secure-code-agent
Example report: secure-code-agent auditing its own repository

secure-code-agent report

Generated: 2026-10-30T23:35:35Z · agent v0.13.2

Summary

Categories

Category Grade Score Findings
secrets A+ 5.00 0
dependencies A+ 5.00 0
code_vulnerabilities A+ 5.00 0
crypto A+ 5.00 0
supply_chain A+ 5.00 0
config_iac A+ 5.00 0
policy_docs A+ 5.00 1
auth_authz — — 0
logging_observability — — 0

Severity breakdown

Severity Count
critical 0
high 0
medium 0
low 0
informational 1

Test tree

Documentation

Dependencies

Scanners

Scanner Outcome Version Command Scope
bandit completed bandit 1.9.4 bandit —
builtin_rules completed builtin/0.13.2 — —
gitleaks completed gitleaks version 8.30.1 /opt/homebrew/bin/gitleaks working tree and git history
njsscan completed njsscan: v1.0.1 Ajin Abraham opensecurity.in
pip_audit completed pip-audit 2.10.1 pip-audit mode=requirements; inputs=requirements-audit.txt; extra_args=--no-deps
semgrep completed 1.172.0 semgrep offline profile sca-offline@1.2.0 (e861a891559f)
checkov completed 3.4.0 checkov —
osv_scanner completed osv-scanner version: 2.6.0 /opt/homebrew/bin/osv-scanner —
rubocop completed 1.91.0 /opt/homebrew/bin/rubocop —
trivy completed Version: 0.74.0 /opt/homebrew/bin/trivy —

Findings

High

B413 — The pyCrypto library and its module AES are no longer actively maintained and have been deprecated. Consider using pyca/ 🆕

1 """Safe twins of the two Python patterns this profile still owns."""
2 from Crypto.Cipher import AES
3

B413 — The pyCrypto library and its module AES are no longer actively maintained and have been deprecated. Consider using pyca/ 🆕

1 """The two Python patterns Bandit measurably misses. Everything else is Bandit's."""
2 from Crypto.Cipher import AES
3

sca.python.eval — eval()/exec() on non-literal input. 🆕

eval(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.eval — eval()/exec() on non-literal input. 🆕

eval(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.eval — eval()/exec() on non-literal input. 🆕

eval(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.eval — eval()/exec() on non-literal input. 🆕

eval(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.eval — eval()/exec() on non-literal input. 🆕

eval(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.eval — eval()/exec() on non-literal input. 🆕

exec(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.eval — eval()/exec() on non-literal input. 🆕

eval(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.fstring_sql — f-string SQL — interpolated value in .execute()/.executemany(). 🆕

.execute(f'SELECT * FROM users WHERE id = {uid}

💡 Fix: Parameterize: await conn.execute('... WHERE id = $1', value) instead of f-string.

sca.python.eval — eval()/exec() on non-literal input. 🆕

eval(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.subprocess.shell_true — subprocess.* with shell=True and non-literal command. 🆕

subprocess.run(user_input, shell=True

💡 Fix: Pass argv as a list (e.g. ['git', 'log', '-n', '5']) and use shell=False.

sca.python.eval — eval()/exec() on non-literal input. 🆕

exec(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.eval — eval()/exec() on non-literal input. 🆕

exec(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.eval — eval()/exec() on non-literal input. 🆕

exec(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.subprocess.shell_true — subprocess.* with shell=True and non-literal command. 🆕

subprocess.call('ls', shell=True

💡 Fix: Pass argv as a list (e.g. ['git', 'log', '-n', '5']) and use shell=False.

sca.python.subprocess.shell_true — subprocess.* with shell=True and non-literal command. 🆕

subprocess.call("ls " + $ARG, shell=True

💡 Fix: Pass argv as a list (e.g. ['git', 'log', '-n', '5']) and use shell=False.

sca.python.fstring_sql — f-string SQL — interpolated value in .execute()/.executemany(). 🆕

.execute(f'SELECT * FROM users WHERE id = {uid}

💡 Fix: Parameterize: await conn.execute('... WHERE id = $1', value) instead of f-string.

sca.python.fstring_sql — f-string SQL — interpolated value in .execute()/.executemany(). 🆕

.execute(f'SELECT * FROM users WHERE id = {uid}

💡 Fix: Parameterize: await conn.execute('... WHERE id = $1', value) instead of f-string.

sca.python.eval — eval()/exec() on non-literal input. 🆕

eval(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.subprocess.shell_true — subprocess.* with shell=True and non-literal command. 🆕

subprocess.call('ls '+a, " + "shell=True

💡 Fix: Pass argv as a list (e.g. ['git', 'log', '-n', '5']) and use shell=False.

sca.python.subprocess.shell_true — subprocess.* with shell=True and non-literal command. 🆕

subprocess.call('ls '+x, " + "shell=True

💡 Fix: Pass argv as a list (e.g. ['git', 'log', '-n', '5']) and use shell=False.

sca.python.subprocess.shell_true — subprocess.* with shell=True and non-literal command. 🆕

subprocess.call('cat '+x, " + "shell=True

💡 Fix: Pass argv as a list (e.g. ['git', 'log', '-n', '5']) and use shell=False.

sca.python.fstring_sql — f-string SQL — interpolated value in .execute()/.executemany(). 🆕

.execute(f'SELECT * FROM u WHERE id = {uid}

💡 Fix: Parameterize: await conn.execute('... WHERE id = $1', value) instead of f-string.

sca.python.eval — eval()/exec() on non-literal input. 🆕

exec(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.eval — eval()/exec() on non-literal input. 🆕

exec(

💡 Fix: Eliminate eval. Use ast.literal_eval for safe data, or a typed registry for dispatch.

sca.python.subprocess.shell_true — subprocess.* with shell=True and non-literal command. 🆕

subprocess.call(c, shell=True

💡 Fix: Pass argv as a list (e.g. ['git', 'log', '-n', '5']) and use shell=False.

CKV_SECRET_4 — IaC misconfiguration detected by Checkov. 🆕

{"dependencies": [{"name": "requests", "version": "2.19.1", "vulns": [{"id": "PYSEC-2018-28", "fix_versions": ["2.20.0"], "aliases": ["GHSA-x84v-xcm2-53pg", "CVE-2018-18074"], "description": "The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network."}, {"id": "PYSEC-2023-74", "fix_versions": ["2.31.0"], "aliases": ["CVE-2023-32681", "GHSA-j8r2-6x86-q33q"], "description": "### Impact  Since Requests v2.3.0, Requests has been vulnerable to potentially leaking `Proxy-Authorization` headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how `rebuild_proxies` is used to recompute and [reattach the `Proxy-Authorization` header](https://github.com/psf/requests/blob/f2629e9e3c7ce3c3c8c025bcd8db551101cbc773/requests/sessions.py#L319-L328) to requests when redirected. Note this behavior has _only_ been observed to affect proxied requests when credentials are supplied in the URL user information component (e.g. `https://username:pa**********@proxy:8080`).  **Current vulnerable behavior(s):**  1. HTTP \u2192 HTTPS: **leak** 2. HTTPS \u2192 HTTP: **no leak** 3. HTTPS \u2192 HTTPS: **leak** 4. HTTP \u2192 HTTP: **no leak**  For HTTP connections sent through the proxy, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into further tunneled requests. This results in Requests forwarding the header to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate those credentials.  The reason this currently works for HTTPS connections in Requests is the `Proxy-Authorization` header is also handled by urllib3 with our usage of the ProxyManager in adapters.py with [`proxy_manager_for`](https://github.com/psf/requests/blob/f2629e9e3c7ce3c3c8c025bcd8db551101cbc773/requests/adapters.py#L199-L235). This will compute the required proxy headers in `proxy_headers` and pass them to the Proxy Manager, avoiding attaching them directly to the Request object. This will be our preferred option going forward for default usage.  ### Patches Starting in Requests v2.31.0, Requests will no longer attach this header to redirects with an HTTPS destination. This should have no negative impacts on the default behavior of the library as the proxy credentials are already properly being handled by urllib3's ProxyManager.  For users with custom adapters, this _may_ be potentially breaking if you were already working around this behavior. The previous functionality of `rebuild_proxies` doesn't make sense in any case, so we would encourage any users impacted to migrate any handling of Proxy-Authorization directly into their custom adapter.  ### Workarounds For users who are not able to update Requests immediately, there is one potential workaround.  You may disable redirects by setting `allow_redirects` to `False` on all calls through Requests top-level APIs. Note that if you're currently relying on redirect behaviors, you will need to capture the 3xx response codes and ensure a new request is made to the redirect destination. ``` import requests r = requests.get('http://github.com/', allow_redirects=False) ```  ### Credits  This vulnerability was discovered and disclosed by the following individuals.  Dennis Brinkrolf, Haxolot (https://haxolot.com/) Tobias Funke, (tobiasfunke93@gmail.com)"}, {"id": "PYSEC-2023-74", "fix_versions": ["2.31.0"], "aliases": ["CVE-2023-32681", "GHSA-j8r2-6x86-q33q"], "description": "Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.  "}, {"id": "PYSEC-2026-1873", "fix_versions": ["2.32.0"], "aliases": ["CVE-2024-35195", "GHSA-9wx4-h78v-vm56"], "description": "When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.  This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.  This behavior affects versions of `requests` prior to 2.32.0."}, {"id": "PYSEC-2026-1872", "fix_versions": ["2.32.4"], "aliases": ["GHSA-9hjg-9r4m-mvj7", "CVE-2024-47081"], "description": "### Impact  Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.  ### Workarounds For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).  ### References https://github.com/psf/requests/pull/6965 https://seclists.org/fulldisclosure/2025/Jun/2"}, {"id": "PYSEC-2026-2275", "fix_versions": ["2.33.0"], "aliases": ["GHSA-gc5v-m9x4-r6x2", "CVE-2026-25645"], "description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access."}]}, {"name": "chardet", "version": "3.0.4", "vulns": []}, {"name": "idna", "version": "2.7", "vulns": [{"id": "PYSEC-2024-60", "fix_versions": ["3.7"], "aliases": ["CVE-2024-3651", "GHSA-jjg7-2v4v-x38h"], "description": "### Impact A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.  ### Patches The function has been refined to reject such strings without the associated resource consumption in version 3.7.  ### Workarounds Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.  ### References * https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"}, {"id": "PYSEC-2024-60", "fix_versions": ["3.7"], "aliases": ["CVE-2024-3651", "GHSA-jjg7-2v4v-x38h"], "description": "A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size."}, {"id": "PYSEC-2026-215", "fix_versions": ["3.15"], "aliases": ["CVE-2026-45409", "GHSA-65pc-fj4g-8rjx"], "description": "This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process.  ### Impact A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.  ### Patches Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support).  ### Workarounds Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application."}, {"id": "PYSEC-2026-215", "fix_versions": ["3.15"], "aliases": ["CVE-2026-45409", "GHSA-65pc-fj4g-8rjx"], "description": "Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application."}]}, {"name": "urllib3", "version": "1.23", "vulns": [{"id": "PYSEC-2019-133", "fix_versions": ["1.24.2"], "aliases": ["CVE-2019-11324", "GHSA-mh33-7rrq-662w"], "description": "The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument."}, {"id": "PYSEC-2019-132", "fix_versions": ["1.24.3"], "aliases": ["CVE-2019-11236", "GHSA-r64q-w8jr-g9qp"], "description": "In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter."}, {"id": "PYSEC-2020-148", "fix_versions": ["1.25.9"], "aliases": ["CVE-2020-26137", "GHSA-wqvq-5m8c-6g24"], "description": "urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116."}, {"id": "PYSEC-2023-192", "fix_versions": ["1.26.17", "2.0.6"], "aliases": ["GHSA-v845-jxx5-vc9f", "CVE-2023-43804"], "description": "urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.  Users **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.  ## Affected usages  We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:  * Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6) * Using the `Cookie` header on requests, which is mostly typical for impersonating a browser. * Not disabling HTTP redirects * Either not using HTTPS or for the origin server to redirect to a malicious origin.  ## Remediation  * Upgrading to at least urllib3 v1.26.17 or v2.0.6 * Disabling HTTP redirects using `redirects=False` when sending requests. * Not using the `Cookie` header."}, {"id": "PYSEC-2023-192", "fix_versions": ["1.26.17", "2.0.6"], "aliases": ["GHSA-v845-jxx5-vc9f", "CVE-2023-43804"], "description": "urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5."}, {"id": "PYSEC-2023-212", "fix_versions": ["1.26.18", "2.0.7"], "aliases": ["CVE-2023-45803", "GHSA-g4mx-q9vg-27p4"], "description": "urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 303 \"See Other\" after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although the behavior of removing the request body is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers.  From [RFC 9110 Section 9.3.1](https://www.rfc-editor.org/rfc/rfc9110.html#name-get):  > A client SHOULD NOT generate content in a GET request unless it is made directly to an origin server that has previously indicated, in or out of band, that such a request has a purpose and will be adequately supported.  ## Affected usages  Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable.  Both of the following conditions must be true to be affected by this vulnerability:  * If you're using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) * The origin service is compromised and starts redirecting using 303 to a malicious peer or the redirected-to service becomes compromised.  ## Remediation  You can remediate this vulnerability with any of the following steps:  * Upgrade to a patched version of urllib3 (v1.26.18 or v2.0.7) * Disable redirects for services that you aren't expecting to respond with redirects with `redirects=False`. * Disable automatic redirects with `redirects=False` and handle 303 redirects manually by stripping the HTTP request body."}, {"id": "PYSEC-2023-207", "fix_versions": ["1.24.2"], "aliases": ["GHSA-gwvm-45gx-3cf8", "CVE-2018-25091"], "description": "urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive)."}, {"id": "PYSEC-2023-212", "fix_versions": ["1.26.18", "2.0.7"], "aliases": ["CVE-2023-45803", "GHSA-g4mx-q9vg-27p4"], "description": "urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body. "}, {"id": "PYSEC-2026-141", "fix_versions": ["2.7.0"], "aliases": ["CVE-2026-44431", "GHSA-qccp-gfcp-xxvc"], "description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0."}, {"id": "PYSEC-2026-1999", "fix_versions": ["2.5.0"], "aliases": ["GHSA-pq67-6m6q-mj2v", "CVE-2025-50181"], "description": "urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:  ```python resp = urllib3.request(\"GET\", \"https://httpbin.org/redirect/1\", redirect=False) print(resp.status) # 302 ```  However, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:  ```python import urllib3  http = urllib3.PoolManager(retries=0)  # should raise MaxRetryError on redirect http = urllib3.PoolManager(retries=urllib3.Retry(redirect=0))  # equivalent to the above http = urllib3.PoolManager(retries=False)  # should return the first response  resp = http.request(\"GET\", \"https://httpbin.org/redirect/1\") ```  However, the `retries` parameter is currently ignored, which means all the above examples don't disable redirects.  ## Affected usages  Passing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.  By default, requests and botocore users are not affected.  ## Impact  Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.  ## Remediation  You can remediate this vulnerability with the following steps:   * Upgrade to a patched version of urllib3. If your organization would benefit from the continued support of urllib3 1.x, please contact [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com) to discuss sponsorship or contribution opportunities.  * Disable redirects at the `request()` level instead of the `PoolManager()` level."}, {"id": "PYSEC-2026-1995", "fix_versions": ["1.26.19", "2.2.2"], "aliases": ["GHSA-34jh-p97f-mpxf", "CVE-2024-37891"], "description": "When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.  However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects.  Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident.  Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach.  ## Affected usages  We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:  * Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support. * Not disabling HTTP redirects. * Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin.  ## Remediation  * Using the `Proxy-Authorization` header with urllib3's `ProxyManager`. * Disabling HTTP redirects using `redirects=False` when sending requests. * Not using the `Proxy-Authorization` header."}, {"id": "PYSEC-2026-1994", "fix_versions": ["2.6.0"], "aliases": ["CVE-2025-66471", "GHSA-2xpw-w6gg-jr37"], "description": "### Impact  urllib3's [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.  When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.  The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.   ### Affected usages  Applications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.  `stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, `readinto(b)` are examples of `urllib3.HTTPResponse` method calls using the affected logic unless decoding is disabled explicitly.   ### Remediation  Upgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data that exceeds the requested amount.  If your environment contains a package facilitating the Brotli encoding, upgrade to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 too. These versions are enforced by the `urllib3[brotli]` extra in the patched versions of urllib3.   ### Credits  The issue was reported by @Cycloctane. Supplemental information was provided by @stamparm during a security audit performed by [7ASecurity](https://7asecurity.com/) and facilitated by [OSTIF](https://ostif.org/)."}, {"id": "PYSEC-2026-1996", "fix_versions": ["2.6.3"], "aliases": ["GHSA-38jv-5279-wg99", "CVE-2026-21441"], "description": "### Impact  urllib3's [streaming API](https://urllib3.readthedocs.io/en/2.6.2/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.  urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption.  However, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client (high CPU usage and large memory allocations for decompressed data; CWE-409).  ### Affected usages  Applications and libraries using urllib3 version 2.6.2 and earlier to stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects.   ### Remediation  Upgrade to at least urllib3 v2.6.3 in which the library does not decode content of redirect responses when `preload_content=False`.  If upgrading is not immediately possible, disable [redirects](https://urllib3.readthedocs.io/en/2.6.2/user-guide.html#retrying-requests) by setting `redirect=False` for requests to untrusted source."}]}, {"name": "certifi", "version": "2026.7.22", "vulns": []}], "fixes": []}

💡 Fix: Follow Checkov's documentation link in the finding message. Misconfigs are typically a one-property addition (encryption, public-access blockers, etc.).

sca.python.hashlib.md5_sha1_security — MD5/SHA-1 in a non-test, non-checksum path. 🆕

hashlib.md5(

💡 Fix: Use SHA-256 or BLAKE2. For password hashing, use Argon2id (via argon2-cffi or passlib).

