Second pass on Codacy PR #56 findings

- http_download: bundle stream knobs into _StreamContext dataclass so
  _stream_to_disk (10 args) and _run_stream (11 args) fit under the
  project-wide R0913 ceiling. Silence W1514 on the binary-mode open().
- scheduler/cron: make _expand_chunk's effective_high keyword-only so
  it stays under the five-positional-arg limit.
- fast_find: wrap the long nosec/nosemgrep comment to clear C0301.
- tests/test_secrets: split the NOSONAR justification above the line so
  the "password" literal doesn't blow the 100-col budget.

Author: JE-Chen

automation_file/remote/http_download.py

@@ -4,6 +4,7 @@
 
 import contextlib
 import os
+from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
 
@@ -32,6 +33,19 @@
 )
 
 
+@dataclass(frozen=True)
+class _StreamContext:
+    """Bundle of per-download stream knobs; avoids 10+ positional args."""
+
+    write_mode: str
+    chunk_size: int
+    start_byte: int
+    total_size: int
+    max_bytes: int
+    reporter: ProgressReporter | None
+    token: Any
+
+
 @retry_on_transient(max_attempts=3, backoff_base=0.5, retriable=_RETRIABLE_EXCEPTIONS)
 def _open_stream(
     file_url: str,
@@ -73,38 +87,31 @@ def _stream_to_disk(
     response: requests.Response,
     part_path: Path,
     target: Path,
-    *,
-    write_mode: str,
-    chunk_size: int,
-    start_byte: int,
-    total_size: int,
-    max_bytes: int,
-    reporter: ProgressReporter | None,
-    token: Any,
+    ctx: _StreamContext,
 ) -> int | None:
     """Stream ``response`` into ``part_path``. Returns bytes written, or None on failure."""
-    written = start_byte
+    written = ctx.start_byte
     with (
-        open(part_path, write_mode) as output,
-        _progress(total_size, str(target)) as progress,
+        open(part_path, ctx.write_mode) as output,  # pylint: disable=unspecified-encoding
+        _progress(ctx.total_size, str(target)) as progress,
     ):
-        if start_byte > 0:
-            progress.update(start_byte)
-        for chunk in response.iter_content(chunk_size=chunk_size):
-            if token is not None:
-                token.raise_if_cancelled()
+        if ctx.start_byte > 0:
+            progress.update(ctx.start_byte)
+        for chunk in response.iter_content(chunk_size=ctx.chunk_size):
+            if ctx.token is not None:
+                ctx.token.raise_if_cancelled()
             if not chunk:
                 continue
             written += len(chunk)
-            if written > max_bytes:
+            if written > ctx.max_bytes:
                 file_automation_logger.error(
-                    "download_file aborted: stream exceeded %d bytes", max_bytes
+                    "download_file aborted: stream exceeded %d bytes", ctx.max_bytes
                 )
                 return None
             output.write(chunk)
             progress.update(len(chunk))
-            if reporter is not None:
-                reporter.update(len(chunk))
+            if ctx.reporter is not None:
+                ctx.reporter.update(len(chunk))
     return written
 
 
@@ -151,41 +158,23 @@ def _run_stream(
     response: requests.Response,
     part_path: Path,
     target: Path,
-    *,
-    write_mode: str,
-    chunk_size: int,
-    start_byte: int,
-    total_size: int,
-    max_bytes: int,
-    reporter: ProgressReporter | None,
-    token: Any,
+    ctx: _StreamContext,
     progress_name: str | None,
 ) -> int | None:
     try:
-        written = _stream_to_disk(
-            response,
-            part_path,
-            target,
-            write_mode=write_mode,
-            chunk_size=chunk_size,
-            start_byte=start_byte,
-            total_size=total_size,
-            max_bytes=max_bytes,
-            reporter=reporter,
-            token=token,
-        )
+        written = _stream_to_disk(response, part_path, target, ctx)
     except CancelledException:
         file_automation_logger.warning("download_file cancelled: %s", progress_name)
-        if reporter is not None:
-            reporter.finish(status="cancelled")
+        if ctx.reporter is not None:
+            ctx.reporter.finish(status="cancelled")
         return None
     except OSError as error:
         file_automation_logger.error("download_file write error: %r", error)
-        if reporter is not None:
-            reporter.finish(status="error")
+        if ctx.reporter is not None:
+            ctx.reporter.finish(status="error")
         return None
-    if written is None and reporter is not None:
-        reporter.finish(status="aborted")
+    if written is None and ctx.reporter is not None:
+        ctx.reporter.finish(status="aborted")
     return written
 
 
@@ -234,20 +223,17 @@ def download_file(
         return False
 
     reporter, token = _make_reporter(progress_name, total_size, start_byte)
-
-    written = _run_stream(
-        response,
-        part_path,
-        target,
+    ctx = _StreamContext(
         write_mode=write_mode,
         chunk_size=chunk_size,
         start_byte=start_byte,
         total_size=total_size,
         max_bytes=max_bytes,
         reporter=reporter,
         token=token,
-        progress_name=progress_name,
     )
+
+    written = _run_stream(response, part_path, target, ctx, progress_name)
     if written is None:
         return False
 

automation_file/scheduler/cron.py

@@ -80,6 +80,7 @@ def _expand_chunk(
     field_index: int,
     low: int,
     high: int,
+    *,
     effective_high: int,
 ) -> set[int]:
     if chunk == "*":
@@ -107,7 +108,7 @@ def _parse_field(raw: str, field_index: int) -> frozenset[int]:
         if not chunk:
             raise CronException(f"cron: empty chunk in field {field_index}")
         base, step = _split_step(chunk)
-        result |= _expand_chunk(base, step, field_index, low, high, effective_high)
+        result |= _expand_chunk(base, step, field_index, low, high, effective_high=effective_high)
     if field_index == 4 and 7 in result:
         result.discard(7)
         result.add(0)

automation_file/utils/fast_find.py

@@ -167,7 +167,8 @@ def _run_indexer(
 
 
 def _capture(argv: list[str]) -> list[str]:
-    completed = subprocess.run(  # nosec B603 nosemgrep — argv[0] is a fixed-name indexer; shell=False
+    # argv[0] is a fixed-name indexer (mdfind/locate/es); shell=False.
+    completed = subprocess.run(  # nosec B603 nosemgrep
         argv,
         capture_output=True,
         timeout=_INDEX_TIMEOUT_SECONDS,

tests/test_secrets.py

@@ -64,7 +64,8 @@ def test_resolve_secret_refs_walks_nested_containers(
                 "sinks": [
                     {
                         "username": "${env:U}",
-                        "password": "${env:P}",  # NOSONAR test fixture — env-ref placeholder, not a real credential
+                        # NOSONAR env-ref placeholder, not a real credential
+                        "password": "${env:P}",  # NOSONAR
                         "port": 587,
                     },
                 ]