Lint on GitHub Actions via pre-commit

.flake8

@@ -0,0 +1,4 @@
+[flake8]
+extend-ignore = C408,E203,F841,W503
+max-complexity = 10
+max-line-length = 88

.github/workflows/lint.yml

@@ -0,0 +1,30 @@
+name: Lint
+
+on: [push, pull_request, workflow_dispatch]
+
+env:
+  FORCE_COLOR: 1
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+          cache: pip
+          cache-dependency-path: .github/workflows/lint.yml
+      - uses: pre-commit/action@v3.0.0
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip wheel
+          # TODO: remove setuptools installation when safety==2.4.0 is released
+          python -m pip install --upgrade safety setuptools
+          python -m pip install --editable .
+      # Ignore CVE-2023-5752, we're not using that pip or feature
+      - run: safety check --ignore 62044

.pre-commit-config.yaml

@@ -0,0 +1,88 @@
+repos:
+  - repo: https://github.com/asottile/pyupgrade
+    rev: v3.15.0
+    hooks:
+      - id: pyupgrade
+        args: [--py38-plus]
+
+  - repo: https://github.com/psf/black-pre-commit-mirror
+    rev: 23.12.1
+    hooks:
+      - id: black
+
+  - repo: https://github.com/PyCQA/isort
+    rev: 5.13.2
+    hooks:
+      - id: isort
+        args: [--add-import=from __future__ import annotations]
+
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.7.6
+    hooks:
+      - id: bandit
+        args: ["--skip=B101,B404,B603"]
+
+  - repo: https://github.com/PyCQA/flake8
+    rev: 7.0.0
+    hooks:
+      - id: flake8
+        additional_dependencies:
+          [
+            flake8-2020,
+            flake8-bugbear,
+            flake8-comprehensions,
+            flake8-implicit-str-concat,
+            flake8-logging,
+          ]
+
+  - repo: https://github.com/pre-commit/pygrep-hooks
+    rev: v1.10.0
+    hooks:
+      - id: python-check-blanket-noqa
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: check-case-conflict
+      - id: check-executables-have-shebangs
+      - id: check-merge-conflict
+      - id: check-json
+      - id: check-toml
+      - id: check-yaml
+      - id: debug-statements
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+
+  - repo: https://github.com/pre-commit/mirrors-mypy
+    rev: v1.8.0
+    hooks:
+      - id: mypy
+        args:
+          [
+            --ignore-missing-imports,
+            --install-types,
+            --non-interactive,
+            --pretty,
+            --show-error-codes,
+            .,
+          ]
+        pass_filenames: false
+
+  - repo: https://github.com/tox-dev/pyproject-fmt
+    rev: 1.6.0
+    hooks:
+      - id: pyproject-fmt
+
+  - repo: https://github.com/abravalheri/validate-pyproject
+    rev: v0.15
+    hooks:
+      - id: validate-pyproject
+
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.2.6
+    hooks:
+      - id: codespell
+        args: [--ignore-words-list=commitish]
+
+ci:
+  autoupdate_schedule: quarterly

cherry_picker/__init__.py

@@ -1,4 +1,6 @@
 """Backport CPython changes from main to maintenance branches."""
+from __future__ import annotations
+
 import importlib.metadata
 
 __version__ = importlib.metadata.version(__name__)

cherry_picker/__main__.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 from .cherry_picker import cherry_pick_cli
 
 if __name__ == "__main__":

cherry_picker/cherry_picker.py

@@ -1,5 +1,7 @@
 #!/usr/bin/env python3
 
+from __future__ import annotations
+
 import collections
 import enum
 import os
@@ -91,7 +93,6 @@ class InvalidRepoException(Exception):
 
 
 class CherryPicker:
-
     ALLOWED_STATES = WORKFLOW_STATES.BACKPORT_PAUSED, WORKFLOW_STATES.UNSET
     """The list of states expected at the start of the app."""
 
@@ -151,7 +152,9 @@ def set_paused_state(self):
         set_state(WORKFLOW_STATES.BACKPORT_PAUSED)
 
     def remember_previous_branch(self):
-        """Save the current branch into Git config to be able to get back to it later."""
+        """Save the current branch into Git config
+        to be able to get back to it later.
+        """
         current_branch = get_current_branch()
         save_cfg_vals_to_git_cfg(previous_branch=current_branch)
 
@@ -160,7 +163,8 @@ def upstream(self):
         """Get the remote name to use for upstream branches
 