CVE-2026-111064 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-111066 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

GHSA-2g87-pp6c-29x5 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

GHSA-6q48-6c7w-9gw2 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2024-23342 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-112940 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-114145 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-52869 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-52870 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-59950 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-102268 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-102266 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-102267 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-102271 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-102272 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-102273 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

GHSA-pxh4-856f-4h89 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

Medium

Security/MarshalLoad — Avoid using Marshal.load. 🆕

Security/YAMLLoad — Prefer using YAML.safe_load over YAML.load. 🆕

B108 — Probable insecure usage of temp file/directory. 🆕

117 )
118 @pytest.mark.parametrize("escape", ["../operator-file", "/tmp/operator-file", "escaped/output"])
119 def test_target_config_cannot_write_audit_artifacts_outside_its_root(tmp_path, output_key, escape):

B108 — Probable insecure usage of temp file/directory. 🆕

126 
127     if escape == "/tmp/operator-file":
128         destination = tmp_path / "absolute-output"

B108 — Probable insecure usage of temp file/directory. 🆕

39     probe = _Probe()
40     probe.configure(Path("/tmp"), Config())
41     return probe._make_finding(

B108 — Probable insecure usage of temp file/directory. 🆕

42         message="m",
43         file_path=Path("/tmp/a.py"),
44         line_start=1,

CVE-2026-111063 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-111065 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-111748 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-111750 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-55244 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

GHSA-9w56-46f6-3qhx — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-112908 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-112909 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-112910 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-112911 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-112915 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-112934 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-112935 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-112938 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-112939 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-116684 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-116685 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-116686 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-59951 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-114603 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-101917 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-101918 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-102265 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-102269 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-102270 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-102274 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-102275 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-103001 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

Low

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

62         out = tmp_path / "report.json"
63         assert (
64             cli.main(
65                 [
66                     str(tree),
67                     "--config",
68                     str(cfg),
69                     "--only-scanners",
70                     "bandit",
71                     "--json-output",
72                     str(out),
73                 ]
74             )
75             == 0
76         )
77         return json.loads(out.read_text(encoding="utf-8"))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

91     counted = audit({})["score"]["loc_scanned"]
92     assert counted < 100, "the fixture grew; the declared number below is no longer distinctive"
93

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

97 
98     assert declared["score"]["loc_scanned"] == 250_000
99

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

118     hits = [f for f in report["findings"] if f["rule_id"] == "B307"]
119     assert hits, "bandit reported nothing; the check below would be vacuous"
120     assert all(f["suppressed"] for f in hits)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119     assert hits, "bandit reported nothing; the check below would be vacuous"
120     assert all(f["suppressed"] for f in hits)
121

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

147     hits = [f for f in report["findings"] if f["rule_id"] == "B307"]
148     assert hits, "bandit reported nothing; the check below would be vacuous"
149     assert not any(f["suppressed"] for f in hits), (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

148     assert hits, "bandit reported nothing; the check below would be vacuous"
149     assert not any(f["suppressed"] for f in hits), (
150         "the retired .scignore.yaml still suppressed a finding"
151     )
152

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

160     """
161     assert audit({})["findings"][0]["axis"] == "primary", (
162         "the finding is already off the primary axis; the check below proves nothing"
163     )
164

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

166 
167     assert [f["axis"] for f in report["findings"]] == ["documentation"]
168

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

180 
181     assert with_js - python_only == 400
182

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

198     shipped = audit({})["findings"]
199     assert [f["rule_id"] for f in shipped] == ["B307"], shipped
200     assert shipped[0]["canonical_cwe"] == "CWE-95", "premise: the shipped mapping"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

199     assert [f["rule_id"] for f in shipped] == ["B307"], shipped
200     assert shipped[0]["canonical_cwe"] == "CWE-95", "premise: the shipped mapping"
201

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

214 
215     assert [f["rule_id"] for f in mapped] == ["B307"]
216     assert mapped[0]["canonical_cwe"] == "CWE-94", "the declared overlay did not apply"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

215     assert [f["rule_id"] for f in mapped] == ["B307"]
216     assert mapped[0]["canonical_cwe"] == "CWE-94", "the declared overlay did not apply"
217     assert mapped[0]["short_desc"] == "Operator maps this to the parent weakness."

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

216     assert mapped[0]["canonical_cwe"] == "CWE-94", "the declared overlay did not apply"
217     assert mapped[0]["short_desc"] == "Operator maps this to the parent weakness."
218

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

243 
244     assert after["findings"][0]["canonical_cwe"] == "CWE-94", "the overlay did apply"
245     assert after["findings"][0]["severity"] == before["findings"][0]["severity"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

244     assert after["findings"][0]["canonical_cwe"] == "CWE-94", "the overlay did apply"
245     assert after["findings"][0]["severity"] == before["findings"][0]["severity"]
246     assert after["findings"][0]["category"] == before["findings"][0]["category"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

245     assert after["findings"][0]["severity"] == before["findings"][0]["severity"]
246     assert after["findings"][0]["category"] == before["findings"][0]["category"]
247     assert after["score"]["overall"] == before["score"]["overall"], (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

246     assert after["findings"][0]["category"] == before["findings"][0]["category"]
247     assert after["score"]["overall"] == before["score"]["overall"], (
248         f"an overlay moved the score: {before['score']['overall']} -> {after['score']['overall']}"
249     )

B404 — Consider possible security implications associated with the subprocess module. 🆕

32 import shutil
33 import subprocess
34 import sys

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

174     population = {f["scanner"] for f in probes}
175     assert population, "no scanner reached the report; the check below would be vacuous"
176     assert population == set(registry.SCANNERS)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

175     assert population, "no scanner reached the report; the check below would be vacuous"
176     assert population == set(registry.SCANNERS)
177

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

178     expected = {(name, rel) for name in registry.SCANNERS for rel in _shapes(name).values()}
179     assert {(f["scanner"], f["file_path"]) for f in probes} == expected
180

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

187 
188     assert {f["scanner"] for f in probes} == set(registry.SCANNERS)
189     live = sorted((f["scanner"], f["file_path"]) for f in probes if not f["suppressed"])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

189     live = sorted((f["scanner"], f["file_path"]) for f in probes if not f["suppressed"])
190     assert live == [], f"a repository-relative paths: glob missed {live}"
191

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

194     (lapsed,) = [f for f in report["findings"] if f["scanner"] == "suppressions"]
195     assert lapsed["file_path"] == ".scignore.yaml"
196

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

217 
218     assert {f["scanner"] for f in probes} == set(registry.SCANNERS)
219     assert {f["file_path"] for f in probes} == {

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

218     assert {f["scanner"] for f in probes} == set(registry.SCANNERS)
219     assert {f["file_path"] for f in probes} == {
220         f"api/{rel}" for name in registry.SCANNERS for rel in _shapes(name).values()
221     }
222     assert {f["axis"] for f in probes} == {"test tree"}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

221     }
222     assert {f["axis"] for f in probes} == {"test tree"}
223

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

232 
233     assert first and _identity(first) == _identity(second)
234     for f in first:

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

234     for f in first:
235         assert f["fingerprint"] == Finding.make_fingerprint(
236             canonical_cwe=f["canonical_cwe"],
237             rule_id=f["rule_id"],
238             file_path=Path(f["file_path"]),
239             code_snippet=f["code_snippet"],
240         )
241

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

265     }
266     assert uris and not any(uri.startswith("/") for uri in uris), sorted(uris)[:5]
267

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

269     paths = {entry["file_path"] for entry in baseline["entries"].values()}
270     assert paths and not any(p.startswith("/") for p in paths), sorted(paths)[:5]
271

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

274         probe_lines = [line for line in text.splitlines() if "_absolute.py" in line]
275         assert probe_lines, f"{name} lists no probe finding; the check would be vacuous"
276         assert not [line for line in probe_lines if str(tree) in line], name

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

275         assert probe_lines, f"{name} lists no probe finding; the check would be vacuous"
276         assert not [line for line in probe_lines if str(tree) in line], name
277

B607 — Starting a process with a partial executable path 🆕

289     # `tests/unit/test_finding_path_consumers.py` commit the same way.
290     subprocess.run(
291         [
292             "git",
293             "-c",
294             "user.email=t@example.invalid",
295             "-c",
296             "user.name=t",
297             "-c",
298             "commit.gpgsign=false",
299             *args,
300         ],
301         cwd=tree,
302         check=True,
303         capture_output=True,
304         env={**os.environ, "GIT_IDENTITY_OVERRIDE": "1"},
305         timeout=120,
306     )
307

B603 — subprocess call - check for execution of untrusted input. 🆕

289     # `tests/unit/test_finding_path_consumers.py` commit the same way.
290     subprocess.run(
291         [
292             "git",
293             "-c",
294             "user.email=t@example.invalid",
295             "-c",
296             "user.name=t",
297             "-c",
298             "commit.gpgsign=false",
299             *args,
300         ],
301         cwd=tree,
302         check=True,
303         capture_output=True,
304         env={**os.environ, "GIT_IDENTITY_OVERRIDE": "1"},
305         timeout=120,
306     )
307

B603 — subprocess call - check for execution of untrusted input. 🆕

345 def _run_cli(target: str, cwd: Path, scanners: str, out: Path) -> dict:
346     result = subprocess.run(
347         [
348             sys.executable,
349             "-m",
350             "secure_code_audit.cli",
351             target,
352             "--only-scanners",
353             scanners,
354             "--json-output",
355             str(out),
356         ],
357         cwd=cwd,
358         check=False,
359         capture_output=True,
360         text=True,
361         timeout=120,
362     )
363     assert out.exists(), result.stdout[-800:] + result.stderr[-800:]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

362     )
363     assert out.exists(), result.stdout[-800:] + result.stderr[-800:]
364     return json.loads(out.read_text(encoding="utf-8"))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

377     hits = _findings_of(report, "B602")
378     assert hits, "bandit reported nothing; the fixture no longer exercises the defect"
379     assert {f["file_path"] for f in hits} == {"src/app.py"}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

378     assert hits, "bandit reported nothing; the fixture no longer exercises the defect"
379     assert {f["file_path"] for f in hits} == {"src/app.py"}
380     assert all(f["suppressed"] for f in hits)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

379     assert {f["file_path"] for f in hits} == {"src/app.py"}
380     assert all(f["suppressed"] for f in hits)
381

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

391     hits = _findings_of(report, "gitleaks.curl-auth-user")
392     assert hits, "gitleaks reported nothing; the fixture no longer exercises the defect"
393     assert {f["file_path"] for f in hits} == {".github/workflows/ci.yml"}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

392     assert hits, "gitleaks reported nothing; the fixture no longer exercises the defect"
393     assert {f["file_path"] for f in hits} == {".github/workflows/ci.yml"}
394     assert all(f["suppressed"] for f in hits)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

393     assert {f["file_path"] for f in hits} == {".github/workflows/ci.yml"}
394     assert all(f["suppressed"] for f in hits)

B404 — Consider possible security implications associated with the subprocess module. 🆕

33 import shutil
34 import subprocess
35 import sys

B603 — subprocess call - check for execution of untrusted input. 🆕

43 def _run(target: Path, out: Path, *extra: str, scanners: str = "bandit") -> dict:
44     subprocess.run(
45         [
46             sys.executable,
47             "-m",
48             "secure_code_audit.cli",
49             str(target),
50             "--config",
51             str(target / "cfg.json"),
52             "--only-scanners",
53             scanners,
54             "--json-output",
55             str(out),
56             *extra,
57         ],
58         check=False,
59         capture_output=True,
60         text=True,
61         cwd=str(REPO),
62         timeout=120,
63     )
64     assert out.exists(), "the audit produced no report"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63     )
64     assert out.exists(), "the audit produced no report"
65     return json.loads(out.read_text(encoding="utf-8"))

B607 — Starting a process with a partial executable path 🆕

99     (tmp_path / "src" / "app.py").write_text("x = 1\n", encoding="utf-8")
100     subprocess.run(
101         ["openssl", "genrsa", "-out", str(tmp_path / "tests" / "fixture.key"), "2048"],
102         check=True,
103         capture_output=True,
104         timeout=120,
105     )
106     (tmp_path / "cfg.json").write_text(

B603 — subprocess call - check for execution of untrusted input. 🆕

99     (tmp_path / "src" / "app.py").write_text("x = 1\n", encoding="utf-8")
100     subprocess.run(
101         ["openssl", "genrsa", "-out", str(tmp_path / "tests" / "fixture.key"), "2048"],
102         check=True,
103         capture_output=True,
104         timeout=120,
105     )
106     (tmp_path / "cfg.json").write_text(

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

112 
113     assert report["gate"]["passed"] is False, "fixture did not trip the gate"
114     assert "fail_on_category" in report["gate"]["tripped"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

113     assert report["gate"]["passed"] is False, "fixture did not trip the gate"
114     assert "fail_on_category" in report["gate"]["tripped"]
115

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

116     reported = {(f["file_path"], f["rule_id"]) for f in report["findings"]}
117     assert any("fixture.key" in path for path, _ in reported), (
118         f"the gate tripped on a secret the report does not contain: {sorted(reported)}"
119     )
120

B607 — Starting a process with a partial executable path 🆕

128     (tmp_path / "app.py").write_text("x = 1\n", encoding="utf-8")
129     subprocess.run(
130         ["openssl", "genrsa", "-out", str(tmp_path / "tests" / "fixture.key"), "2048"],
131         check=True,
132         capture_output=True,
133         timeout=120,
134     )
135     (tmp_path / "cfg.json").write_text(

B603 — subprocess call - check for execution of untrusted input. 🆕

128     (tmp_path / "app.py").write_text("x = 1\n", encoding="utf-8")
129     subprocess.run(
130         ["openssl", "genrsa", "-out", str(tmp_path / "tests" / "fixture.key"), "2048"],
131         check=True,
132         capture_output=True,
133         timeout=120,
134     )
135     (tmp_path / "cfg.json").write_text(

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

141 
142     assert report["gate"]["passed"] is False
143     assert report["score"]["per_category_count"]["secrets"] == 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

142     assert report["gate"]["passed"] is False
143     assert report["score"]["per_category_count"]["secrets"] == 0
144     assert report["score"]["overall"] == 5.0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

143     assert report["score"]["per_category_count"]["secrets"] == 0
144     assert report["score"]["overall"] == 5.0
145

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

157 
158     assert side, "the test-tree finding is missing from findings[]"
159     assert all(f["axis"] == "test tree" for f in side)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

158     assert side, "the test-tree finding is missing from findings[]"
159     assert all(f["axis"] == "test tree" for f in side)
160     assert all(f["scored"] is False for f in side)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

159     assert all(f["axis"] == "test tree" for f in side)
160     assert all(f["scored"] is False for f in side)
161

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

166 
167     assert report["score"]["per_category_count"]["code_vulnerabilities"] == 0
168

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

175 
176     assert tagged == report["reported_not_scored"]["test_tree"]["count"]
177

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

203     side = [f for f in report["findings"] if "test_q.py" in f["file_path"]]
204     assert side, "the finding vanished entirely"
205     assert all(f["suppressed"] for f in side), "fixture did not suppress"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

204     assert side, "the finding vanished entirely"
205     assert all(f["suppressed"] for f in side), "fixture did not suppress"
206     assert all(f["axis"] == "test tree" for f in side), (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

205     assert all(f["suppressed"] for f in side), "fixture did not suppress"
206     assert all(f["axis"] == "test tree" for f in side), (
207         "suppressing moved the finding to the primary axis: " + str([f["axis"] for f in side])
208     )
209     assert all(f["scored"] is False for f in side)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

208     )
209     assert all(f["scored"] is False for f in side)
210

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

228 
229     assert report["reported_not_scored"]["test_tree"]["count"] == 0
230     assert any(f["axis"] == "test tree" for f in report["findings"])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

229     assert report["reported_not_scored"]["test_tree"]["count"] == 0
230     assert any(f["axis"] == "test tree" for f in report["findings"])
231

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

243 
244     assert baseline.exists(), "no baseline was written"
245

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

252     side = [f for f in second["findings"] if "test_q.py" in f["file_path"]]
253     assert side, "the side-axis finding is absent, so this proves nothing"
254

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

255     still_new = [f for f in side if f["is_new"]]
256     assert still_new == [], (
257         "findings remain new after being baselined, so fail_on_new can never "
258         "be satisfied: " + str([f["file_path"] for f in still_new])
259     )
260

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

262     recorded = json.loads(baseline.read_text(encoding="utf-8"))
263     assert "test_q.py" in json.dumps(recorded), "the baseline omits the side-axis finding"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

33 
34     assert result.outcome is ScannerOutcome.NOT_APPLICABLE, (
35         f"osv-scanner reported {result.outcome.value} for a tree with no package "
36         f"sources: {result.reason}"
37     )

B404 — Consider possible security implications associated with the subprocess module. 🆕

25 import json
26 import subprocess
27 import sys

B603 — subprocess call - check for execution of untrusted input. 🆕

47     out = target / "report.json"
48     subprocess.run(
49         [
50             sys.executable,
51             "-m",
52             "secure_code_audit.cli",
53             str(target),
54             "--config",
55             str(target / "cfg.json"),
56             "--only-scanners",
57             "bandit,builtin_rules",
58             "--json-output",
59             str(out),
60             "--output",
61             str(target / "report.md"),
62             *extra,
63         ],
64         check=False,
65         capture_output=True,
66         text=True,
67         cwd=str(REPO),
68         timeout=120,
69     )
70     assert out.exists()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

69     )
70     assert out.exists()
71     return json.loads(out.read_text(encoding="utf-8"))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

77     first = _audit(project)
78     assert (project / "report.md").exists(), "fixture never wrote a report"
79

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82     from_report = [f for f in second["findings"] if "report.md" in f["file_path"]]
83     assert from_report == [], "the audit scored its own report: " + str(
84         [(f["file_path"], f["rule_id"]) for f in from_report]
85     )
86     assert len(second["findings"]) == len(first["findings"])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

85     )
86     assert len(second["findings"]) == len(first["findings"])
87

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

94 
95     assert second["score"]["overall"] == first["score"]["overall"]
96     assert second["score"]["per_category_count"] == first["score"]["per_category_count"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

95     assert second["score"]["overall"] == first["score"]["overall"]
96     assert second["score"]["per_category_count"] == first["score"]["per_category_count"]
97

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103 
104     assert [f for f in second["findings"] if "report.json" in f["file_path"]] == []
105

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

110     _audit(project, "--bump-baseline", "--baseline", str(baseline))
111     assert baseline.exists()
112

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

114 
115     assert [f for f in second["findings"] if "baseline.json" in f["file_path"]] == []
116

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122 
123     assert any("app.py" in f["file_path"] for f in report["findings"]), (
124         "the fixture's own source produced no findings, so this suite proves nothing"
125     )

B404 — Consider possible security implications associated with the subprocess module. 🆕

75 def _stub_exec(scanner, monkeypatch, stdout: str, code: int = 0):
76     from subprocess import CompletedProcess
77

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86     path = FIXTURES / name
87     assert path.exists(), f"missing capture: {path}"
88     return path.read_text(encoding="utf-8")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

96 
97     assert result.outcome is ScannerOutcome.COMPLETED
98     ids = {f.rule_id for f in result.findings}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

100     # fails instead of the adapter quietly reporting fewer findings.
101     assert {"node_md5", "node_insecure_random_generator", "node_tls_reject"} <= ids
102     assert all(f.line_start > 0 for f in result.findings)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

101     assert {"node_md5", "node_insecure_random_generator", "node_tls_reject"} <= ids
102     assert all(f.line_start > 0 for f in result.findings)
103     assert all(str(f.file_path).endswith(".js") for f in result.findings)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102     assert all(f.line_start > 0 for f in result.findings)
103     assert all(str(f.file_path).endswith(".js") for f in result.findings)
104

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

111 
112     assert result.outcome is ScannerOutcome.COMPLETED
113     cops = {f.rule_id for f in result.findings}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

113     cops = {f.rule_id for f in result.findings}
114     assert {"Security/Eval", "Security/MarshalLoad", "Security/YAMLLoad"} <= cops
115     # `convention` is RuboCop's own severity for these, and it must not land

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

116     # as INFORMATIONAL or the findings drop out of a severity gate.
117     assert all(f.severity is not Severity.INFORMATIONAL for f in result.findings)
118

B404 — Consider possible security implications associated with the subprocess module. 🆕

124     def fake_exec(args, **kwargs):
125         from subprocess import CompletedProcess
126

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

133 
134     assert result.outcome is ScannerOutcome.COMPLETED
135     assert result.findings, "gitleaks captured a real secret; the adapter parsed none"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

134     assert result.outcome is ScannerOutcome.COMPLETED
135     assert result.findings, "gitleaks captured a real secret; the adapter parsed none"
136     # The adapter namespaces gitleaks' own rule id under the scanner name.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

136     # The adapter namespaces gitleaks' own rule id under the scanner name.
137     assert {"gitleaks.github-pat", "gitleaks.generic-api-key"} <= {
138         f.rule_id for f in result.findings
139     }
140     # --redact is passed, so the capture holds no live secret and neither

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

141     # should the finding.
142     assert all("REDACTED" in (f.message or "") or f.code_snippet is None for f in result.findings)
143

