add Ruff linting to CI

Author: Saharsh1123

.github/workflows/tests.yaml

@@ -11,6 +11,17 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Install test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install pytest ruff
+
+      - name: Run Ruff
+        run: ruff check .
+
+      - name: Run tests
+        run: pytest
+
       - name: Check out repository
         uses: actions/checkout@v4
 
@@ -25,4 +36,5 @@ jobs:
           pip install pytest
 
       - name: Run tests
-        run: pytest
+        run: pytest
+

cli.py

@@ -13,23 +13,16 @@
 )
 
 # Define required positional argument for the target directory
-parser.add_argument(
-    "path",
-    help="Path to the directory to scan"
-)
+parser.add_argument("path", help="Path to the directory to scan")
 
 # Enable machine-readable JSON output when present
-parser.add_argument(
-    "--json",
-    action="store_true",
-    help="Output findings as JSON"
-)
+parser.add_argument("--json", action="store_true", help="Output findings as JSON")
 
 # Optionally filter displayed findings by severity level
 parser.add_argument(
     "--severity",
     choices=["LOW", "MEDIUM", "HIGH"],
-    help="Only show findings matching the selected severity"
+    help="Only show findings matching the selected severity",
 )
 
 # Parse command-line arguments
@@ -39,4 +32,3 @@
 input_path = args.path
 use_json = args.json
 chosen_severity = args.severity
-

detectors/find_secrets.py

@@ -9,35 +9,37 @@
 REGEX_INFO = {
     "AWS Access Key": {
         "value_pattern": re.compile(r"(AKIA[0-9A-Z]{16})"),
-        "severity": "HIGH"
+        "severity": "HIGH",
     },
     "Password": {
         "var_patterns": [
             re.compile(r"password", re.IGNORECASE),
             re.compile(r"pwd", re.IGNORECASE),
-            re.compile(r"passwd", re.IGNORECASE)         
+            re.compile(r"passwd", re.IGNORECASE),
         ],
         "min_length": 4,
-        "severity": "HIGH"
+        "severity": "HIGH",
     },
     "API Key": {
         "var_patterns": [
             re.compile(r"api_key", re.IGNORECASE),
-            re.compile(r"apikey", re.IGNORECASE)
+            re.compile(r"apikey", re.IGNORECASE),
         ],
-        "min_length": 4,        
-        "severity": "HIGH"
+        "min_length": 4,
+        "severity": "HIGH",
     },
     "Token": {
         "var_patterns": [re.compile(r"token", re.IGNORECASE)],
         "min_length": 4,
-        "severity": "MEDIUM"
+        "severity": "MEDIUM",
     },
     "Secret": {
-        "var_patterns": [re.compile(r"secret", re.IGNORECASE),],
+        "var_patterns": [
+            re.compile(r"secret", re.IGNORECASE),
+        ],
         "min_length": 4,
-        "severity": "MEDIUM"
-    }
+        "severity": "MEDIUM",
+    },
 }
 
 
@@ -57,7 +59,7 @@ def parse_ast(file):
         tree = ast.parse(file)
     except SyntaxError:
         return None
-    
+
     return tree
 
 
@@ -71,7 +73,7 @@ def get_assignments(tree):
     Yields:
         ast.Assign: Assignment nodes found during traversal.
     """
-    for node in ast.walk(tree): 
+    for node in ast.walk(tree):
         if isinstance(node, ast.Assign):
             yield node
 
@@ -87,10 +89,7 @@ def extract_node_value(node):
         str | None: String value if valid, otherwise None.
     """
     val = node.value
-    if not(
-        isinstance(val, ast.Constant)
-        and isinstance(val.value, str)
-    ):
+    if not (isinstance(val, ast.Constant) and isinstance(val.value, str)):
         return None
     return val.value
 
@@ -159,7 +158,7 @@ def detect_from_parts(var_name, val):
         # Match suspicious variable names and enforce minimum value length
         if "var_patterns" in data:
             for pattern in data["var_patterns"]:
-                match = pattern.search(var_name) 
+                match = pattern.search(var_name)
                 if match and len(val) >= data["min_length"]:
                     findings.append((rule, data["severity"], val))
 