         Uses the remote passed to `--upstream-remote`.
-        If this flag wasn't passed, it uses "upstream" if it exists or "origin" otherwise.
+        If this flag wasn't passed, it uses "upstream" if it exists or "origin"
+        otherwise.
         """
         # the cached calculated value of the property
         if self._upstream is not None:
@@ -203,7 +207,10 @@ def get_cherry_pick_branch(self, maint_branch):
         return f"backport-{self.commit_sha1[:7]}-{maint_branch}"
 
     def get_pr_url(self, base_branch, head_branch):
-        return f"https://github.com/{self.config['team']}/{self.config['repo']}/compare/{base_branch}...{self.username}:{head_branch}?expand=1"
+        return (
+            f"https://github.com/{self.config['team']}/{self.config['repo']}"
+            f"/compare/{base_branch}...{self.username}:{head_branch}?expand=1"
+        )
 
     def fetch_upstream(self):
         """git fetch <upstream>"""
@@ -323,7 +330,9 @@ def get_updated_commit_message(self, cherry_pick_branch):
         commit_prefix = ""
         if self.prefix_commit:
             commit_prefix = f"[{get_base_branch(cherry_pick_branch)}] "
-        updated_commit_message = f"{commit_prefix}{self.get_commit_message(self.commit_sha1)}"
+        updated_commit_message = (
+            f"{commit_prefix}{self.get_commit_message(self.commit_sha1)}"
+        )
 
         # Add '(cherry picked from commit ...)' to the message
         # and add new Co-authored-by trailer if necessary.
@@ -349,7 +358,9 @@ def get_updated_commit_message(self, cherry_pick_branch):
         #
         # This needs to be done because `git interpret-trailers` required us to add `:`
         # to `cherry_pick_information` when we don't actually want it.
-        before, after = output.strip().decode().rsplit(f"\n{cherry_pick_information}", 1)
+        before, after = (
+            output.strip().decode().rsplit(f"\n{cherry_pick_information}", 1)
+        )
         if not before.endswith("\n"):
             # ensure that we still have a newline between cherry pick information
             # and commit headline
@@ -359,7 +370,7 @@ def get_updated_commit_message(self, cherry_pick_branch):
         return updated_commit_message
 
     def amend_commit_message(self, cherry_pick_branch):
-        """ prefix the commit message with (X.Y) """
+        """Prefix the commit message with (X.Y)"""
 
         updated_commit_message = self.get_updated_commit_message(cherry_pick_branch)
         if self.dry_run:
@@ -442,7 +453,7 @@ def create_gh_pr(self, base_branch, head_branch, *, commit_message, gh_auth):
         if response.status_code == requests.codes.created:
             response_data = response.json()
             click.echo(f"Backport PR created at {response_data['html_url']}")
-            self.pr_number = response_data['number']
+            self.pr_number = response_data["number"]
         else:
             click.echo(response.status_code)
             click.echo(response.text)
@@ -542,7 +553,9 @@ def abort_cherry_pick(self):
         state = self.get_state_and_verify()
         if state != WORKFLOW_STATES.BACKPORT_PAUSED:
             raise ValueError(
-                f"One can only abort a paused process. Current state: {state}. Expected state: {WORKFLOW_STATES.BACKPORT_PAUSED}"
+                f"One can only abort a paused process. "
+                f"Current state: {state}. "
+                f"Expected state: {WORKFLOW_STATES.BACKPORT_PAUSED}"
             )
 
         try:
@@ -575,7 +588,9 @@ def continue_cherry_pick(self):
         state = self.get_state_and_verify()
         if state != WORKFLOW_STATES.BACKPORT_PAUSED:
             raise ValueError(
-                f"One can only continue a paused process. Current state: {state}. Expected state: {WORKFLOW_STATES.BACKPORT_PAUSED}"
+                "One can only continue a paused process. "
+                f"Current state: {state}. "
+                f"Expected state: {WORKFLOW_STATES.BACKPORT_PAUSED}"
             )
 
         cherry_pick_branch = get_current_branch()
@@ -623,7 +638,8 @@ def continue_cherry_pick(self):
 
         else:
             click.echo(
-                f"Current branch ({cherry_pick_branch}) is not a backport branch.  Will not continue. \U0001F61B"
+                f"Current branch ({cherry_pick_branch}) is not a backport branch. "
+                "Will not continue. \U0001F61B"
             )
             set_state(WORKFLOW_STATES.CONTINUATION_FAILED)
 
@@ -635,8 +651,8 @@ def check_repo(self):
         """
         Check that the repository is for the project we're configured to operate on.
 
-        This function performs the check by making sure that the sha specified in the config
-        is present in the repository that we're operating on.
+        This function performs the check by making sure that the sha specified in the
+        config is present in the repository that we're operating on.
         """
         try:
             validate_sha(self.config["check_sha"])
@@ -823,7 +839,8 @@ def get_base_branch(cherry_pick_branch):
 
     if prefix != "backport":
         raise ValueError(
-            'branch name is not prefixed with "backport-".  Is this a cherry_picker branch?'
+            'branch name is not prefixed with "backport-". '
+            "Is this a cherry_picker branch?"
         )
 
     if not re.match("[0-9a-f]{7,40}", sha):
@@ -851,7 +868,8 @@ def validate_sha(sha):
         subprocess.check_output(cmd, stderr=subprocess.STDOUT)
     except subprocess.SubprocessError:
         raise ValueError(
-            f"The sha listed in the branch name, {sha}, is not present in the repository"
+            f"The sha listed in the branch name, {sha}, "
+            "is not present in the repository"
         )