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

152     raw = json.loads(_fixture("gosec-no-toolchain.json"))
153     assert raw["Issues"] == [], "the capture no longer demonstrates the empty-Issues case"
154     assert raw["Golang errors"], "the capture no longer carries the load failure"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

153     assert raw["Issues"] == [], "the capture no longer demonstrates the empty-Issues case"
154     assert raw["Golang errors"], "the capture no longer carries the load failure"
155

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

160 
161     assert result.outcome is ScannerOutcome.FAILED
162     assert "go command required" in result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

161     assert result.outcome is ScannerOutcome.FAILED
162     assert "go command required" in result.reason
163

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

173 
174     assert result.outcome is ScannerOutcome.COMPLETED
175     assert result.findings, "the capture holds 23 vulnerabilities; the adapter parsed none"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

174     assert result.outcome is ScannerOutcome.COMPLETED
175     assert result.findings, "the capture holds 23 vulnerabilities; the adapter parsed none"
176     assert all(f.rule_id.startswith("pip_audit.") for f in result.findings)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

175     assert result.findings, "the capture holds 23 vulnerabilities; the adapter parsed none"
176     assert all(f.rule_id.startswith("pip_audit.") for f in result.findings)
177     assert any("GHSA" in f.rule_id or "PYSEC" in f.rule_id for f in result.findings)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

176     assert all(f.rule_id.startswith("pip_audit.") for f in result.findings)
177     assert any("GHSA" in f.rule_id or "PYSEC" in f.rule_id for f in result.findings)
178     # Scope is what makes the result reproducible: which inputs were audited.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

178     # Scope is what makes the result reproducible: which inputs were audited.
179     assert result.scope is not None and "mode=requirements" in result.scope
180

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

195     for name in scanners.SCANNERS:
196         assert name in captured or name in SCANNERS_WITHOUT_A_REAL_CAPTURE, (
197             f"{name!r} has neither a real captured output fixture nor an entry "
198             f"in SCANNERS_WITHOUT_A_REAL_CAPTURE explaining why not"
199         )
200

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

205     ]
206     assert stale == [], (
207         f"these scanners now have real captures and should be removed from "
208         f"SCANNERS_WITHOUT_A_REAL_CAPTURE: {stale}"
209     )
210

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

216 
217     assert "/Users/" not in body or "user" in body, f"{path.name} leaks a home directory"
218     assert "/private/tmp" not in body, f"{path.name} leaks a local temp path"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

217     assert "/Users/" not in body or "user" in body, f"{path.name} leaks a home directory"
218     assert "/private/tmp" not in body, f"{path.name} leaks a local temp path"
219     # gitleaks is run with --redact; the others never see a secret. If a

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

227     for label, pattern in _SECRET_SHAPES.items():
228         assert not re.search(pattern, body), f"{path.name} contains an unredacted {label}"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

96     """The band table is a judgement call, so moving it must be deliberate."""
97     assert letter_grade(value) == expected
98

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

107 
108     assert report.overall == 5.0
109     assert report.letter == "A+"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

108     assert report.overall == 5.0
109     assert report.letter == "A+"
110     assert report.worst_category is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

109     assert report.letter == "A+"
110     assert report.worst_category is None
111

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122 
123     assert report.overall < 5.0
124     assert report.worst_category is Category.CODE_VULNERABILITIES

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

123     assert report.overall < 5.0
124     assert report.worst_category is Category.CODE_VULNERABILITIES
125

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

142     worst = min(report.per_category.values())
143     assert report.overall == worst
144     assert report.overall < sum(report.per_category.values()) / len(report.per_category)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

143     assert report.overall == worst
144     assert report.overall < sum(report.per_category.values()) / len(report.per_category)
145

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

162 
163     assert grades == sorted(grades, reverse=True), grades
164     # Informational findings — which is what every control finding is — must

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

166     # security defect.
167     assert grades[0] == 5.0
168

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

173 
174     assert score([live], 10_000).overall == score([live, muted], 10_000).overall
175     assert score([muted], 10_000).overall == 5.0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

174     assert score([live], 10_000).overall == score([live, muted], 10_000).overall
175     assert score([muted], 10_000).overall == 5.0
176     assert score([live, muted], 10_000).per_category_count[Category.CODE_VULNERABILITIES] == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

175     assert score([muted], 10_000).overall == 5.0
176     assert score([live, muted], 10_000).per_category_count[Category.CODE_VULNERABILITIES] == 1
177

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

190 
191     assert many <= one
192

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

212 
213     assert report.letter == "A+"
214     assert coverage.status is CoverageStatus.FAILED

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

213     assert report.letter == "A+"
214     assert coverage.status is CoverageStatus.FAILED
215

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

243     """
244     assert score([_finding(severity=severity)], loc_scanned=loc).overall == pytest.approx(expected)
245

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

255 
256     assert score(findings, loc_scanned=10_000).overall == pytest.approx(1.0836, abs=1e-4)
257

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

272 
273     assert report.letter == "A+"
274     assert report.overall < 5.0  # it did move, just not far enough to matter

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

273     assert report.letter == "A+"
274     assert report.overall < 5.0  # it did move, just not far enough to matter
275

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

306 
307     assert score([finding], loc_scanned=loc).letter == expected_letter
308

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

318 
319     assert secret < sink
320

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

392     """
393     assert SCORING_MODEL in _MODEL_DIGESTS, (
394         f"SCORING_MODEL is {SCORING_MODEL} with no recorded digest; add one"
395     )
396     assert _model_digest() == _MODEL_DIGESTS[SCORING_MODEL], (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

395     )
396     assert _model_digest() == _MODEL_DIGESTS[SCORING_MODEL], (
397         "the scoring model changed but SCORING_MODEL did not. A consumer "
398         "keeping a trend will splice the old and new models into one line "
399         "and call it knowledge. Bump SCORING_MODEL and add a digest row."
400     )
401

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

405     one model. Back-filling a 1 would assert they did."""
406     assert SCORING_MODEL >= 2
407     assert 1 not in _MODEL_DIGESTS

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

406     assert SCORING_MODEL >= 2
407     assert 1 not in _MODEL_DIGESTS

B404 — Consider possible security implications associated with the subprocess module. 🆕

24 import json
25 import subprocess
26 import sys

B603 — subprocess call - check for execution of untrusted input. 🆕

32 def _run(target, *extra: str):
33     return subprocess.run(
34         [
35             sys.executable,
36             "-m",
37             "secure_code_audit.cli",
38             str(target),
39             "--only-scanners",
40             "bandit,builtin_rules",
41             *extra,
42         ],
43         check=False,
44         capture_output=True,
45         text=True,
46         cwd=str(REPO),
47         timeout=120,
48     )
49

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

52     combined = result.stdout + result.stderr
53     assert "Traceback" not in combined, f"crashed rather than reporting:\n{combined[-800:]}"
54

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

64     _no_traceback(result)
65     assert result.returncode == 2
66     assert "does not exist" in result.stderr

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

65     assert result.returncode == 2
66     assert "does not exist" in result.stderr
67

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

71 
72     assert "typo-here" in result.stderr
73

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

87     _no_traceback(result)
88     assert result.returncode == 0
89

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

100 
101     assert report["score"]["loc_scanned"] == 2
102     assert report["score"]["overall"] == 0.0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

101     assert report["score"]["loc_scanned"] == 2
102     assert report["score"]["overall"] == 0.0
103

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

112 
113     assert (tmp_path / "secure-code-report.md").is_file()
114     assert (tmp_path / "secure-code-remediation-prompt.md").is_file()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

113     assert (tmp_path / "secure-code-report.md").is_file()
114     assert (tmp_path / "secure-code-remediation-prompt.md").is_file()
115

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

125 
126     assert any(f["rule_id"] == "B602" for f in report["findings"])
127

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

151     _no_traceback(result)
152     assert not marker.exists()
153

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

163     _no_traceback(result)
164     assert result.returncode == 0
165

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

172     _no_traceback(result)
173     assert result.returncode == 0
174

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

186         _no_traceback(result)
187         assert result.returncode == 0
188     finally:

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

219     # 3 Dockerfile lines + 4 Terraform lines.
220     assert report["score"]["loc_scanned"] == 7
221

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

231 
232     assert report["score"]["per_category"]["config_iac"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

91         argv = [str(tree), "--only-scanners", "bandit", "--json-output", str(out), *extra_argv]
92         assert cli.main(argv) == 0
93         return json.loads(out.read_text(encoding="utf-8"))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

99     """The premise. Re-labelling is only an attack because the weight is 0."""
100     assert SEVERITY_WEIGHT[Severity.INFORMATIONAL] == 0.0
101     assert SEVERITY_WEIGHT[Severity.HIGH] > 0.0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

100     assert SEVERITY_WEIGHT[Severity.INFORMATIONAL] == 0.0
101     assert SEVERITY_WEIGHT[Severity.HIGH] > 0.0
102

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

109     severities = {f["rule_id"]: f["severity"] for f in report["findings"]}
110     assert severities.get("B602") == "high", severities
111     assert report["score"]["overall"] < 1.0, report["score"]["overall"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

110     assert severities.get("B602") == "high", severities
111     assert report["score"]["overall"] < 1.0, report["score"]["overall"]
112

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122     severities = {f["rule_id"]: f["severity"] for f in report["findings"]}
123     assert severities.get("B602") == "high", (
124         "an in-tree config downgraded a HIGH finding to "
125         f"{severities.get('B602')!r}; the audited tree set its own grade"
126     )
127     assert report["score"]["overall"] < 1.0, (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

126     )
127     assert report["score"]["overall"] < 1.0, (
128         f"the grade rose to {report['score']['overall']} because the audited tree asked it to"
129     )
130

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

138     categories = {f["rule_id"]: f["category"] for f in report["findings"]}
139     assert categories.get("B602") == "code_vulnerabilities", categories
140

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

152     severities = {f["rule_id"]: f["severity"] for f in report["findings"]}
153     assert severities.get("B602") == "informational", (
154         "--trust-target-config was passed and the override was still ignored; "
155         "the operator's explicit assertion must be honoured"
156     )
157

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

171 
172     assert report["score"]["loc_scanned"] < 1_000, (
173         f"the audited tree declared {report['score']['loc_scanned']} lines of its own; "
174         "the denominator of its grade is not its own to set"
175     )
176     assert report["score"]["overall"] < 1.0, (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

175     )
176     assert report["score"]["overall"] < 1.0, (
177         f"the grade rose to {report['score']['overall']} on a declared line count"
178     )
179

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

190 
191     assert report["score"]["loc_scanned"] == 10_000_000, (
192         "--trust-target-config was passed and the declared line count was still "
193         "ignored; the operator's explicit assertion must be honoured"
194     )
195

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

222     )
223     assert all(getattr(loaded, key) for key in _GRADING_KEYS), (
224         f"this test must set every key in {_GRADING_KEYS} to something truthy, "
225         "or it proves nothing about the ones it left empty"
226     )
227

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

230     still_applied = [key for key in _GRADING_KEYS if getattr(refused, key)]
231     assert still_applied == [], (
232         f"{still_applied} are named in _GRADING_KEYS, so the operator is warned they "
233         "were ignored, and they were still applied. Derive the clearing from the "
234         "tuple rather than restating it."
235     )
236

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

250     severities = {f["rule_id"]: f["severity"] for f in report["findings"]}
251     assert severities.get("B602") == "informational", severities

B404 — Consider possible security implications associated with the subprocess module. 🆕

13 import json
14 import subprocess
15 import sys

B603 — subprocess call - check for execution of untrusted input. 🆕

35 
36     result = subprocess.run(
37         [
38             sys.executable,
39             "-m",
40             "secure_code_audit.cli",
41             str(tree),
42             "--only-scanners",
43             "bandit",
44             "--json-output",
45             str(out),
46         ],
47         cwd=tmp_path,
48         check=False,
49         capture_output=True,
50         text=True,
51         timeout=120,
52     )
53     assert out.exists(), result.stdout[-800:] + result.stderr[-800:]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

52     )
53     assert out.exists(), result.stdout[-800:] + result.stderr[-800:]
54     asserts = {

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

59 
60     assert asserts == {
61         "tests/test_app.py": True,
62         "src/tests/test_app.py": True,
63         # Outside the directory the entry names: still live.
64         "src/app.py": False,
65     }, asserts

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

87 
88     assert payload["score"]["verified_grade"] is None
89     # Neither human-facing artifact may present the letter unqualified.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

89     # Neither human-facing artifact may present the letter unqualified.
90     assert "not a verified grade" in markdown, markdown
91     assert "not a verified grade" in comment, comment

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

90     assert "not a verified grade" in markdown, markdown
91     assert "not a verified grade" in comment, comment
92     assert "Verified grade" not in markdown, markdown

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

91     assert "not a verified grade" in comment, comment
92     assert "Verified grade" not in markdown, markdown
93

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

104 
105     assert payload["score"]["verified_grade"] == report.letter
106     assert "Verified grade" in markdown, markdown

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

105     assert payload["score"]["verified_grade"] == report.letter
106     assert "Verified grade" in markdown, markdown
107     assert "not a verified grade" not in comment, comment

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

106     assert "Verified grade" in markdown, markdown
107     assert "not a verified grade" not in comment, comment
108

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119 
120     assert v.reasons
121     for reason in v.reasons:

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

121     for reason in v.reasons:
122         assert reason in markdown
123

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

136 
137         assert json_claims_grade == markdown_claims_grade == comment_claims_grade, (
138             f"{name}: json={json_claims_grade} markdown={markdown_claims_grade} "
139             f"comment={comment_claims_grade}"
140         )

B404 — Consider possible security implications associated with the subprocess module. 🆕

28 import os
29 import subprocess
30 from pathlib import Path

B607 — Starting a process with a partial executable path 🆕

49     # runs a commit-identity hook that rejects any author but the owner's.
50     subprocess.run(
51         ["git", "-C", str(tree), "-c", "user.email=t@example.invalid", "-c", "user.name=t", *args],
52         check=True,
53         capture_output=True,
54         env={**os.environ, "GIT_IDENTITY_OVERRIDE": "1"},
55         timeout=120,
56     )
57

B603 — subprocess call - check for execution of untrusted input. 🆕

49     # runs a commit-identity hook that rejects any author but the owner's.
50     subprocess.run(
51         ["git", "-C", str(tree), "-c", "user.email=t@example.invalid", "-c", "user.name=t", *args],
52         check=True,
53         capture_output=True,
54         env={**os.environ, "GIT_IDENTITY_OVERRIDE": "1"},
55         timeout=120,
56     )
57

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

89     base_argv = [str(tree), "--config", str(cfg), "--only-scanners", "bandit"]
90     assert cli.main([*base_argv, "--json-output", str(before)]) == 0
91     recorded = json.loads(before.read_text(encoding="utf-8"))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

91     recorded = json.loads(before.read_text(encoding="utf-8"))
92     assert [f["rule_id"] for f in recorded["findings"]] == ["B307"], (
93         "the fixture no longer produces the one finding the verification is about"
94     )
95

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

110 
111     assert audited["verify"]() == 0
112

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

113     out = capsys.readouterr().out
114     assert "work order verification" in out
115     assert "improved: 1 fixed" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

114     assert "work order verification" in out
115     assert "improved: 1 fixed" in out
116     assert "fixed      B307" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

115     assert "improved: 1 fixed" in out
116     assert "fixed      B307" in out
117     assert "app.py:2" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

116     assert "fixed      B307" in out
117     assert "app.py:2" in out
118

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

133 
134     assert audited["verify"]() == 1
135

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

136     out = capsys.readouterr().out
137     assert "SILENCED   B307" in out
138     assert "1 silenced rather than fixed" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

137     assert "SILENCED   B307" in out
138     assert "1 silenced rather than fixed" in out
139     assert "fixed      " not in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

138     assert "1 silenced rather than fixed" in out
139     assert "fixed      " not in out
140

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

152 
153     assert audited["verify"]() == 1
154

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

155     out = capsys.readouterr().out
156     assert "1 fixed" in out and "1 introduced" in out
157     assert "INTRODUCED B102" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

156     assert "1 fixed" in out and "1 introduced" in out
157     assert "INTRODUCED B102" in out
158     assert "other.py:2" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

157     assert "INTRODUCED B102" in out
158     assert "other.py:2" in out
159

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

167     """
168     assert audited["verify"]() == 1
169

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

170     out = capsys.readouterr().out
171     assert "still open B307" in out
172     assert "1 still open" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

171     assert "still open B307" in out
172     assert "1 still open" in out
173

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

186 
187     assert audited["verify"]() == 0
188

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

189     out = capsys.readouterr().out
190     assert "scope: EXCEEDED" in out
191     assert "collateral src/session.py" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

190     assert "scope: EXCEEDED" in out
191     assert "collateral src/session.py" in out
192     assert "secure-code-report" not in out, "the verifying run blamed the agent for our own output"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

191     assert "collateral src/session.py" in out
192     assert "secure-code-report" not in out, "the verifying run blamed the agent for our own output"
193

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

206 
207     assert audited["verify"]() == 1
208

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

209     out = capsys.readouterr().out
210     assert "scope: unknown" in out
211     assert "records no commit" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

210     assert "scope: unknown" in out
211     assert "records no commit" in out
212

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

225 
226     assert audited["verify"]() == 1
227

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

228     out = capsys.readouterr().out
229     assert "still open B307" in out
230     assert "INTRODUCED" not in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

229     assert "still open B307" in out
230     assert "INTRODUCED" not in out
231     assert "fixed      " not in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

230     assert "INTRODUCED" not in out
231     assert "fixed      " not in out
232

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

237 
238     assert audited["verify"]("--json") == 0
239

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

240     payload = json.loads(capsys.readouterr().out)
241     assert payload["passed"] is True
242     assert [f["rule_id"] for f in payload["fixed"]] == ["B307"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

241     assert payload["passed"] is True
242     assert [f["rule_id"] for f in payload["fixed"]] == ["B307"]
243     assert payload["introduced"] == [] and payload["suppressed"] == []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

242     assert [f["rule_id"] for f in payload["fixed"]] == ["B307"]
243     assert payload["introduced"] == [] and payload["suppressed"] == []
244

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

255 
256     assert audited["verify"](report=alien) == 2
257

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

268 
269     assert audited["verify"](report=broken) == 2
270     assert audited["verify"](report=audited["tree"] / "absent.json") == 2

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

269     assert audited["verify"](report=broken) == 2
270     assert audited["verify"](report=audited["tree"] / "absent.json") == 2

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82 
83     assert documents, "no agent guidance was located; the paths must have moved"
84     assert any(name.startswith("skills/") for name in documents)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

83     assert documents, "no agent guidance was located; the paths must have moved"
84     assert any(name.startswith("skills/") for name in documents)
85     assert any(name.startswith("instructions.py::") for name in documents)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

84     assert any(name.startswith("skills/") for name in documents)
85     assert any(name.startswith("instructions.py::") for name in documents)
86

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

130 
131     assert offenders == {}, (
132         f"{name} invokes {sorted(offenders)}, which this CLI does not accept:\n"
133         + "\n".join(f"    {line}" for line in offenders.values())
134     )
135

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

150         stale = [marker for marker in STALE_CHANGED_ONLY if marker in line.lower()]
151         assert not stale, (
152             f"{name} still describes --changed-only as {stale[0]!r}; it shipped "
153             f"in 0.12.0:\n    {line.strip()}"
154         )
155

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

170         for marker in STALE_CHANGED_ONLY:
171             assert marker not in lowered or "--changed-only" not in lowered.split(marker)[0][-400:]
172

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

181 
182     assert "--changed-only" in skill
183     assert "no grade" in flat, "the skill names the flag without saying it issues no grade"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