@@ -204,5 +203,3 @@ def detect_ast_secrets(code):
                     findings.append((line_number, pattern_name, severity, value))
 
     return findings
-
-    

main.py

@@ -36,5 +36,3 @@
     except FileNotFoundError as e:
         # Display a user-friendly error message for invalid paths
         print(f"[ERROR] {e}")
-
-

scanner.py

@@ -2,6 +2,7 @@
 from detectors.find_secrets import detect_ast_secrets
 import json
 
+
 def check_path(input_path):
     """
     Validate that the provided path exists and is a directory.
@@ -20,9 +21,7 @@ def check_path(input_path):
     if path.is_dir():
         return path
 
-    raise FileNotFoundError(
-        f"'{input_path}' does not exist or is not a directory!"
-    )
+    raise FileNotFoundError(f"'{input_path}' does not exist or is not a directory!")
 
 
 def list_python_files(path):
@@ -69,7 +68,6 @@ def scan(files):
     findings = []
 
     for file in files:
-
         # Read file content safely before passing it to the AST detector
         with open(file, "r", encoding="utf-8", errors="ignore") as f:
             content = f.read()
@@ -150,17 +148,13 @@ def output(filtered_findings, use_json, files):
         return
 
     print(f"Scanning {len(files)} Python files...")
-    
+
     if not filtered_findings:
         print("\nNo vulnerabilities found.")
     else:
         print("\n--- Findings ---\n")
 
-        for line_number, file, rule_name, severity, value in filtered_findings:      
-            print(
-                f"[{severity}] "
-                f"{file}:{line_number} "
-                f"{rule_name} → {value}"
-            )
+        for line_number, file, rule_name, severity, value in filtered_findings:
+            print(f"[{severity}] {file}:{line_number} {rule_name} → {value}")
 
-        print(f"\nTotal findings: {len(filtered_findings)}")
+        print(f"\nTotal findings: {len(filtered_findings)}")

test_dirs/edge_repo/edge_test.py

@@ -1 +1 @@
-password = "hjkl"
+password = "hjkl"

test_dirs/test_repo/embedded_test/embedded_hello.py

@@ -1 +1 @@
-print("hellohello")
+print("hellohello")

test_dirs/test_repo/hello.py

@@ -1,2 +1,2 @@
 print("hello")
-print("world")
+print("world")

test_dirs/test_repo/open_vulns.py

@@ -1,9 +1,8 @@
 api_key = "123"
-password="abc"
+password = "abc"
 token = "xyz"
 aws_key = "AKIAEXAMPLE123456789"
 token = "xyzttttggfdddf"
-api_key = "12dwdqwdqwdqw3"; token = "xyzgggggg"
-TOKEN="abc1234567890j"
-
-
+api_key = "12dwdqwdqwdqw3"
+token = "xyzgggggg"  # noqa: E702
+TOKEN = "abc1234567890j"

tests/test_ast.py

@@ -62,7 +62,7 @@ def test_ast_aws_access_key_with_api_key_variable():
 
 # Ignore non-string assignments
 def test_ast_non_string():
-    code = 'password = 123456'
+    code = "password = 123456"
     result = detect_ast_secrets(code)
 
     assert result == []
@@ -86,11 +86,11 @@ def test_ast_short_value():
 
 # Validate multiple assignments and correct line numbers
 def test_ast_multiple_assignments():
-    code = '''
+    code = """
     password = "abcdef"
     api_key = "12345678"
     token = "qwerty123"
-    '''
+    """
     result = detect_ast_secrets(code)
 
     assert result == [
@@ -169,10 +169,10 @@ def test_ast_complex_password_value():
 
 # Handle indented multiline code by normalizing indentation
 def test_ast_dedented_multiline_code():
-    code = '''
+    code = """
         password = "abcdef"
         username = "notsecret"
-    '''
+    """
     result = detect_ast_secrets(code)
 
-    assert result == [(2, "Password", "HIGH", "abcdef")]
+    assert result == [(2, "Password", "HIGH", "abcdef")]