[Task]: Enforce strict compiler warning equivalents

[WilliamBerryiii]

Documentation Location

CONTRIBUTING.md, .github/workflows/, scripts/linting/

Issue Description

Background

OpenSSF Best Practices (Silver) requirement warnings_strict requires projects to be strict about warnings where practical. This includes:

1. Enabling strict compiler/linter modes
2. Treating warnings as errors in CI
3. Documenting warning policy

This project uses shell scripts, Terraform, and Python, so "strict warnings" applies to linters for these languages.

Current State

Component	Status
Shell script linting (shellcheck)	⚠️ Scripts exist but not enforced in CI
Terraform validation	⚠️ Not enforced in CI
Python linting	⚠️ No linting configuration
Markdown linting	✅ Exists in scripts/linting/
Go linting (golangci-lint)	⚠️ Planned — see #333
Warnings as errors	❌ Not enforced

Evidence

• scripts/linting/ contains PowerShell scripts for linting but no CI integration
• No .shellcheckrc or shellcheck CI job
• No .terraform-docs.yml or terraform fmt/validate CI
• No pyproject.toml linting configuration (black, ruff, mypy)
• OpenSSF Silver requirement: warnings_strict

Suggested Fix

1. Add shellcheck configuration

Create .shellcheckrc:

# Treat warnings as errors
external-sources=true
shell=bash

2. Add Python linting with ruff

Update pyproject.toml:

[tool.ruff]
line-length = 120
target-version = "py310"
select = [
    "E",   # pycodestyle errors
    "W",   # pycodestyle warnings
    "F",   # pyflakes
    "I",   # isort
    "B",   # flake8-bugbear
    "UP",  # pyupgrade
]

[tool.ruff.lint]
# Treat all warnings as errors in CI
extend-select = ["E"]

3. Add CI workflow for linting

Create or update .github/workflows/lint.yml:

name: Lint

on: [push, pull_request]

jobs:
  shellcheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@master
        with:
          severity: warning  # Fail on warnings

  terraform:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - name: Terraform Format Check
        run: terraform fmt -check -recursive deploy/

  python:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.10'
      - run: pip install ruff
      - name: Ruff Check
        run: ruff check src/ --output-format=github

4. Document warning policy in CONTRIBUTING.md

## Code Quality Standards

### Warning Policy

We enforce strict warnings across all code:

| Language | Tool | Policy | CI Enforcement |
|----------|------|--------|----------------|
| Shell scripts | ShellCheck | All warnings are errors | lint workflow |
| Terraform | terraform fmt/validate | Format and validation required | lint workflow |
| Python | Ruff | All enabled rules enforced | lint workflow |
| Markdown | markdownlint | Enforced in CI | lint workflow |
| Go | golangci-lint | All enabled linters enforced | `go-tests.yml` lint step |

### Pre-commit Hooks (Recommended)

Install pre-commit to catch warnings locally:

pip install pre-commit
pre-commit install

### Suppressing Warnings

If a warning must be suppressed:

1. Prefer fixing the issue over suppressing
2. Use inline suppression with explanation comment
3. Document in code review why suppression is needed

Acceptance Criteria

• ShellCheck is enforced in CI with warnings as errors
• Terraform format and validation are enforced in CI
• Python linting (ruff or equivalent) is enforced in CI
• Go linting (golangci-lint) is enforced in CI (see docs(contributing): add Go toolchain to prerequisites and developer workflow #333)
• Warning policy is documented in CONTRIBUTING.md
• CI fails on warnings, not just errors
• Configuration files exist (.shellcheckrc, ruff config in pyproject.toml, .golangci.yml)

Dependencies

• docs(contributing): add Go toolchain to prerequisites and developer workflow #333 — golangci-lint configuration for Go code quality

Validation

1. Submit a PR with a shell script warning — should fail CI
2. Submit a PR with unformatted Terraform — should fail CI
3. Submit a PR with Python style issue — should fail CI
4. Review CONTRIBUTING.md for warning policy documentation

---

OpenSSF IDs: warnings_strict

---

Migrated from Azure-Samples/azure-nvidia-robotics-reference-architecture#106