182     assert "--changed-only" in skill
183     assert "no grade" in flat, "the skill names the flag without saying it issues no grade"
184

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

210 
211     assert len(documents) >= 3, sorted(documents)
212     assert any("constraint" in text.lower() for text in documents.values()), (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

211     assert len(documents) >= 3, sorted(documents)
212     assert any("constraint" in text.lower() for text in documents.values()), (
213         "the work order's constraint list is not in the corpus"
214     )
215

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

225 
226     assert any(marker in reintroduced for marker in _DEBT_MARKERS)
227     assert not any(

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

226     assert any(marker in reintroduced for marker in _DEBT_MARKERS)
227     assert not any(
228         marker in "9. Add a test. Do not defer the test to a later change."
229         for marker in _DEBT_MARKERS
230     ), "the detector fires on the wording that replaced it"
231

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

252 
253     assert offenders == [], (
254         "shipped guidance carries a debt marker; say it without the literal, "
255         f"as constraint 9 now does: {offenders}"
256     )

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82 
83     assert kept == [advisory], (
84         "an exclusion deleted a dependency advisory. The finding is about the "
85         "pinned package; the lockfile is only the one file there is to point at."
86     )
87

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

97 
98     assert _kept(tree, [code], ["**/*.lock"]) == []
99

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

109 
110     assert _kept(tree, [secret], ["**/*.lock"]) == []
111

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

116 
117     assert _kept(tree, [advisory], []) == [advisory]
118

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

123 
124     assert _kept(tree, [vendored], ["vendor/"]) == []
125

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

138 
139     assert kept == [advisory], kept

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

37 
38     assert cov.unread_languages, cov
39     assert "gosec" in " ".join(cov.unread_languages)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

38     assert cov.unread_languages, cov
39     assert "gosec" in " ".join(cov.unread_languages)
40

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

48     unread = (payload or {}).get("unread_languages")
49     assert unread, f"the JSON dropped it: {payload}"
50     assert any("gosec" in entry for entry in unread), unread

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

49     assert unread, f"the JSON dropped it: {payload}"
50     assert any("gosec" in entry for entry in unread), unread
51

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

58 
59     assert "go" in text.lower()
60     assert "gosec" in text, "the remedy was not named"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

59     assert "go" in text.lower()
60     assert "gosec" in text, "the remedy was not named"
61

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

74 
75     assert "gosec" not in text
76     assert not payload.get("unread_languages")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

75     assert "gosec" not in text
76     assert not payload.get("unread_languages")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

80 
81     assert axes.get("documentation", []) == []
82     assert axes.get("test tree", []) == []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

81     assert axes.get("documentation", []) == []
82     assert axes.get("test tree", []) == []
83     assert len(primary) == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82     assert axes.get("test tree", []) == []
83     assert len(primary) == 1
84

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

93 
94     assert len(dependencies) == 1
95     assert scored == []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

94     assert len(dependencies) == 1
95     assert scored == []
96

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

104 
105     assert len(axes.get("documentation", [])) == 1
106

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

112 
113     assert len(axes.get("test tree", [])) == 1
114

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

134 
135     assert len(axes.get("documentation", [])) == 1, (
136         "the old ordering no longer reproduces the defect; this test has stopped pinning anything"
137     )

B404 — Consider possible security implications associated with the subprocess module. 🆕

3 from pathlib import Path
4 from subprocess import CompletedProcess
5

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

43 
44     assert loaded["abc"].bumped_by == "dev@example.com"
45     assert [finding.is_new for finding in marked] == [False, True]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

44     assert loaded["abc"].bumped_by == "dev@example.com"
45     assert [finding.is_new for finding in marked] == [False, True]
46     assert payload["operator"] == "dev@example.com"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

45     assert [finding.is_new for finding in marked] == [False, True]
46     assert payload["operator"] == "dev@example.com"
47

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

84 
85     assert payload["entries"]["abc"]["bumped_by"] == "first@example.com"
86     assert "skip" not in payload["entries"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

85     assert payload["entries"]["abc"]["bumped_by"] == "first@example.com"
86     assert "skip" not in payload["entries"]
87

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

97 
98     assert baseline.load(path) == {}
99     assert baseline._git_user_email() == "unknown"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

98     assert baseline.load(path) == {}
99     assert baseline._git_user_email() == "unknown"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

61     )
62     assert result.passed is False
63     return " ".join(result.reasons)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

71 def test_a_missing_baseline_is_absent(tmp_path):
72     assert state(tmp_path / "nope.json") is State.ABSENT
73

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

78 
79     assert state(path) is State.PRESENT
80

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86 
87     assert state(path) is State.UNREADABLE
88

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

94 
95     assert state(path) is State.UNREADABLE
96

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

105 
106     assert "no baseline exists yet" in reason
107     assert "since baseline" not in reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

106     assert "no baseline exists yet" in reason
107     assert "since baseline" not in reason
108

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

113 
114     assert "--bump-baseline" in reason
115

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119 
120     assert "could not be parsed" in reason
121     assert "--bump-baseline" not in reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

120     assert "could not be parsed" in reason
121     assert "--bump-baseline" not in reason
122

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

127 
128     assert reason == "1 new finding(s) since baseline"
129

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

135 
136     assert "since baseline" in " ".join(result.reasons)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

25     findings = _run(tmp_path)
26     assert any(f.rule_id == "sca.python.eval" for f in findings)
27

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

31     findings = _run(tmp_path)
32     assert not any(f.rule_id == "sca.python.eval" for f in findings)
33

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

40     findings = _run(tmp_path)
41     assert any(f.rule_id == "sca.python.yaml.unsafe_load" for f in findings)
42

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

46     findings = _run(tmp_path)
47     assert not any(f.rule_id == "sca.python.yaml.unsafe_load" for f in findings)
48

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

55     findings = _run(tmp_path)
56     assert any(f.rule_id == "sca.python.requests.verify_false" for f in findings)
57

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

64     findings = _run(tmp_path)
65     assert any(f.rule_id == "sca.python.subprocess.shell_true" for f in findings)
66

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

70     findings = _run(tmp_path)
71     assert not any(f.rule_id == "sca.python.subprocess.shell_true" for f in findings)
72

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

79     findings = _run(tmp_path)
80     assert any(f.rule_id == "sca.python.fstring_sql" for f in findings)
81

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

85     findings = _run(tmp_path)
86     assert not any(f.rule_id == "sca.python.fstring_sql" for f in findings)
87

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

94     findings = _run(tmp_path)
95     assert any(f.rule_id == "sca.python.hashlib.md5_sha1_security" for f in findings)
96

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102     findings = _run(tmp_path)
103     assert not any(f.rule_id == "sca.python.hashlib.md5_sha1_security" for f in findings)
104

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

113     findings = _run(tmp_path)
114     assert any(f.rule_id == "sca.web.dangerously_set_inner_html" for f in findings)
115

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

123     hits = [f for f in findings if f.rule_id == "sca.python.hashlib.md5_sha1_security"]
124     assert hits
125     assert hits[0].canonical_cwe == "CWE-327"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

124     assert hits
125     assert hits[0].canonical_cwe == "CWE-327"
126     assert hits[0].owasp_top10 == "A02"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

125     assert hits[0].canonical_cwe == "CWE-327"
126     assert hits[0].owasp_top10 == "A02"
127     assert hits[0].asvs_section is not None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

126     assert hits[0].owasp_top10 == "A02"
127     assert hits[0].asvs_section is not None
128     assert hits[0].nist_ssdf is not None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

127     assert hits[0].asvs_section is not None
128     assert hits[0].nist_ssdf is not None
129     assert hits[0].category.value == "crypto"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

128     assert hits[0].nist_ssdf is not None
129     assert hits[0].category.value == "crypto"
130

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

157 
158     assert [f.rule_id for f in findings if f.rule_id == "sca.python.eval"] == []
159

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

169 
170     assert len([f for f in findings if f.rule_id == "sca.python.eval"]) == 2

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

129 
130     assert summary["maintained"] == 2
131     assert summary["vulnerable"] == 2

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

130     assert summary["maintained"] == 2
131     assert summary["vulnerable"] == 2
132     # Each population's own min, median and max — not the pooled 2.0.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

132     # Each population's own min, median and max — not the pooled 2.0.
133     assert summary["maintained_overall"] == {
134         "min": 3.5,
135         "p25": 3.5,
136         "median": 4.0,
137         "p75": 4.5,
138         "max": 4.5,
139     }
140     assert summary["vulnerable_overall"] == {

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

139     }
140     assert summary["vulnerable_overall"] == {
141         "min": 0.0,
142         "p25": 0.0,
143         "median": 0.25,
144         "p75": 0.5,
145         "max": 0.5,
146     }
147     pooled = harness.percentiles([3.5, 4.5, 0.0, 0.5])["median"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

147     pooled = harness.percentiles([3.5, 4.5, 0.0, 0.5])["median"]
148     assert pooled == 2.0
149     assert summary["maintained_overall"]["median"] != pooled

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

148     assert pooled == 2.0
149     assert summary["maintained_overall"]["median"] != pooled
150     assert summary["vulnerable_overall"]["median"] != pooled

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

149     assert summary["maintained_overall"]["median"] != pooled
150     assert summary["vulnerable_overall"]["median"] != pooled
151

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

170 
171     assert summary["separation"] == pytest.approx(0.75), (
172         "separation is not the worst maintained grade minus the best "
173         "vulnerable one; a median, mean or extremes reading would give "
174         "3.125, 2.625 or 4.0"
175     )
176

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

191 
192     assert summary["separation"] == pytest.approx(-1.5)
193     assert summary["separation"] < 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

192     assert summary["separation"] == pytest.approx(-1.5)
193     assert summary["separation"] < 0
194

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

204 
205     assert summary["separation"] is None
206     assert summary["vulnerable"] == 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

205     assert summary["separation"] is None
206     assert summary["vulnerable"] == 0
207     assert summary["vulnerable_overall"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

206     assert summary["vulnerable"] == 0
207     assert summary["vulnerable_overall"] is None
208     # The half that *was* measured is still reported.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

208     # The half that *was* measured is still reported.
209     assert summary["maintained_overall"]["median"] == 4.0
210

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

221 
222     assert summary["maintained"] == 1
223     assert summary["vulnerable"] == 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

222     assert summary["maintained"] == 1
223     assert summary["vulnerable"] == 0
224     assert summary["maintained_overall"]["median"] == 3.5

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

223     assert summary["vulnerable"] == 0
224     assert summary["maintained_overall"]["median"] == 3.5
225

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

242 
243     assert summary["unexamined"] == ["webgoat"]
244     assert summary["vulnerable"] == 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

243     assert summary["unexamined"] == ["webgoat"]
244     assert summary["vulnerable"] == 0
245     assert summary["vulnerable_overall"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

244     assert summary["vulnerable"] == 0
245     assert summary["vulnerable_overall"] is None
246     assert summary["separation"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

245     assert summary["vulnerable_overall"] is None
246     assert summary["separation"] is None
247     # Still counted and still reported in the whole-corpus figure, just not

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

248     # in the one the bands are chosen from.
249     assert summary["measured"] == 2
250     assert summary["reported_overall"]["max"] == 5.0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

249     assert summary["measured"] == 2
250     assert summary["reported_overall"]["max"] == 5.0
251

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

265 
266     assert summary["examined"] == 0
267     assert summary["examined_overall"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

266     assert summary["examined"] == 0
267     assert summary["examined_overall"] is None
268     assert summary["examined_worst_normalized"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

267     assert summary["examined_overall"] is None
268     assert summary["examined_worst_normalized"] is None
269     assert summary["maintained_overall"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

268     assert summary["examined_worst_normalized"] is None
269     assert summary["maintained_overall"] is None
270     assert summary["vulnerable_overall"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

269     assert summary["maintained_overall"] is None
270     assert summary["vulnerable_overall"] is None
271     assert summary["separation"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

270     assert summary["vulnerable_overall"] is None
271     assert summary["separation"] is None
272     assert sorted(summary["unexamined"]) == ["gson", "webgoat"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

271     assert summary["separation"] is None
272     assert sorted(summary["unexamined"]) == ["gson", "webgoat"]
273

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

282 
283     assert summary["repositories"] == 0
284     assert summary["measured"] == 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

283     assert summary["repositories"] == 0
284     assert summary["measured"] == 0
285     assert summary["reported_overall"] == {}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

284     assert summary["measured"] == 0
285     assert summary["reported_overall"] == {}
286     assert "median" not in summary["reported_overall"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

285     assert summary["reported_overall"] == {}
286     assert "median" not in summary["reported_overall"]
287     assert summary["maintained_overall"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

286     assert "median" not in summary["reported_overall"]
287     assert summary["maintained_overall"] is None
288     assert summary["separation"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

287     assert summary["maintained_overall"] is None
288     assert summary["separation"] is None
289     assert summary["letters"] == {}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

288     assert summary["separation"] is None
289     assert summary["letters"] == {}
290

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

303 
304     assert summary["failed"] == ["broken"]
305     assert summary["repositories"] == 2

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

304     assert summary["failed"] == ["broken"]
305     assert summary["repositories"] == 2
306     assert summary["measured"] == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

305     assert summary["repositories"] == 2
306     assert summary["measured"] == 1
307     assert summary["reported_overall"]["median"] == 2.0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

306     assert summary["measured"] == 1
307     assert summary["reported_overall"]["median"] == 2.0
308     assert summary["letters"] == {"B": 1}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

307     assert summary["reported_overall"]["median"] == 2.0
308     assert summary["letters"] == {"B": 1}
309     assert "broken" not in summary["unexamined"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

308     assert summary["letters"] == {"B": 1}
309     assert "broken" not in summary["unexamined"]
310     assert "broken" not in [name for name, _letter in summary["maintained_letters"]]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

309     assert "broken" not in summary["unexamined"]
310     assert "broken" not in [name for name, _letter in summary["maintained_letters"]]
311

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

322 
323     assert summary["letters"] == {"B": 2, "F": 1}
324     assert sum(summary["letters"].values()) == summary["measured"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

323     assert summary["letters"] == {"B": 2, "F": 1}
324     assert sum(summary["letters"].values()) == summary["measured"]
325

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

339 
340     assert summary["maintained_letters"] == [("alpha", "F"), ("zeta", "A")]
341

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

382 
383     assert summary["measured"] == 2, "both repositories were audited and both are counted"
384     assert "narrow" in summary["unexamined"], (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

383     assert summary["measured"] == 2, "both repositories were audited and both are counted"
384     assert "narrow" in summary["unexamined"], (
385         "a repository the product refused to grade belongs with the unexamined, "
386         f"not in a distribution: {summary['unexamined']}"
387     )
388     assert summary["maintained_overall"]["median"] == 3.4, (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

387     )
388     assert summary["maintained_overall"]["median"] == 3.4, (
389         "the ungraded repository must not reach the distribution it would skew"
390     )
391     assert None not in dict(summary["maintained_letters"]).values()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

390     )
391     assert None not in dict(summary["maintained_letters"]).values()
392     assert None not in summary["letters"], summary["letters"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

391     assert None not in dict(summary["maintained_letters"]).values()
392     assert None not in summary["letters"], summary["letters"]
393

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

405 
406     assert summary["examined"] == 0
407     assert summary["maintained_overall"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

406     assert summary["examined"] == 0
407     assert summary["maintained_overall"] is None
408     assert summary["separation"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

407     assert summary["maintained_overall"] is None
408     assert summary["separation"] is None
409     assert summary["reported_overall"] == {}, summary["reported_overall"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

408     assert summary["separation"] is None
409     assert summary["reported_overall"] == {}, summary["reported_overall"]
410

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

543 
544     assert study.rc == 0
545     assert study.out["corpus"] == str(tmp_path / "corpus.json")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

544     assert study.rc == 0
545     assert study.out["corpus"] == str(tmp_path / "corpus.json")
546     assert study.out["config"] == str(study.config)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

545     assert study.out["corpus"] == str(tmp_path / "corpus.json")
546     assert study.out["config"] == str(study.config)
547     assert study.out["scanner_set"] == study.harness.SCANNER_SET

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

546     assert study.out["config"] == str(study.config)
547     assert study.out["scanner_set"] == study.harness.SCANNER_SET
548     assert [row["name"] for row in study.out["rows"]] == ["django"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

547     assert study.out["scanner_set"] == study.harness.SCANNER_SET
548     assert [row["name"] for row in study.out["rows"]] == ["django"]
549

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

563 
564     assert [call["config"] for call in study.audited] == [study.config, study.config]
565     # And each repository writes its own report, so one cannot read another's.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

565     # And each repository writes its own report, so one cannot read another's.
566     assert [call["report"].name for call in study.audited] == ["django.json", "flask.json"]
567     assert [call["target"].name for call in study.audited] == ["django", "flask"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

566     assert [call["report"].name for call in study.audited] == ["django.json", "flask.json"]
567     assert [call["target"].name for call in study.audited] == ["django", "flask"]
568

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

579 
580     assert [call["target"].name for call in study.audited] == ["flask"]
581     assert [row["name"] for row in study.out["rows"]] == ["flask"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

580     assert [call["target"].name for call in study.audited] == ["flask"]
581     assert [row["name"] for row in study.out["rows"]] == ["flask"]
582     assert study.out["summary"]["repositories"] == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

581     assert [row["name"] for row in study.out["rows"]] == ["flask"]
582     assert study.out["summary"]["repositories"] == 1
583

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

599     rows = {row["name"]: row for row in study.out["rows"]}
600     assert study.out["summary"]["failed"] == ["flask"]
601     assert "measure" not in rows["flask"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

600     assert study.out["summary"]["failed"] == ["flask"]
601     assert "measure" not in rows["flask"]
602     assert rows["flask"]["error"].startswith("RuntimeError: flask: fetch failed")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

601     assert "measure" not in rows["flask"]
602     assert rows["flask"]["error"].startswith("RuntimeError: flask: fetch failed")
603     assert "measure" in rows["django"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

602     assert rows["flask"]["error"].startswith("RuntimeError: flask: fetch failed")
603     assert "measure" in rows["django"]
604     assert "measure" in rows["httpx"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

603     assert "measure" in rows["django"]
604     assert "measure" in rows["httpx"]
605     assert [call["target"].name for call in study.audited] == ["django", "httpx"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

604     assert "measure" in rows["httpx"]
605     assert [call["target"].name for call in study.audited] == ["django", "httpx"]
606     assert "FAILED" in study.stdout

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

605     assert [call["target"].name for call in study.audited] == ["django", "httpx"]
606     assert "FAILED" in study.stdout
607

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

638 
639     assert study.out["summary"]["failed"] == ["flask"]
640     assert study.rc != 0, (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

639     assert study.out["summary"]["failed"] == ["flask"]
640     assert study.rc != 0, (
641         "a run with a failed repository reported success; its figures are "
642         "derived from a smaller corpus than the one it was given"
643     )
644

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

663 
664     assert study.out["summary"]["failed"] == ["django", "flask"]
665     assert study.rc != 0, "a run that measured nothing reported success"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

664     assert study.out["summary"]["failed"] == ["django", "flask"]
665     assert study.rc != 0, "a run that measured nothing reported success"
666

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

697 
698     assert study.rc != 0, "a --only typo audited nothing and reported success"
699     assert "djangoo" in study.stdout + study.stderr, (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

698     assert study.rc != 0, "a --only typo audited nothing and reported success"
699     assert "djangoo" in study.stdout + study.stderr, (
700         "the run must name the unmatched selector, not just fail"
701     )
702

