried_with_backoff(fake_gh, monkeypatch):
 
 
 def test_other_gh_errors_are_not_retried(fake_gh, monkeypatch):
-    import contributor_metrics.fetch as f
+    from contributor_metrics import fetch as f
 
     monkeypatch.setattr(f.time, "sleep", lambda s: (_ for _ in ()).throw(AssertionError("should not sleep")))
     monkeypatch.setattr(
diff --git a/tools/jira/tests/test_rest.py b/tools/jira/tests/test_rest.py
index 67ee7dfb..79f87db7 100644
--- a/tools/jira/tests/test_rest.py
+++ b/tools/jira/tests/test_rest.py
@@ -15,7 +15,7 @@ from http.server import BaseHTTPRequestHandler, HTTPServer
 
 import pytest
 
-import jira_bridge.rest as rest_mod
+from jira_bridge import rest as rest_mod
 from jira_bridge.rest import JiraRest, JiraRestConfigError, JiraRestError
 
 BASE = "https://issues.example.org/jira"
diff --git a/tools/reproducible-archive/tests/test_reproducible_archive.py b/tools/reproducible-archive/tests/test_reproducible_archive.py
index fbd73ec4..a7f7f8bd 100644
--- a/tools/reproducible-archive/tests/test_reproducible_archive.py
+++ b/tools/reproducible-archive/tests/test_reproducible_archive.py
@@ -194,9 +194,10 @@ def test_symlink_mode_is_platform_independent(fmt: str) -> None:
     macos = [*base, ra.Entry("p/link", "symlink", 0o755, linkname="target")]
     linux = [*base, ra.Entry("p/link", "symlink", 0o777, linkname="target")]
     write = ra.write_zip if fmt == "zip" else ra.write_tar_gz
-    assert write(macos, EPOCH) == write(linux, EPOCH)
+    macos_archive, linux_archive = write(macos, EPOCH), write(linux, EPOCH)
+    assert macos_archive == linux_archive
     assert ra.swhid_dir_of_entries(macos, "p") == ra.swhid_dir_of_entries(linux, "p")
-    packed = ra.read_zip_entries(write(macos, EPOCH)) if fmt == "zip" else ra.read_tar_entries(write(macos, EPOCH))
+    packed = ra.read_zip_entries(macos_archive) if fmt == "zip" else ra.read_tar_entries(macos_archive)
     assert [e.mode for e in packed if e.kind == "symlink"] == [0o777]
 
 
diff --git a/tools/vetted-ops/src/vetted_ops/ops.py b/tools/vetted-ops/src/vetted_ops/ops.py
index 1a13978e..e6539f9d 100644
--- a/tools/vetted-ops/src/vetted_ops/ops.py
+++ b/tools/vetted-ops/src/vetted_ops/ops.py
@@ -1870,9 +1870,11 @@ _register(
             # paths drops that flag, so a caller cannot tell a complete listing
             # from a partial one and reads the gap as "those paths do not
             # exist". Fail loudly instead of answering with half a tree.
-            'if .truncated then error("repo-tree: the GitHub API truncated '
-            "this tree; the listing is incomplete. Walk the tree level by "
-            'level instead of relying on recursive=1.") else .tree[].path end',
+            (
+                'if .truncated then error("repo-tree: the GitHub API truncated '
+                "this tree; the listing is incomplete. Walk the tree level by "
+                'level instead of relying on recursive=1.") else .tree[].path end'
+            ),
         ],
     )
 )