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

714 
715     assert study.rc == 0
716     assert [row["name"] for row in study.out["rows"]] == ["django"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

715     assert study.rc == 0
716     assert [row["name"] for row in study.out["rows"]] == ["django"]
717

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

740 
741     assert study.out["summary"]["failed"] == [], (
742         f"an audit that completed and reported ungraded was recorded as failed: "
743         f"{study.out['summary']['failed']}"
744     )
745     assert study.rc == 0, (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

744     )
745     assert study.rc == 0, (
746         f"the study exited {study.rc} because one repository was ungraded; stderr: {study.stderr}"
747     )
748     assert "TypeError" not in study.stdout + study.stderr

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

747     )
748     assert "TypeError" not in study.stdout + study.stderr
749     assert "narrow" in study.out["summary"]["unexamined"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

748     assert "TypeError" not in study.stdout + study.stderr
749     assert "narrow" in study.out["summary"]["unexamined"]
750     assert study.out["summary"]["measured"] == 2

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

749     assert "narrow" in study.out["summary"]["unexamined"]
750     assert study.out["summary"]["measured"] == 2
751

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

762 
763     assert study.out["summary"]["failed"] == []
764     assert study.rc == 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

763     assert study.out["summary"]["failed"] == []
764     assert study.rc == 0
765

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

790 
791     assert "Maintained median: 4.0" in study.stdout
792     assert "Vulnerable-by-design median: 0.25" in study.stdout

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

791     assert "Maintained median: 4.0" in study.stdout
792     assert "Vulnerable-by-design median: 0.25" in study.stdout
793     # The pooled median of the same four grades.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

793     # The pooled median of the same four grades.
794     assert "2.0 →" not in study.stdout
795

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

808 
809     assert "Separation: -1.50" in study.stdout
810     assert "THE POPULATIONS OVERLAP" in study.stdout

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

809     assert "Separation: -1.50" in study.stdout
810     assert "THE POPULATIONS OVERLAP" in study.stdout
811

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

821 
822     assert "Separation: +3.00" in study.stdout
823     assert "do not overlap" in study.stdout

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

822     assert "Separation: +3.00" in study.stdout
823     assert "do not overlap" in study.stdout
824     assert "THE POPULATIONS OVERLAP" not in study.stdout

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

823     assert "do not overlap" in study.stdout
824     assert "THE POPULATIONS OVERLAP" not in study.stdout
825

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

844 
845     assert study.rc == 0
846     assert "no distribution to calibrate from" in study.stdout

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

845     assert study.rc == 0
846     assert "no distribution to calibrate from" in study.stdout
847     assert "Maintained median" not in study.stdout

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

846     assert "no distribution to calibrate from" in study.stdout
847     assert "Maintained median" not in study.stdout
848     assert "Separation" not in study.stdout

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

847     assert "Maintained median" not in study.stdout
848     assert "Separation" not in study.stdout
849     # The measurements are still written down; only the headline is withheld.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

849     # The measurements are still written down; only the headline is withheld.
850     assert study.out["summary"]["examined"] == 0
851     assert sorted(study.out["summary"]["unexamined"]) == ["commons-lang", "gson"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

850     assert study.out["summary"]["examined"] == 0
851     assert sorted(study.out["summary"]["unexamined"]) == ["commons-lang", "gson"]
852

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

869 
870     assert "1 of 3 repositories were not examined" in study.stdout
871     assert "UNEXAMINED" in study.stdout, "the per-repository line did not flag it either"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

870     assert "1 of 3 repositories were not examined" in study.stdout
871     assert "UNEXAMINED" in study.stdout, "the per-repository line did not flag it either"
872     assert study.out["summary"]["unexamined"] == ["gson"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

871     assert "UNEXAMINED" in study.stdout, "the per-repository line did not flag it either"
872     assert study.out["summary"]["unexamined"] == ["gson"]
873

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

890     rows = {row["name"]: row for row in study.out["rows"]}
891     assert rows["django"]["examined"] is True
892     assert rows["gson"]["examined"] is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

891     assert rows["django"]["examined"] is True
892     assert rows["gson"]["examined"] is False
893

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

922     first = _run(tmp_path, monkeypatch, capsys, entries, payloads, work=work)
923     assert set(first.out["summary"]["variants"]["per_repository"]) == {"django", "flask"}
924

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

934 
935     assert [row["name"] for row in second.out["rows"]] == ["flask"]
936     assert set(second.out["summary"]["variants"]["per_repository"]) == {"flask"}, (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

935     assert [row["name"] for row in second.out["rows"]] == ["flask"]
936     assert set(second.out["summary"]["variants"]["per_repository"]) == {"flask"}, (
937         "the variants block reports repositories this run never audited"
938     )

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

87 def test_the_harness_exists_where_the_study_says_it_does():
88     assert HARNESS.exists(), "the calibration harness has moved; the study cannot be re-run"
89

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

105                     finding = _finding(severity, confidence, category, top25)
106                     assert harness._finding_score(_as_json(finding)) == pytest.approx(
107                         finding_score(finding)
108                     ), f"{severity.value}/{confidence.value}/{category.value}/top25={top25}"
109                     checked += 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

110 
111     assert checked == len(Severity) * len(Confidence) * len(Category) * 2
112     assert checked > 100, "the enumeration collapsed; this would pass vacuously"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

111     assert checked == len(Severity) * len(Confidence) * len(Category) * 2
112     assert checked > 100, "the enumeration collapsed; this would pass vacuously"
113

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119 
120     assert harness._finding_score(payload) == 0.0
121

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

147 
148     assert measured["unclamped_overall"] < 0.0, measured
149     assert measured["reported_overall"] == 0.0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

148     assert measured["unclamped_overall"] < 0.0, measured
149     assert measured["reported_overall"] == 0.0
150     assert measured["worst_normalized"] > 10.0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

149     assert measured["reported_overall"] == 0.0
150     assert measured["worst_normalized"] > 10.0
151

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

168 
169         assert actual["code_vulnerabilities"] == pytest.approx(expected), count
170

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

180     )["code_vulnerabilities"]
181     assert fifty < one * 50 * 0.5, "the harness is not saturating at all"
182

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

195 
196     assert distinct > same
197

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

222 
223     assert measured["normalized"]["code_vulnerabilities"] == pytest.approx(
224         normalize(subtotal, 20_000), abs=1e-3
225     )
226     assert measured["unclamped_overall"] == pytest.approx(

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

225     )
226     assert measured["unclamped_overall"] == pytest.approx(
227         5.0 - normalize(subtotal, 20_000) * GRADE_SLOPE, abs=1e-3
228     )
229

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

233 
234     assert harness.percentiles([]) == {}
235     single = harness.percentiles([2.0])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

235     single = harness.percentiles([2.0])
236     assert single["min"] == single["median"] == single["max"] == 2.0
237

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

259 
260     assert not report.exists(), "the stale report survived a failed audit"
261

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

285 
286     assert harness.examined(_row("python", ["bandit", "gitleaks"])) is True
287     assert harness.examined(_row("javascript", ["njsscan"])) is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

286     assert harness.examined(_row("python", ["bandit", "gitleaks"])) is True
287     assert harness.examined(_row("javascript", ["njsscan"])) is True
288     assert harness.examined(_row("ruby", ["rubocop"])) is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

287     assert harness.examined(_row("javascript", ["njsscan"])) is True
288     assert harness.examined(_row("ruby", ["rubocop"])) is True
289

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

300 
301     assert harness.examined(_row("javascript", ["gitleaks", "semgrep"])) is False
302     assert harness.examined(_row("ruby", ["gitleaks", "semgrep"])) is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

301     assert harness.examined(_row("javascript", ["gitleaks", "semgrep"])) is False
302     assert harness.examined(_row("ruby", ["gitleaks", "semgrep"])) is False
303

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

308 
309     assert harness.examined(_row("go", ["gitleaks", "semgrep", "bandit"])) is False
310     assert harness.examined(_row("go", ["gosec"])) is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

309     assert harness.examined(_row("go", ["gitleaks", "semgrep", "bandit"])) is False
310     assert harness.examined(_row("go", ["gosec"])) is True
311

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

317 
318     assert harness.examined(_row("java", ["gitleaks", "semgrep", "bandit"])) is False
319

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

336 
337     assert summary["examined"] == 2
338     assert sorted(summary["unexamined"]) == ["r", "r"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

337     assert summary["examined"] == 2
338     assert sorted(summary["unexamined"]) == ["r", "r"]
339     assert summary["examined_overall"]["median"] == 2.0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

338     assert sorted(summary["unexamined"]) == ["r", "r"]
339     assert summary["examined_overall"]["median"] == 2.0
340     # The whole-corpus figure is still reported, just not the one to calibrate from.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

340     # The whole-corpus figure is still reported, just not the one to calibrate from.
341     assert summary["reported_overall"]["median"] == 4.0
342

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

352 
353     assert summary["examined"] == 0
354     assert summary["examined_overall"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

353     assert summary["examined"] == 0
354     assert summary["examined_overall"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

65     payload = json.loads(json_report.read_text(encoding="utf-8"))
66     assert exit_code == 1
67     assert payload["gate"]["passed"] is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

66     assert exit_code == 1
67     assert payload["gate"]["passed"] is False
68     assert payload["coverage"]["status"] == "failed"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

67     assert payload["gate"]["passed"] is False
68     assert payload["coverage"]["status"] == "failed"
69     assert payload["coverage"]["scanners"][0]["outcome"] == "unavailable"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

68     assert payload["coverage"]["status"] == "failed"
69     assert payload["coverage"]["scanners"][0]["outcome"] == "unavailable"
70

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

81 
82     assert exit_code == 2
83     assert "configuration file does not exist" in capsys.readouterr().err

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82     assert exit_code == 2
83     assert "configuration file does not exist" in capsys.readouterr().err
84

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

101 
102     assert exit_code == 0
103

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

105 def test_cli_rejects_multiple_roots_instead_of_ignoring_them(tmp_path):
106     assert main([str(tmp_path / "one"), str(tmp_path / "two")]) == 2
107

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

109 def test_repository_policy_paths_resolve_from_scan_root(tmp_path):
110     assert (
111         _under_root(tmp_path, ".policy/ignore.yaml") == (tmp_path / ".policy/ignore.yaml").resolve()
112     )
113

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

154 
155     assert main(argv) == 2
156     assert not destination.exists() or destination.read_text(encoding="utf-8") == "do not overwrite"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

155     assert main(argv) == 2
156     assert not destination.exists() or destination.read_text(encoding="utf-8") == "do not overwrite"
157

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

164 
165     assert (
166         main(
167             [
168                 str(target),
169                 "--only-scanners",
170                 "builtin_rules",
171                 "--output",
172                 str(operator_output),
173             ]
174         )
175         == 0
176     )
177     assert operator_output.is_file()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

176     )
177     assert operator_output.is_file()
178

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

192 
193     assert BanditScanner().scope(scanner_config) is None
194     assert PipAuditScanner().scope(scanner_config) == (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

193     assert BanditScanner().scope(scanner_config) is None
194     assert PipAuditScanner().scope(scanner_config) == (
195         "mode=requirements; inputs=requirements-audit.txt; extra_args=--no-deps"
196     )
197

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

204 
205     assert exit_code == 1
206     assert "required scanners unavailable: trivy" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

205     assert exit_code == 1
206     assert "required scanners unavailable: trivy" in out
207     assert not (tmp_path / "secure-code-report.md").exists()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

206     assert "required scanners unavailable: trivy" in out
207     assert not (tmp_path / "secure-code-report.md").exists()
208

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

215 
216     assert exit_code == 1
217     assert payload["ready"] is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

216     assert exit_code == 1
217     assert payload["ready"] is False
218     assert payload["required_unresolved"] == ["trivy"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

217     assert payload["ready"] is False
218     assert payload["required_unresolved"] == ["trivy"]
219     row = next(r for r in payload["scanners"] if r["scanner"] == "trivy")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

219     row = next(r for r in payload["scanners"] if r["scanner"] == "trivy")
220     assert "brew install trivy" in row["remedy"]
221     assert "--sarif-import" in row["remedy"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

220     assert "brew install trivy" in row["remedy"]
221     assert "--sarif-import" in row["remedy"]
222

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

238 
239     assert exit_code == 1
240     assert "not enabled in this configuration" in capsys.readouterr().out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

239     assert exit_code == 1
240     assert "not enabled in this configuration" in capsys.readouterr().out
241

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

281 
282     assert exit_code == 0
283     assert payload["coverage"]["status"] == "complete"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

282     assert exit_code == 0
283     assert payload["coverage"]["status"] == "complete"
284     trivy = next(s for s in payload["coverage"]["scanners"] if s["name"] == "trivy")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

284     trivy = next(s for s in payload["coverage"]["scanners"] if s["name"] == "trivy")
285     assert trivy["scope"] == "sarif-import:trivy.sarif"
286

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

310 
311     assert exit_code == 1
312

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

314 def test_sarif_import_name_prefix_is_split_from_paths_that_contain_equals(tmp_path):
315     assert _parse_sarif_import("trivy=out.sarif") == ("trivy", Path("out.sarif"))
316     assert _parse_sarif_import("./a=b/out.sarif") == (None, Path("./a=b/out.sarif"))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

315     assert _parse_sarif_import("trivy=out.sarif") == ("trivy", Path("out.sarif"))
316     assert _parse_sarif_import("./a=b/out.sarif") == (None, Path("./a=b/out.sarif"))
317     assert _parse_sarif_import("out.sarif") == (None, Path("out.sarif"))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

316     assert _parse_sarif_import("./a=b/out.sarif") == (None, Path("./a=b/out.sarif"))
317     assert _parse_sarif_import("out.sarif") == (None, Path("out.sarif"))
318

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

338 
339     assert exit_code == 2
340     assert "no gate is configured" in capsys.readouterr().err

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

339     assert exit_code == 2
340     assert "no gate is configured" in capsys.readouterr().err
341

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

352 
353     assert exit_code == 2
354     assert "no gate is configured" in capsys.readouterr().err

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

353     assert exit_code == 2
354     assert "no gate is configured" in capsys.readouterr().err
355

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

364     # Not a usage error (2) — the gate runs and trips on the HIGH finding (1).
365     assert main([str(target), "--config", str(config), "--fail-on-gate"]) == 1
366

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

372 
373     assert main([str(target), "--config", str(config)]) == 0
374

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

418     # quality nobody has.
419     assert isinstance(looked["overall"], float)
420     assert did_not_look["overall"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

419     assert isinstance(looked["overall"], float)
420     assert did_not_look["overall"] is None
421     assert did_not_look["letter"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

420     assert did_not_look["overall"] is None
421     assert did_not_look["letter"] is None
422

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

423     # The grade is withheld in both, because neither run declared a scanner set.
424     assert looked["verified_grade"] is None
425     assert did_not_look["verified_grade"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

424     assert looked["verified_grade"] is None
425     assert did_not_look["verified_grade"] is None
426     assert "require_scanners" in " ".join(did_not_look["evidence_reasons"])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

425     assert did_not_look["verified_grade"] is None
426     assert "require_scanners" in " ".join(did_not_look["evidence_reasons"])
427     assert "no category could be measured" in " ".join(did_not_look["evidence_reasons"])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

426     assert "require_scanners" in " ".join(did_not_look["evidence_reasons"])
427     assert "no category could be measured" in " ".join(did_not_look["evidence_reasons"])
428

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

430     # a reader sees. A 5.0 there means "clean"; null means "nobody looked".
431     assert did_not_look["per_category"][Category.CODE_VULNERABILITIES.value] is None
432     assert looked["per_category"][Category.CODE_VULNERABILITIES.value] is not None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

431     assert did_not_look["per_category"][Category.CODE_VULNERABILITIES.value] is None
432     assert looked["per_category"][Category.CODE_VULNERABILITIES.value] is not None
433

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

461 
462     assert payload["verified_grade"] == payload["letter"]
463     assert payload["evidence_status"] == "complete"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

462     assert payload["verified_grade"] == payload["letter"]
463     assert payload["evidence_status"] == "complete"
464     assert payload["evidence_reasons"] == []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

463     assert payload["evidence_status"] == "complete"
464     assert payload["evidence_reasons"] == []
465

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

491     # The target's own policy, not the caller's.
492     assert payload["coverage"]["required"] == []
493     assert "trivy" not in json.dumps(payload["coverage"])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

492     assert payload["coverage"]["required"] == []
493     assert "trivy" not in json.dumps(payload["coverage"])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

28 
29     assert exit_code == 2
30     assert "not a repository to audit" in capsys.readouterr().err

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

29     assert exit_code == 2
30     assert "not a repository to audit" in capsys.readouterr().err
31

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

36 
37     assert "secure-code-agent /some/repo" in capsys.readouterr().err
38

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

50 
51     assert exit_code == 0
52     assert list(tmp_path.iterdir()), "nothing was written"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

51     assert exit_code == 0
52     assert list(tmp_path.iterdir()), "nothing was written"
53

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

67 
68     assert cli.main(["--target", "/some/repo"]) == 2
69

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86 
87     assert action.help, f"{flag} has no help text"
88     assert "--init-agent-standards" in action.help, (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

87     assert action.help, f"{flag} has no help text"
88     assert "--init-agent-standards" in action.help, (
89         f"{flag} does not say which mode it belongs to, which is how --target "
90         f"came to read as 'the repository to audit'"
91     )

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

46 
47     assert entry is not None, f"{rule_id} has no curated entry, so it falls back to Bandit's CWE"
48     assert entry.canonical_cwe == "CWE-95"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

47     assert entry is not None, f"{rule_id} has no curated entry, so it falls back to Bandit's CWE"
48     assert entry.canonical_cwe == "CWE-95"
49

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

55 
56     assert entry is not None and entry.canonical_cwe == "CWE-78"
57

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63 
64     assert bandit is not None and builtin is not None
65     assert bandit.canonical_cwe == builtin.canonical_cwe

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

64     assert bandit is not None and builtin is not None
65     assert bandit.canonical_cwe == builtin.canonical_cwe
66

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

101 
102     assert len(merged) == 1
103     assert merged[0].corroborated_by

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102     assert len(merged) == 1
103     assert merged[0].corroborated_by
104

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

115 
116     assert len(unmerged) == 2
117

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

129     """
130     assert "CWE-95" not in CWE_TOP25_2025, "this test is about the child, not the list"
131     assert is_top25("CWE-95") is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

130     assert "CWE-95" not in CWE_TOP25_2025, "this test is about the child, not the list"
131     assert is_top25("CWE-95") is True
132

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

135     """The parent map must widen membership, not dissolve it."""
136     assert is_top25("CWE-489") is False
137     assert is_top25(None) is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

136     assert is_top25("CWE-489") is False
137     assert is_top25(None) is False
138

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

140 def test_a_listed_cwe_is_unaffected():
141     assert is_top25("CWE-89") is True
142     assert is_top25("CWE-78") is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

141     assert is_top25("CWE-89") is True
142     assert is_top25("CWE-78") is True

B404 — Consider possible security implications associated with the subprocess module. 🆕

33 import re
34 import subprocess
35 import sys

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

109     findings, axes, alerts = _population()
110     assert sarif._SIDE_AXES and set(sarif._SIDE_AXES) <= set(axes.values())
111     assert GATED_FROM_ANY_AXIS, "no escalated category; the exception would go untested"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

110     assert sarif._SIDE_AXES and set(sarif._SIDE_AXES) <= set(axes.values())
111     assert GATED_FROM_ANY_AXIS, "no escalated category; the exception would go untested"
112     assert any(f.suppressed for f in findings)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

111     assert GATED_FROM_ANY_AXIS, "no escalated category; the exception would go untested"
112     assert any(f.suppressed for f in findings)
113     assert alerts < {f.rule_id for f in findings}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

112     assert any(f.suppressed for f in findings)
113     assert alerts < {f.rule_id for f in findings}
114

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

125     suppressed = {r["ruleId"] for r in _results(record) if r.get("suppressions")}
126     assert suppressed - alerts, "nothing was left out; the check would be vacuous"
127

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

128     uploaded = {r["ruleId"] for r in _results(upload)}
129     assert uploaded == alerts, (
130         f"missing from code scanning: {sorted(alerts - uploaded)}; "
131         f"alerting on what should not: {sorted(uploaded - alerts)}"
132     )
133     assert not any(r.get("suppressions") for r in _results(upload))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

132     )
133     assert not any(r.get("suppressions") for r in _results(upload))
134     # A rule with no result left would still describe a check nobody reported.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

134     # A rule with no result left would still describe a check nobody reported.
135     assert {rule["id"] for rule in upload["runs"][0]["tool"]["driver"]["rules"]} == alerts
136

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

145         upload = sarif.emit([secret], None, lambda _f, axis=axis: axis, alerts_only=True)
146         assert [r["ruleId"] for r in _results(upload)] == ["R-fixture_key"], axis
147

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

153 
154     assert len(_results(record)) == len(findings)
155

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

163 
164     assert upload["version"] == "2.1.0" and _results(upload) == []
165

B603 — subprocess call - check for execution of untrusted input. 🆕

186 
187     result = subprocess.run(
188         [
189             sys.executable,
190             "-m",
191             "secure_code_audit.cli",
192             str(tree),
193             "--only-scanners",
194             "bandit",
195             "--sarif-output",
196             str(record),
197             "--code-scanning-sarif-output",
198             str(upload),
199         ],
200         cwd=tmp_path,
201         check=False,
202         capture_output=True,
203         text=True,
204         timeout=120,
205     )
206     assert upload.exists(), result.stdout[-800:] + result.stderr[-800:]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

205     )
206     assert upload.exists(), result.stdout[-800:] + result.stderr[-800:]
207

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

218     kept = located(record)
219     assert ("B101", "tests/test_app.py", True) in kept, kept
220     assert ("B101", "app.py", True) in kept, kept

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

219     assert ("B101", "tests/test_app.py", True) in kept, kept
220     assert ("B101", "app.py", True) in kept, kept
221     assert ("B602", "app.py", False) in kept, kept

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

220     assert ("B101", "app.py", True) in kept, kept
221     assert ("B602", "app.py", False) in kept, kept
222

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

223     sent = located(upload)
224     assert ("B602", "app.py", False) in sent, sent
225     assert not {entry for entry in sent if entry[2] or entry[0] == "B101"}, sent

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

224     assert ("B602", "app.py", False) in sent, sent
225     assert not {entry for entry in sent if entry[2] or entry[0] == "B101"}, sent
226

B603 — subprocess call - check for execution of untrusted input. 🆕

236 
237     subprocess.run(
238         [
239             sys.executable,
240             "-m",
241             "secure_code_audit.cli",
242             str(tree),
243             "--config",
244             str(config),
245             "--only-scanners",
246             "bandit",
247         ],
248         cwd=tmp_path,
249         check=False,
250         capture_output=True,
251         timeout=120,
252     )
253

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

253 
254     assert (tree / "alerts.sarif").exists()
255

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

284     steps = _upload_steps()
285     assert {name for name, _ in steps} >= {"action.yml", "ci.yml"}, steps
286     wrong = [(name, value) for name, value in steps if "code-scanning" not in value]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

286     wrong = [(name, value) for name, value in steps if "code-scanning" not in value]
287     assert not wrong, f"these upload the record, which GitHub turns into alerts wholesale: {wrong}"
288

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

293     name = DEFAULT_OUTPUTS["code_scanning_sarif_path"]
294     assert f"**/{name}" in DEFAULT_EXCLUDES

B404 — Consider possible security implications associated with the subprocess module. 🆕

10 
11 import subprocess
12 import sys

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

56 
57     assert _Probe().command == ("/usr/bin/probe-bin",)
58

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

64 
65     assert probe.command == ()
66     assert not probe.is_available()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

65     assert probe.command == ()
66     assert not probe.is_available()
67

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

76 
77     assert probe.command == ()
78     assert calls == []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

77     assert probe.command == ()
78     assert calls == []
79

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

96 
97     assert probe.command == (str(tool),)
98

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

106 
107     assert probe.command == (sys.executable, "-m", "probe_mod")
108

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

116 
117     assert probe.command == ()
118

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

130 
131     assert probe.command == (str(tool),)
132

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

143 
144     assert probe.command == (str(tool.resolve()), "--flag", "v")
145

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

153 
154     assert probe.command == ()
155

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

164 
165     assert probe.command == ()
166

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

175 
176     assert probe.command == ()
177

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

185 
186     assert probe.command == (str(tool.resolve()),)
187

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

202 
203     assert probe.command == (str(tool.resolve()),)
204

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

220 
221     assert probe.command == ()
222     assert not probe.is_available()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

221     assert probe.command == ()
222     assert not probe.is_available()
223

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

235 
236     assert probe.command == (str(tool),)
237

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

252 
253     assert probe.command == ()
254

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

273 
274     assert probe.ignored_command is True
275     assert probe.command == (str(default_tool),)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

274     assert probe.ignored_command is True
275     assert probe.command == (str(default_tool),)
276

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

288 
289     assert probe.ignored_command is False
290     assert probe.command == (str(chosen.resolve()),)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

289     assert probe.ignored_command is False
290     assert probe.command == (str(chosen.resolve()),)
291

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

298 
299     assert probe.ignored_command is False
300

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

321 
322     assert probe.binary_version() == "1.2.3"
323     assert seen[0][0] == ["/tools/probe", "wrap", "-V"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

322     assert probe.binary_version() == "1.2.3"
323     assert seen[0][0] == ["/tools/probe", "wrap", "-V"]
324     assert seen[0][1]["timeout"] == 10

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

323     assert seen[0][0] == ["/tools/probe", "wrap", "-V"]
324     assert seen[0][1]["timeout"] == 10
325

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

331 
332     assert probe.binary_version() is None
333     assert seen == []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

332     assert probe.binary_version() is None
333     assert seen == []
334

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

341 
342     assert probe.binary_version() is None
343

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

351 
352     assert probe.binary_version() == "njsscan 0.4.3"
353

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

357 
358     assert probe.binary_version() == "tool 9.9"
359

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

363 
364     assert probe.binary_version() == "out 1"
365

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

369 
370     assert probe.binary_version() is None
371

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

380 
381     assert probe.binary_version() is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

75 
76     assert str(path) in str(caught.value)
77

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

88 
89     assert load().gates == {"fail_on_new": True}
90

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

106 
107     assert gates == {"fail_on_severity": ["critical"]}
108     assert "fail_on_new" not in gates

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

107     assert gates == {"fail_on_severity": ["critical"]}
108     assert "fail_on_new" not in gates
109

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

117 
118     assert load().gates == {}
119

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

141 
142     assert cfg.outputs["prompt_path"] is None
143

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

149         cfg = _cfg(tmp_path, {"version": 1, "outputs": {key: None}})
150         assert cfg.outputs[key] is None, key
151         others = [k for k in DEFAULT_OUTPUTS if k != key]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

151         others = [k for k in DEFAULT_OUTPUTS if k != key]
152         assert all(cfg.outputs[k] is not None for k in others), (
153             f"disabling {key} disabled something else too"
154         )
155

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

57 
58     assert schema_keys == set(_KNOWN_KEYS), {
59         "only in schema": sorted(schema_keys - set(_KNOWN_KEYS)),
60         "only in loader": sorted(set(_KNOWN_KEYS) - schema_keys),
61     }
62     # Both must be closed, or the agreement above proves nothing.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

62     # Both must be closed, or the agreement above proves nothing.
63     assert SCHEMA.get("additionalProperties") is False
64

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

97 
98     assert schema_paths == loader_paths, {
99         "only in schema": sorted(schema_paths - loader_paths),
100         "only in loader": sorted(loader_paths - schema_paths),
101     }
102     assert SCHEMA["properties"]["paths"].get("additionalProperties") is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

101     }
102     assert SCHEMA["properties"]["paths"].get("additionalProperties") is False
103

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

109 
110     assert code_fields == schema_fields, {
111         "only in schema": sorted(schema_fields - code_fields),
112         "only in dataclass": sorted(code_fields - schema_fields),
113     }
114

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

133             continue
134         assert field.name in _KNOWN_KEYS, (
135             f"Config.{field.name} has no configuration key; either add it to "
136             f"_KNOWN_KEYS and the schema, or mark it loader-populated here"
137         )
138

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

152 
153     assert shipped, "there is no data directory to ship"
154     for path in shipped:

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

155         relative = f"data/{path.name}"
156         assert any(fnmatch(relative, glob) for glob in globs), (
157             f"{relative} exists but no package-data glob matches it, so it "
158             f"would be missing from a built wheel"
159         )
160

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

161     # And the loader can actually find it through the packaging machinery.
162     assert offline_ruleset_path() is not None
163

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

183 
184     assert "version" not in project, (
185         "pyproject declares a literal version again; it must stay derived from "
186         "secure_code_audit.__version__ via [tool.setuptools.dynamic]"
187     )
188     assert project.get("dynamic") == ["version"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

187     )
188     assert project.get("dynamic") == ["version"]
189     assert (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

188     assert project.get("dynamic") == ["version"]
189     assert (
190         _pyproject()["tool"]["setuptools"]["dynamic"]["version"]["attr"]
191         == "secure_code_audit.__version__"
192     )
193

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

208 
209     assert getattr(module, attribute) == __version__
210     assert __version__.count(".") >= 2, f"{__version__!r} is not a release version"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

209     assert getattr(module, attribute) == __version__
210     assert __version__.count(".") >= 2, f"{__version__!r} is not a release version"
211

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

246 
247     assert not missing, (
248         f"{missing} ship as defaults but the schema omits them, and outputs "
249         f"declares additionalProperties:false — an editor rejects what the tool writes"
250     )
251

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

257 
258     assert not extra, (
259         f"{extra} are offered by the schema but the loader never reads them, "
260         f"so configuring one does nothing"
261     )
262

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

267 
268     assert _schema_outputs()["additionalProperties"] is False
269

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

283     for key, spec in _schema_outputs()["properties"].items():
284         assert "null" in spec["type"], f"outputs.{key} cannot be disabled per the schema"
285

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

290     for key, spec in _schema_outputs()["properties"].items():
291         assert spec.get("default") == DEFAULT_OUTPUTS[key], key

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

69 
70     assert len(merged) == 1
71     assert merged[0].rule_id == "B703"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

70     assert len(merged) == 1
71     assert merged[0].rule_id == "B703"
72     assert merged[0].corroborated_by == ("bandit:B308",)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

71     assert merged[0].rule_id == "B703"
72     assert merged[0].corroborated_by == ("bandit:B308",)
73

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

78 
79     assert merged[0].corroborated_by == ("bandit:B703",)
80

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

98 
99     assert len(merged) == 1
100     assert merged[0].corroborated_by == ("bandit:B308",)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

99     assert len(merged) == 1
100     assert merged[0].corroborated_by == ("bandit:B308",)
101

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

111 
112     assert len(merged) == 1
113     assert merged[0].corroborated_by == ("builtin_rules:sca.python.subprocess.shell_true",)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

112     assert len(merged) == 1
113     assert merged[0].corroborated_by == ("builtin_rules:sca.python.subprocess.shell_true",)
114

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

129 
130     assert len(merged) == 1
131     assert merged[0].severity is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

130     assert len(merged) == 1
131     assert merged[0].severity is Severity.HIGH
132     assert merged[0].confidence is Confidence.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

131     assert merged[0].severity is Severity.HIGH
132     assert merged[0].confidence is Confidence.HIGH
133

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

142 
143     assert merged[0].confidence is Confidence.HIGH
144

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

159 
160     assert len(merged) == 2
161

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

165 
166     assert len(merged) == 2
167

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

172 
173     assert len(merged) == 10
174

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

178 
179     assert len(merged) == 2
180

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

188 
189     assert len(merged) == 2
190

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

200 
201     assert [f.rule_id for f in merge_corroborating(findings)] == ["B101", "B608", "B105"]
202

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

207 
208     assert merged is original
209     assert merged.corroborated_by == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

208     assert merged is original
209     assert merged.corroborated_by == ()
210

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

212 def test_an_empty_scan_merges_to_nothing():
213     assert merge_corroborating([]) == []
214

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

240 
241     assert len(merged) == 2
242     assert {f.rule_id for f in merged} == {"B602", "B607"}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

241     assert len(merged) == 2
242     assert {f.rule_id for f in merged} == {"B602", "B607"}
243

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

254 
255     assert len(merged) == 1
256     assert merged[0].corroborated_by == ("builtin_rules:sca.python.subprocess.shell_true",)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

255     assert len(merged) == 1
256     assert merged[0].corroborated_by == ("builtin_rules:sca.python.subprocess.shell_true",)
257

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

262 
263     assert len(merged) == 1
264

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

272 
273     assert len(merged) == 2

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

88 
89     assert set(report.per_severity_count) == set(Severity)
90     assert all(report.per_severity_count[sev] == 0 for sev in Severity)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

89     assert set(report.per_severity_count) == set(Severity)
90     assert all(report.per_severity_count[sev] == 0 for sev in Severity)
91

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

101 
102     assert set(report.per_category_count) == set(Category)
103     assert all(report.per_category_count[cat] == 0 for cat in Category)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102     assert set(report.per_category_count) == set(Category)
103     assert all(report.per_category_count[cat] == 0 for cat in Category)
104

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

118 
119     assert set(report.per_severity_count) == set(Severity)
120     assert set(report.per_category_count) == set(Category)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119     assert set(report.per_severity_count) == set(Severity)
120     assert set(report.per_category_count) == set(Category)
121     assert report.per_severity_count[Severity.HIGH] == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

120     assert set(report.per_category_count) == set(Category)
121     assert report.per_severity_count[Severity.HIGH] == 1
122     assert report.per_severity_count[Severity.CRITICAL] == 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

121     assert report.per_severity_count[Severity.HIGH] == 1
122     assert report.per_severity_count[Severity.CRITICAL] == 0
123     assert report.per_category_count[Category.CODE_VULNERABILITIES] == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122     assert report.per_severity_count[Severity.CRITICAL] == 0
123     assert report.per_category_count[Category.CODE_VULNERABILITIES] == 1
124     assert report.per_category_count[Category.SECRETS] == 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

123     assert report.per_category_count[Category.CODE_VULNERABILITIES] == 1
124     assert report.per_category_count[Category.SECRETS] == 0
125

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

139 
140     assert report.per_severity_count[Severity.HIGH] == 1
141     assert Severity.CRITICAL in report.per_severity_count

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

140     assert report.per_severity_count[Severity.HIGH] == 1
141     assert Severity.CRITICAL in report.per_severity_count
142     assert report.per_severity_count[Severity.CRITICAL] == 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

141     assert Severity.CRITICAL in report.per_severity_count
142     assert report.per_severity_count[Severity.CRITICAL] == 0
143

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

164 
165     assert axis.per_severity_count == {Severity.LOW: 2}
166

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

175 
176     assert axis.per_category_count == {Category.DEPENDENCIES: 1}
177

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

187 
188     assert axis.per_severity_count == {}
189     assert axis.per_category_count == {}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

188     assert axis.per_severity_count == {}
189     assert axis.per_category_count == {}
190

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

203 
204     assert axis.findings == (muted,)
205     assert axis.count == 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

204     assert axis.findings == (muted,)
205     assert axis.count == 0
206     assert axis.suppressed_count == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

205     assert axis.count == 0
206     assert axis.suppressed_count == 1
207     assert axis.per_severity_count == {}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

206     assert axis.suppressed_count == 1
207     assert axis.per_severity_count == {}
208     assert axis.worst_severity is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

207     assert axis.per_severity_count == {}
208     assert axis.worst_severity is None
209

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

225 
226     assert axis.worst_severity is None
227     assert "worst" not in axis.headline()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

226     assert axis.worst_severity is None
227     assert "worst" not in axis.headline()
228

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

244 
245     assert axis.worst_severity is Severity.CRITICAL
246     assert "worst critical" in axis.headline()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

245     assert axis.worst_severity is Severity.CRITICAL
246     assert "worst critical" in axis.headline()
247

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

257 
258     assert axis.worst_severity is Severity.INFORMATIONAL
259     assert axis.count == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

258     assert axis.worst_severity is Severity.INFORMATIONAL
259     assert axis.count == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

47 
48     assert report.status is CoverageStatus.FAILED
49     joined = " ".join(report.failures)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

49     joined = " ".join(report.failures)
50     assert "429" in joined, (
51         f"the reason was recorded and the operator-facing failure dropped it: {joined!r}"
52     )
53

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

59     joined = " ".join(report.failures)
60     assert "trivy" in joined, joined
61     assert "failed" in joined, joined

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

60     assert "trivy" in joined, joined
61     assert "failed" in joined, joined
62

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

69 
70     assert report.failures == ("required scanner 'trivy' did not complete: failed",), (
71         report.failures
72     )
73

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

78 
79     assert report.failures == ("required scanner 'trivy' was not selected",), report.failures
80

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

87 
88     assert report.status is CoverageStatus.COMPLETE
89     assert report.failures == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

88     assert report.status is CoverageStatus.COMPLETE
89     assert report.failures == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

58     """
59     assert "builtin_rules" in LANGUAGE_SCANNERS["python"]
60     assert "semgrep" in LANGUAGE_SCANNERS["python"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

59     assert "builtin_rules" in LANGUAGE_SCANNERS["python"]
60     assert "semgrep" in LANGUAGE_SCANNERS["python"]
61     assert "semgrep" in LANGUAGE_SCANNERS["go"], "the offline profile has five Go rules"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

60     assert "semgrep" in LANGUAGE_SCANNERS["python"]
61     assert "semgrep" in LANGUAGE_SCANNERS["go"], "the offline profile has five Go rules"
62     assert "semgrep" in LANGUAGE_SCANNERS["java"], "and five Java rules"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

61     assert "semgrep" in LANGUAGE_SCANNERS["go"], "the offline profile has five Go rules"
62     assert "semgrep" in LANGUAGE_SCANNERS["java"], "and five Java rules"
63     assert "njsscan" in LANGUAGE_SCANNERS["javascript"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

62     assert "semgrep" in LANGUAGE_SCANNERS["java"], "and five Java rules"
63     assert "njsscan" in LANGUAGE_SCANNERS["javascript"]
64     assert "rubocop" in LANGUAGE_SCANNERS["ruby"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63     assert "njsscan" in LANGUAGE_SCANNERS["javascript"]
64     assert "rubocop" in LANGUAGE_SCANNERS["ruby"]
65     # Nothing in the floor reads shell for code defects, so there is no name

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

66     # to suggest. An empty tuple is the honest entry.
67     assert LANGUAGE_SCANNERS["shell"] == ()
68

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

76 
77     assert report.status is CoverageStatus.PARTIAL, report.status
78     assert report.unread_languages, "the language went unnamed"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

77     assert report.status is CoverageStatus.PARTIAL, report.status
78     assert report.unread_languages, "the language went unnamed"
79

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

85     joined = " ".join(report.unread_languages)
86     assert "shell" in joined.lower(), joined
87     assert "no scanner in this floor reads it" in joined, joined

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86     assert "shell" in joined.lower(), joined
87     assert "no scanner in this floor reads it" in joined, joined
88

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

98 
99     assert report.status is CoverageStatus.COMPLETE, report.status
100     assert report.unread_languages == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

99     assert report.status is CoverageStatus.COMPLETE, report.status
100     assert report.unread_languages == ()
101

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

106 
107     assert report.status is CoverageStatus.COMPLETE, report.status
108     assert report.unread_languages == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

107     assert report.status is CoverageStatus.COMPLETE, report.status
108     assert report.unread_languages == ()
109

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

118 
119     assert report.unread_languages == ()
120

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

131 
132     assert report.status is CoverageStatus.COMPLETE
133     assert report.unread_languages == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

132     assert report.status is CoverageStatus.COMPLETE
133     assert report.unread_languages == ()
134

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

143 
144     assert report.status is CoverageStatus.COMPLETE
145     assert report.unread_languages == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

144     assert report.status is CoverageStatus.COMPLETE
145     assert report.unread_languages == ()
146

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

157 
158     assert report.status is CoverageStatus.FAILED, report.status
159     assert report.failures, "the required-scanner failure was lost"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

158     assert report.status is CoverageStatus.FAILED, report.status
159     assert report.failures, "the required-scanner failure was lost"
160     assert report.unread_languages, "the unread language was lost"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

159     assert report.failures, "the required-scanner failure was lost"
160     assert report.unread_languages, "the unread language was lost"
161

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

168 
169     assert report.status is CoverageStatus.COMPLETE, report.status
170     assert report.unread_languages == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

169     assert report.status is CoverageStatus.COMPLETE, report.status
170     assert report.unread_languages == ()
171

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

178 
179     assert report.unread_languages, "a failed gosec was treated as Go coverage"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102 
103     assert tier_of(finding) is Tier.REVIEW
104

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

110 
111     assert reason is not None
112     assert "variable reference" in reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

111     assert reason is not None
112     assert "variable reference" in reason
113     assert "reading the line back" in reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

112     assert "variable reference" in reason
113     assert "reading the line back" in reason
114

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

123 
124     assert tier_of(finding) is Tier.FIX
125

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

131 
132     assert tier_of(finding) is Tier.FIX
133

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

140 
141     assert tier_of(finding) is Tier.REVIEW
142

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

153 
154     assert tier_of(finding) is Tier.FIX
155

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

165 
166     assert _auth("$TOKEN:") not in source
167     assert _LITERAL not in source

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

166     assert _auth("$TOKEN:") not in source
167     assert _LITERAL not in source
168

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

172 
173     assert tier_of(finding) is Tier.FIX
174

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

178 
179     assert tier_of(finding) is Tier.FIX
180

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

194 
195     assert tier_of(code_finding) is Tier.FIX

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

78 
79     assert ungraded.overall is None
80     assert _declared().total_accounted == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

79     assert ungraded.overall is None
80     assert _declared().total_accounted == 1
81

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

88 
89     assert line is None or "None" not in line, line
90

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102 
103     assert line is not None, "the disclosure was dropped along with the number"
104     assert "1 finding(s) accounted for" in line, line

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103     assert line is not None, "the disclosure was dropped along with the number"
104     assert "1 finding(s) accounted for" in line, line
105     assert "subprocess execution" in line, line

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

104     assert "1 finding(s) accounted for" in line, line
105     assert "subprocess execution" in line, line
106

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

113 
114     assert line is not None
115     assert "without declarations" in line, line

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

114     assert line is not None
115     assert "without declarations" in line, line
116     assert f"{graded.overall:.2f}" in line, line

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

115     assert "without declarations" in line, line
116     assert f"{graded.overall:.2f}" in line, line
117

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

123 
124     assert _declaration_delta(graded, graded, nothing_declared) is None
125     assert _declaration_delta(graded, None, _declared()) is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

124     assert _declaration_delta(graded, graded, nothing_declared) is None
125     assert _declaration_delta(graded, None, _declared()) is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

68     """`spawns_processes` accounts for the reports that say a process started."""
69     assert capability_for(_finding("B603"), ["spawns_processes"]) == "spawns_processes"
70     assert capability_for(_finding("B404"), ["spawns_processes"]) == "spawns_processes"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

69     assert capability_for(_finding("B603"), ["spawns_processes"]) == "spawns_processes"
70     assert capability_for(_finding("B404"), ["spawns_processes"]) == "spawns_processes"
71

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

74     """Declaring one capability does not quietly account for another's rules."""
75     assert capability_for(_finding("B310"), ["spawns_processes"]) is None
76     assert capability_for(_finding("B603"), []) is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

75     assert capability_for(_finding("B310"), ["spawns_processes"]) is None
76     assert capability_for(_finding("B603"), []) is None
77

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

85     """
86     assert "B602" not in CAPABILITY_RULES["spawns_processes"]
87     assert capability_for(_finding("B602"), list(CAPABILITY_RULES)) is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86     assert "B602" not in CAPABILITY_RULES["spawns_processes"]
87     assert capability_for(_finding("B602"), list(CAPABILITY_RULES)) is None
88

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

99 
100     assert report.accounted["spawns_processes"] == 2
101     assert report.unexercised == ("fetches_remote_urls",)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

100     assert report.accounted["spawns_processes"] == 2
101     assert report.unexercised == ("fetches_remote_urls",)
102

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

107     )
108     assert report.total_accounted == 2
109

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

137     )
138     assert cfg.capabilities == {"spawns_processes": "runs the analyzer pool"}
139

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

142     cfg = _write(tmp_path, '{"version": 1}')
143     assert cfg.capabilities == {}
144     assert unknown_capabilities(cfg.capabilities) == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

143     assert cfg.capabilities == {}
144     assert unknown_capabilities(cfg.capabilities) == ()
145

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

164 
165     assert axis.note == "Runs the analyzer pool as subprocesses."
166

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

177 
178     assert "Runs the analyzer pool as subprocesses. ADR 006." in section
179

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

190 
191     assert blocks[renderers._axis_key(AXIS_PREFIX + "spawns_processes")]["note"] == (
192         "Runs the analyzer pool as subprocesses."
193     )
194

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

203 
204     assert "graded on the wrong thing" in renderers._axis_section(axis)
205

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

249     axis = payload["reported_not_scored"]["declared:_spawns_processes"]
250     assert axis["count"] >= 1, "the declaration routed nothing; the rest proves nothing"
251     assert axis["note"] == reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

250     assert axis["count"] >= 1, "the declaration routed nothing; the rest proves nothing"
251     assert axis["note"] == reason
252     assert reason in report.read_text(encoding="utf-8")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

251     assert axis["note"] == reason
252     assert reason in report.read_text(encoding="utf-8")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

71 
72     assert triage.tier_of(_finding(), axis) is triage.Tier.ACCEPT
73

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

80     """
81     assert triage.tier_of(_finding(), "primary") is triage.Tier.FIX
82

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

87 
88     assert tiers[triage.Tier.FIX] == []
89     assert len(tiers[triage.Tier.ACCEPT]) == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

88     assert tiers[triage.Tier.FIX] == []
89     assert len(tiers[triage.Tier.ACCEPT]) == 1
90

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102 
103     assert data["counts"]["fix"] == 0
104     assert data["fix"]["shown"] == []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103     assert data["counts"]["fix"] == 0
104     assert data["fix"]["shown"] == []
105     assert data["counts"]["accept"] == 3

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

104     assert data["fix"]["shown"] == []
105     assert data["counts"]["accept"] == 3
106

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119 
120     assert not scored, "fixture no longer declares every finding"
121     assert not tiers[triage.Tier.FIX], (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

120     assert not scored, "fixture no longer declares every finding"
121     assert not tiers[triage.Tier.FIX], (
122         "a finding the scorer routed off the code condition was nominated for patching"
123     )
124

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

127     """The pair that already worked must keep working."""
128     assert triage.tier_of(_finding(), "test tree") is triage.Tier.ACCEPT
129     assert triage.tier_of(_finding(), "documentation") is triage.Tier.ACCEPT

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

128     assert triage.tier_of(_finding(), "test tree") is triage.Tier.ACCEPT
129     assert triage.tier_of(_finding(), "documentation") is triage.Tier.ACCEPT

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63     had none — which is how the others drifted unnoticed."""
64     assert _status_line(doc) is not None, (
65         f"{doc.name} has no `> Status:` header, so nothing can tell whether it "
66         f"still describes the shipped tool"
67     )
68

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

74     line = _status_line(doc)
75     assert line is not None
76     match = _STATUS_VERSION.search(line)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

78         return  # a status that names no version claims nothing about one
79     assert match.group("version") == __version__, (
80         f"{doc.name} is headed v{match.group('version')} while the package is v{__version__}"
81     )
82

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

98 
99     assert len(examined) >= 8, (
100         f"only {len(examined)} document(s) carry a version in their status "
101         f"header: {examined}. The check is close to vacuous."
102     )
103

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

108     for name in _HISTORICAL:
109         assert (REPO / "docs" / name).is_file(), f"{name} is exempted but does not exist"
110

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

132             continue
133         assert match.group("version") == __version__, (
134             f"{path.name}:{number} pins v{match.group('version')}; "
135             f"the current release is v{__version__}"
136         )
137

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

147 
148     assert found >= 2, f"expected action references in README and examples, found {found}"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

57     """A discovery that found nothing would make every check below vacuous."""
58     assert len(_adapters()) >= 10, [c.__name__ for c in _adapters()]
59

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

67     note = (adapter.exclusion_note or "").strip()
68     assert note, (
69         f"{adapter.name} does not pass exclude_patterns to its tool and gives no reason. "
70         "Set exclusion_note to say whether the tool cannot express it, or implement "
71         "exclusion_args — an adapter that silently scans excluded paths is how a "
72         "required scanner failed for sixty runs here."
73     )
74     assert len(note) > 20, f"{adapter.name}: {note!r} is too short to be a reason"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

73     )
74     assert len(note) > 20, f"{adapter.name}: {note!r} is too short to be a reason"
75

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

93 
94     assert emits_flags or filters_inputs, (
95         f"{adapter.name} claims honours_exclusions and neither emits exclusion flags "
96         "nor reads exclude_patterns when choosing its inputs. The claim is the part "
97         "an operator trusts."
98     )
99

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103     letting it inherit a claim it has not earned."""
104     assert Scanner.honours_exclusions is False
105     assert Scanner.exclusion_note == ""

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

104     assert Scanner.honours_exclusions is False
105     assert Scanner.exclusion_note == ""
106

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119 
120     assert SilentScanner.honours_exclusions is False
121     assert not (SilentScanner.exclusion_note or "").strip(), (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

120     assert SilentScanner.honours_exclusions is False
121     assert not (SilentScanner.exclusion_note or "").strip(), (
122         "a new adapter must start with no note, or the mandatory-reason check proves nothing"
123     )

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86     """A glob that matched nothing would make the check below vacuous."""
87     assert len(_sources()) >= 20, len(_sources())
88

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

104 
105     assert spawns >= 8, (
106         f"found {spawns} child-process calls; this package had 8. A drop means "
107         "either they were removed or they are now spelled in a way this lint "
108         "cannot see, and an unseen call is an unchecked one."
109     )
110

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

115 
116     assert offenders == [], (
117         f"child process spawned with no timeout: {offenders}. Pass `timeout=`; a "
118         "scanner, or a git command waiting on a prompt, would otherwise hang the "
119         "audit with no finding and no exit code to explain it."
120     )
121

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

136 
137     assert _unbounded_calls(unbounded) == ["unbounded.py:5 subprocess.run()"]
138     assert _unbounded_calls(bounded) == []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

137     assert _unbounded_calls(unbounded) == ["unbounded.py:5 subprocess.run()"]
138     assert _unbounded_calls(bounded) == []
139

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

151 
152     assert spawns >= 20, (
153         f"found {spawns} child-process calls in the suite; there were 36. A drop "
154         "means they were removed or are spelled in a way this lint cannot see."
155     )
156

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

168 
169     assert offenders == [], (
170         f"test spawned a child process with no timeout: {offenders}. Pass "
171         "`timeout=`; one of these hung a CI job for 45 minutes and left a "
172         "required check skipped, which blocks the merge rather than failing it."
173     )

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

68 
69     assert _excluded(rel, f"{directory}/") is True, "the bare spelling regressed"
70     assert _excluded(rel, f"**/{directory}/") is True, (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

69     assert _excluded(rel, f"{directory}/") is True, "the bare spelling regressed"
70     assert _excluded(rel, f"**/{directory}/") is True, (
71         f"**/{directory}/ is inert — it reads as intent and matches nothing"
72     )
73

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

80 
81     assert _excluded(rel, pattern), f"{pattern} matches nothing"
82

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

88 
89     assert _excluded(rel, pattern), f"{pattern} does not match below the root"
90

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

107 
108     assert _excluded(rel, pattern), f"{pattern} does not match {rel}"
109

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

114     did."""
115     assert _excluded("a/b/c/vendor.min.js", "**/*.min.js") is True
116     assert _excluded("deep/nested/path/poetry.lock", "**/*.lock") is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

115     assert _excluded("a/b/c/vendor.min.js", "**/*.min.js") is True
116     assert _excluded("deep/nested/path/poetry.lock", "**/*.lock") is True
117

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

120     """Matching everything would pass the tests above and exclude the repo."""
121     assert _excluded("src/app.py", "**/*.min.js") is False
122     assert _excluded("src/app.py", "**/*.lock") is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

121     assert _excluded("src/app.py", "**/*.min.js") is False
122     assert _excluded("src/app.py", "**/*.lock") is False
123

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

130 def test_a_similarly_named_directory_is_not_matched():
131     assert _excluded("__pycache__extra/x.py", "**/__pycache__/") is False
132     assert _excluded("my__pycache__/x.py", "**/__pycache__/") is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

131     assert _excluded("__pycache__extra/x.py", "**/__pycache__/") is False
132     assert _excluded("my__pycache__/x.py", "**/__pycache__/") is False
133

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

149     """
150     assert _excluded("src/__pycache__", "**/__pycache__/") is False
151     assert _excluded("src/notes.egg-info", "*.egg-info/") is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

150     assert _excluded("src/__pycache__", "**/__pycache__/") is False
151     assert _excluded("src/notes.egg-info", "*.egg-info/") is False
152

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

154 def test_an_unrelated_path_is_untouched():
155     assert _excluded("src/app.py", "**/__pycache__/") is False
156

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

161     repository with nothing scanned."""
162     assert _excluded("src/app.py", "**/") is False
163     assert _excluded("anything/at/all.py", "**/") is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

162     assert _excluded("src/app.py", "**/") is False
163     assert _excluded("anything/at/all.py", "**/") is False
164

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

191     """
192     assert _excluded(rel, pattern), f"{pattern} is inert against {rel}"
193

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

204     """Matching everything would satisfy the test above and exclude the repo."""
205     assert not _excluded(rel, pattern)
206

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

210     swallow every path containing `build-` anywhere ahead of it."""
211     assert _excluded("build-x86/out.js", "build-*/")
212     assert not _excluded("src/nested/out.js", "build-*/")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

211     assert _excluded("build-x86/out.js", "build-*/")
212     assert not _excluded("src/nested/out.js", "build-*/")
213

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

244     """
245     assert _excluded(rel, pattern) is expected
246

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

257 
258     assert multi, "expected at least one multi-segment directory exclude to guard"
259     for pattern in multi:

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

260         probe = repo_root / f"{pattern.rstrip('/')}/nested/file.py"
261         assert is_excluded(probe, repo_root, patterns), f"{pattern} is inert"
262

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

271     still carries the string constants of its source."""
272     assert _excluded(
273         "tests/unit/__pycache__/test_x.cpython-311-pytest-9.1.1.pyc", *DEFAULT_EXCLUDES
274     )
275

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

286 
287     assert is_excluded(repo_root / "tests/unit/__pycache__/test_x.pyc", repo_root, patterns), (
288         "this repository is scanning its own bytecode again"
289     )

B404 — Consider possible security implications associated with the subprocess module. 🆕

45 from pathlib import Path
46 from subprocess import CompletedProcess
47

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

74 
75     assert "calibration/.corpus" in dirs
76     assert ".venv" in dirs

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

75     assert "calibration/.corpus" in dirs
76     assert ".venv" in dirs
77     assert "node_modules" in dirs

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

76     assert ".venv" in dirs
77     assert "node_modules" in dirs
78

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

89 
90     assert not any(d.endswith(".min.js") for d in dirs), dirs
91     assert not any("standards.py" in d for d in dirs), dirs

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

90     assert not any(d.endswith(".min.js") for d in dirs), dirs
91     assert not any("standards.py" in d for d in dirs), dirs
92

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

98 
99     assert dirs == ("**/__pycache__",), dirs
100

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102 def test_nothing_configured_offers_nothing():
103     assert directory_excludes([]) == ()
104

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

116     """
117     assert as_regex("calibration/.corpus") == r"calibration/\.corpus"
118

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

123 
124     assert re.search(pattern, "src/a/__pycache__/x.pyc")
125     assert re.search(pattern, "__pycache__/x.pyc"), "the root case is the one `**/` includes"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

124     assert re.search(pattern, "src/a/__pycache__/x.pyc")
125     assert re.search(pattern, "__pycache__/x.pyc"), "the root case is the one `**/` includes"
126

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

131 
132     assert re.search(pattern, "calibration/.corpus/webgoat/pom.xml")
133     assert not re.search(pattern, "calibration/Xcorpus/webgoat/pom.xml")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

132     assert re.search(pattern, "calibration/.corpus/webgoat/pom.xml")
133     assert not re.search(pattern, "calibration/Xcorpus/webgoat/pom.xml")
134

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

137     """A directory called `a+b` or `(old)` must not become a regex operator."""
138     assert re.search(as_regex("a+b"), "a+b/f.tf")
139     assert not re.search(as_regex("a+b"), "aab/f.tf")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

138     assert re.search(as_regex("a+b"), "a+b/f.tf")
139     assert not re.search(as_regex("a+b"), "aab/f.tf")
140

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

150 
151     assert all(d.strip(" ./") for d in dirs), dirs
152     assert "" not in dirs

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

151     assert all(d.strip(" ./") for d in dirs), dirs
152     assert "" not in dirs
153     assert "/" not in dirs

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

152     assert "" not in dirs
153     assert "/" not in dirs
154

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

171     scanner_cls().scan(Path("/repo"), config)
172     assert seen, "the adapter never executed anything"
173     return seen[0]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

201 
202     assert flag in argv, f"{scanner_cls.name} never passed {flag}: {argv}"
203     joined = " ".join(argv)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

203     joined = " ".join(argv)
204     assert expected in joined, (
205         f"{scanner_cls.name} was told to scan a directory the operator excluded: {argv}"
206     )
207

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

223 
224     assert "--skip-dirs" not in argv
225     assert "--skip-path" not in argv

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

224     assert "--skip-dirs" not in argv
225     assert "--skip-path" not in argv
226     assert "--exclude" not in argv

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

225     assert "--skip-path" not in argv
226     assert "--exclude" not in argv
227

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

244 
245     assert any("/repo" in a for a in argv), argv

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

52     """
53     assert lookup("bandit", "B608").canonical_cwe == "CWE-89"  # premise
54

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

56 
57     assert std.canonical_cwe == "CWE-79"
58

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

67 
68     assert std.canonical_cwe == "CWE-89"
69

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

76     """
77     assert lookup("nosuchscanner", "X1") is None  # premise
78

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

80 
81     assert std.canonical_cwe == "CWE-89"
82

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

87 
88     assert std.canonical_cwe is None
89     assert std.owasp_top10 is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

88     assert std.canonical_cwe is None
89     assert std.owasp_top10 is None
90     assert not is_top25(std.canonical_cwe)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

89     assert std.owasp_top10 is None
90     assert not is_top25(std.canonical_cwe)
91

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

99     entry = lookup("scorecard", "Anything")
100     assert entry is not None and entry.canonical_cwe is None  # premise
101

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103 
104     assert std.canonical_cwe == "CWE-89"
105

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

114 
115     assert std.canonical_cwe == "CWE-798"
116     assert std.severity is Severity.CRITICAL

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

115     assert std.canonical_cwe == "CWE-798"
116     assert std.severity is Severity.CRITICAL
117

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

120     """The label is lowercased by `lookup`; 'Bandit' must resolve like 'bandit'."""
121     assert _resolve("Bandit", "B608") == _resolve("bandit", "B608")
122

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

133 
134     assert std.owasp_top10 == owasp_for_cwe("CWE-89") == "A03"
135

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

145 
146     assert std.canonical_cwe == "CWE-22"
147     assert std.owasp_top10 == "A01"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

146     assert std.canonical_cwe == "CWE-22"
147     assert std.owasp_top10 == "A01"
148

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

163     """
164     assert owasp_for_cwe("CWE-22") == "A01"  # derived from the override
165     assert lookup("bandit", "B608").owasp_top10 == "A03"  # the curated answer it beats

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

164     assert owasp_for_cwe("CWE-22") == "A01"  # derived from the override
165     assert lookup("bandit", "B608").owasp_top10 == "A03"  # the curated answer it beats
166

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

168 
169     assert std.canonical_cwe == "CWE-22"
170     assert std.owasp_top10 == "A01"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

169     assert std.canonical_cwe == "CWE-22"
170     assert std.owasp_top10 == "A01"
171

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

180     """
181     assert owasp_for_cwe("CWE-703") is None  # premise
182     assert lookup("bandit", "B608").owasp_top10 == "A03"  # what must not leak through

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

181     assert owasp_for_cwe("CWE-703") is None  # premise
182     assert lookup("bandit", "B608").owasp_top10 == "A03"  # what must not leak through
183

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

185 
186     assert std.canonical_cwe == "CWE-703"
187     assert std.owasp_top10 is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

186     assert std.canonical_cwe == "CWE-703"
187     assert std.owasp_top10 is None
188

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

198 
199     assert std.canonical_cwe == "CWE-89"
200     assert std.owasp_top10 == "A03"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

199     assert std.canonical_cwe == "CWE-89"
200     assert std.owasp_top10 == "A03"
201

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

208     """
209     assert owasp_for_cwe("CWE-703") is None  # premise
210

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

212 
213     assert std.canonical_cwe == "CWE-703"
214     assert std.owasp_top10 is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

213     assert std.canonical_cwe == "CWE-703"
214     assert std.owasp_top10 is None
215

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

224 
225     assert std.canonical_cwe is None
226     assert std.owasp_top10 == "A08"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

225     assert std.canonical_cwe is None
226     assert std.owasp_top10 == "A08"
227

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

237 
238     assert std.asvs_section == entry.asvs_section == "V5.3.5"
239     assert std.nist_ssdf == entry.nist_ssdf == "PW.5.1"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

238     assert std.asvs_section == entry.asvs_section == "V5.3.5"
239     assert std.nist_ssdf == entry.nist_ssdf == "PW.5.1"
240     assert std.short_desc == entry.short_desc and std.short_desc

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

239     assert std.nist_ssdf == entry.nist_ssdf == "PW.5.1"
240     assert std.short_desc == entry.short_desc and std.short_desc
241     assert std.fix_hint == entry.fix_hint and std.fix_hint

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

240     assert std.short_desc == entry.short_desc and std.short_desc
241     assert std.fix_hint == entry.fix_hint and std.fix_hint
242

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

247 
248     assert std.asvs_section is None
249     assert std.nist_ssdf is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

248     assert std.asvs_section is None
249     assert std.nist_ssdf is None
250     assert std.short_desc is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

249     assert std.nist_ssdf is None
250     assert std.short_desc is None
251     assert std.fix_hint is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

250     assert std.short_desc is None
251     assert std.fix_hint is None
252

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

255     """Scanner-emitted severity wins over the entry's default (HIGH here)."""
256     assert lookup("bandit", "B608").severity is Severity.HIGH  # premise
257

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

259 
260     assert std.severity is Severity.LOW
261

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

265 
266     assert std.severity is Severity.HIGH
267     assert std.confidence is Confidence.MEDIUM

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

266     assert std.severity is Severity.HIGH
267     assert std.confidence is Confidence.MEDIUM
268

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

273 
274     assert std.confidence is Confidence.HIGH
275

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

280 
281     assert std.severity is Severity.MEDIUM
282     assert std.confidence is Confidence.MEDIUM

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

281     assert std.severity is Severity.MEDIUM
282     assert std.confidence is Confidence.MEDIUM
283     assert std.category is Category.SECRETS

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

282     assert std.confidence is Confidence.MEDIUM
283     assert std.category is Category.SECRETS
284

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

292     default = Category.CONFIG_IAC
293     assert lookup("gitleaks", "r").category is Category.SECRETS  # premise
294

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

298 
299     assert from_map.category is Category.SECRETS
300     assert explicit.category is Category.DEPENDENCIES

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

299     assert from_map.category is Category.SECRETS
300     assert explicit.category is Category.DEPENDENCIES
301     assert fallback.category is default

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

300     assert explicit.category is Category.DEPENDENCIES
301     assert fallback.category is default
302

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

307 
308     assert isinstance(std, _Standards)
309     with pytest.raises(AttributeError):

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

339     """
340     assert _finding().cwe_top25 is True
341     overridden = _finding(cwe_override="CWE-703")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

342 
343     assert overridden.canonical_cwe == "CWE-703"
344     assert overridden.cwe_top25 is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

343     assert overridden.canonical_cwe == "CWE-703"
344     assert overridden.cwe_top25 is False
345

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

350 
351     assert finding.canonical_cwe == "CWE-95"
352     assert finding.cwe_top25 is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

351     assert finding.canonical_cwe == "CWE-95"
352     assert finding.cwe_top25 is True
353

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

365 
366     assert finding.scanner == "gitleaks"
367     assert finding.canonical_cwe == "CWE-798"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

366     assert finding.scanner == "gitleaks"
367     assert finding.canonical_cwe == "CWE-798"
368

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

373 
374     assert _finding(file_path=absolute).file_path == absolute
375

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

381     """
382     assert _finding().fingerprint != _finding(cwe_override="CWE-79").fingerprint
383     assert _finding().fingerprint == _finding().fingerprint

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

382     assert _finding().fingerprint != _finding(cwe_override="CWE-79").fingerprint
383     assert _finding().fingerprint == _finding().fingerprint
384

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

400 
401     assert finding.rule_id == "tool.tool_unavailable"
402     assert finding.severity is Severity.INFORMATIONAL

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

401     assert finding.rule_id == "tool.tool_unavailable"
402     assert finding.severity is Severity.INFORMATIONAL
403     assert finding.category is Category.POLICY_DOCS

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

402     assert finding.severity is Severity.INFORMATIONAL
403     assert finding.category is Category.POLICY_DOCS
404     assert finding.file_path == target

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

403     assert finding.category is Category.POLICY_DOCS
404     assert finding.file_path == target
405     assert finding.fingerprint == "unavailable.tool"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

404     assert finding.file_path == target
405     assert finding.fingerprint == "unavailable.tool"
406     assert finding.fix_hint is not None and "pipx install tool" in finding.fix_hint

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

405     assert finding.fingerprint == "unavailable.tool"
406     assert finding.fix_hint is not None and "pipx install tool" in finding.fix_hint
407

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

414 
415     assert hint.startswith("Install bandit")
416     assert "scanners.bandit.command" in hint

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

415     assert hint.startswith("Install bandit")
416     assert "scanners.bandit.command" in hint
417     assert "--sarif-import" in hint

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

416     assert "scanners.bandit.command" in hint
417     assert "--sarif-import" in hint

B404 — Consider possible security implications associated with the subprocess module. 🆕

18 import os
19 import subprocess
20 from pathlib import Path

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86 def test_a_repository_relative_paths_glob_matches(tmp_path):
87     assert _rule(paths=("src/*.py",)).matches(_finding("src/app.py"), tmp_path)
88

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

91     """This repository's own `.scignore.yaml` is written this way."""
92     assert _rule(paths=("*/src/app.py",)).matches(_finding("src/app.py"), tmp_path)
93     assert _rule(paths=("**/app.py",)).matches(_finding("app.py"), tmp_path)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

92     assert _rule(paths=("*/src/app.py",)).matches(_finding("src/app.py"), tmp_path)
93     assert _rule(paths=("**/app.py",)).matches(_finding("app.py"), tmp_path)
94

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

96 def test_the_compatibility_does_not_widen_a_glob_to_another_directory(tmp_path):
97     assert not _rule(paths=("src/*.py",)).matches(_finding("lib/src/app.py"), tmp_path)
98     assert not _rule(paths=("*/src/app.py",)).matches(_finding("src/app.pyc"), tmp_path)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

97     assert not _rule(paths=("src/*.py",)).matches(_finding("lib/src/app.py"), tmp_path)
98     assert not _rule(paths=("*/src/app.py",)).matches(_finding("src/app.pyc"), tmp_path)
99

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

101 def test_a_file_entry_matches_exactly_and_by_suffix(tmp_path):
102     assert _rule(file="src/app.py").matches(_finding("src/app.py"), tmp_path)
103     assert _rule(file="app.py").matches(_finding("src/app.py"), tmp_path)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102     assert _rule(file="src/app.py").matches(_finding("src/app.py"), tmp_path)
103     assert _rule(file="app.py").matches(_finding("src/app.py"), tmp_path)
104     assert not _rule(file="src/other.py").matches(_finding("src/app.py"), tmp_path)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103     assert _rule(file="app.py").matches(_finding("src/app.py"), tmp_path)
104     assert not _rule(file="src/other.py").matches(_finding("src/app.py"), tmp_path)
105

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

109 
110     assert entry.matches(_finding("src/app.py"), tmp_path)
111     assert not entry.matches(_finding("src/other.py"), tmp_path)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

110     assert entry.matches(_finding("src/app.py"), tmp_path)
111     assert not entry.matches(_finding("src/other.py"), tmp_path)
112

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

117 
118     assert old != finding.fingerprint
119     assert _rule(fingerprint=old, line=1).matches(finding, tmp_path)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

118     assert old != finding.fingerprint
119     assert _rule(fingerprint=old, line=1).matches(finding, tmp_path)
120     assert _rule(fingerprint=finding.fingerprint, line=1).matches(finding, tmp_path)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119     assert _rule(fingerprint=old, line=1).matches(finding, tmp_path)
120     assert _rule(fingerprint=finding.fingerprint, line=1).matches(finding, tmp_path)
121     assert not _rule(fingerprint=old, line=1).matches(finding, tmp_path / "moved")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

120     assert _rule(fingerprint=finding.fingerprint, line=1).matches(finding, tmp_path)
121     assert not _rule(fingerprint=old, line=1).matches(finding, tmp_path / "moved")
122

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

126     rules, errors = suppressions.load(REPO / ".scignore.yaml")
127     assert not errors
128     checked = 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

130         for pattern in rule.paths:
131             assert pattern.startswith("*/"), pattern
132             named = _finding(pattern.removeprefix("*/"), rule_id=rule.rule_id)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

132             named = _finding(pattern.removeprefix("*/"), rule_id=rule.rule_id)
133             assert rule.matches(named, REPO), f"{rule.rule_id} no longer matches {pattern}"
134             checked += 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

134             checked += 1
135     assert checked, "no path entries were checked"
136

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

149 
150     assert marked.is_new is False
151

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

162 
163     assert set(bumped) == {current.fingerprint}
164     assert bumped[current.fingerprint].first_seen == first_seen

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

163     assert set(bumped) == {current.fingerprint}
164     assert bumped[current.fingerprint].first_seen == first_seen
165     assert bumped[current.fingerprint].file_path == "src/app.py"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

164     assert bumped[current.fingerprint].first_seen == first_seen
165     assert bumped[current.fingerprint].file_path == "src/app.py"
166

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

177 
178     assert tier_of(secret, root=tmp_path) is Tier.REVIEW
179

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

195 
196     assert result == [control, kept]
197

B607 — Starting a process with a partial executable path 🆕

199 def _git(root: Path, *args: str) -> None:
200     subprocess.run(
201         ["git", "-C", str(root), "-c", "user.email=t@example.invalid", "-c", "user.name=t", *args],
202         check=True,
203         capture_output=True,
204         env={**os.environ, "GIT_IDENTITY_OVERRIDE": "1"},
205         timeout=120,
206     )
207

B603 — subprocess call - check for execution of untrusted input. 🆕

199 def _git(root: Path, *args: str) -> None:
200     subprocess.run(
201         ["git", "-C", str(root), "-c", "user.email=t@example.invalid", "-c", "user.name=t", *args],
202         check=True,
203         capture_output=True,
204         env={**os.environ, "GIT_IDENTITY_OVERRIDE": "1"},
205         timeout=120,
206     )
207

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

225 
226     assert [f.file_path for f in kept] == [Path("src/a.py")]
227

B607 — Starting a process with a partial executable path 🆕

231     root = _committed_repo(tmp_path)
232     head = subprocess.run(
233         ["git", "-C", str(root), "rev-parse", "HEAD"],
234         capture_output=True,
235         text=True,
236         check=True,
237         timeout=120,
238     ).stdout.strip()
239     (root / "src" / "a.py").write_text("x = 2\n", encoding="utf-8")

B603 — subprocess call - check for execution of untrusted input. 🆕

231     root = _committed_repo(tmp_path)
232     head = subprocess.run(
233         ["git", "-C", str(root), "rev-parse", "HEAD"],
234         capture_output=True,
235         text=True,
236         check=True,
237         timeout=120,
238     ).stdout.strip()
239     (root / "src" / "a.py").write_text("x = 2\n", encoding="utf-8")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

243 
244     assert scope.known
245     assert tuple(scope.cited) == ("src/a.py",)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

244     assert scope.known
245     assert tuple(scope.cited) == ("src/a.py",)
246     assert not scope.collateral

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

245     assert tuple(scope.cited) == ("src/a.py",)
246     assert not scope.collateral

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

78     """gitleaks' `git` pass and SARIF ingest. The case D5 found broken."""
79     assert _located("tests/certs/server.key", tmp_path) == Path("tests/certs/server.key")
80

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

83     """Bandit's shape, and gitleaks' `dir` pass given an absolute root."""
84     assert _located(tmp_path / "src" / "app.py", tmp_path) == Path("src/app.py")
85

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

90 
91     assert _located(uri, tmp_path) == Path("src/my app.py")
92

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102 
103     assert _located(elsewhere, tmp_path) == elsewhere
104

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

109 
110     assert _located("handlers.py", tmp_path, scanned) == Path("api/handlers.py")
111     assert _located(scanned / "handlers.py", tmp_path) == Path("api/handlers.py")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

110     assert _located("handlers.py", tmp_path, scanned) == Path("api/handlers.py")
111     assert _located(scanned / "handlers.py", tmp_path) == Path("api/handlers.py")
112

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

115     """Auditing one file still gives paths a directory to be relative to."""
116     assert _located("helpers.py", tmp_path, scanned=tmp_path) == Path("helpers.py")
117

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

124     """
125     assert _finding(_probe(tmp_path), "a/b.py").file_path == Path("a/b.py")
126     assert _finding(_Probe(), "a/b.py").file_path == Path("a/b.py")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

125     assert _finding(_probe(tmp_path), "a/b.py").file_path == Path("a/b.py")
126     assert _finding(_Probe(), "a/b.py").file_path == Path("a/b.py")
127

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

133 
134     assert anchored.file_path == Path("src/app.py")
135     assert anchored.fingerprint == Finding.make_fingerprint(

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

134     assert anchored.file_path == Path("src/app.py")
135     assert anchored.fingerprint == Finding.make_fingerprint(
136         canonical_cwe=reported.canonical_cwe,
137         rule_id=reported.rule_id,
138         file_path=Path("src/app.py"),
139         code_snippet=reported.code_snippet,
140     )
141     assert anchored.legacy_fingerprint(tmp_path) == reported.fingerprint

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

140     )
141     assert anchored.legacy_fingerprint(tmp_path) == reported.fingerprint
142

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

149 
150     assert anchored.file_path == Path(".")
151     assert anchored.fingerprint == control.fingerprint

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

150     assert anchored.file_path == Path(".")
151     assert anchored.fingerprint == control.fingerprint
152

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

165     """
166     assert is_excluded(Path("vendor/thing.go"), tmp_path, ("vendor/",))
167     assert is_test_path(Path("tests/certs/ca.key"), tmp_path, ("tests/",))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

166     assert is_excluded(Path("vendor/thing.go"), tmp_path, ("vendor/",))
167     assert is_test_path(Path("tests/certs/ca.key"), tmp_path, ("tests/",))
168

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

186     """
187     assert is_excluded(tmp_path / relative, tmp_path, (pattern,))
188

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

210 
211     assert offenders == [], (
212         f"{offenders} construct Finding() directly instead of going through "
213         f"Scanner._make_finding(), so they skip the standards mapping and the "
214         f"shared fingerprint"
215     )
216

B404 — Consider possible security implications associated with the subprocess module. 🆕

233     def binary_version(self):
234         import subprocess
235         from unittest.mock import patch

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

251 
252     assert scanner.binary_version() == "njsscan: v1.0.0 | Ajin Abraham"
253

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

255 def test_an_uncoloured_version_is_unchanged():
256     assert _Versioned("gitleaks version 8.30.1\n").binary_version() == "gitleaks version 8.30.1"
257

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

259 def test_leading_blank_lines_are_skipped():
260     assert _Versioned("\n\n  1.28.2  \n").binary_version() == "1.28.2"
261

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

264     """Better to say nothing than to record an escape sequence."""
265     assert _Versioned("\x1b[34m\x1b[0m\n").binary_version() is None
266

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

270     version column of a report claiming the scanner ran fine."""
271     assert _Versioned("1.2.3", returncode=1).binary_version() is None
272

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

292 
293     assert SemgrepScanner.python_module is None
294

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

319             continue  # not installed here; nothing to check
320         assert importlib.util.find_spec(f"{module}.__main__") is not None, (
321             f"{name} declares python_module={module!r} but it has no __main__, "
322             f"so `python -m {module}` cannot run it"
323         )

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

12 def test_severity_from_string_aliases():
13     assert Severity.from_string("HIGH") is Severity.HIGH
14     assert Severity.from_string("error") is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

13     assert Severity.from_string("HIGH") is Severity.HIGH
14     assert Severity.from_string("error") is Severity.HIGH
15     assert Severity.from_string("warning") is Severity.MEDIUM

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

14     assert Severity.from_string("error") is Severity.HIGH
15     assert Severity.from_string("warning") is Severity.MEDIUM
16     assert Severity.from_string("moderate") is Severity.MEDIUM

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

15     assert Severity.from_string("warning") is Severity.MEDIUM
16     assert Severity.from_string("moderate") is Severity.MEDIUM
17     assert Severity.from_string("note") is Severity.LOW

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

16     assert Severity.from_string("moderate") is Severity.MEDIUM
17     assert Severity.from_string("note") is Severity.LOW
18     assert Severity.from_string("info") is Severity.INFORMATIONAL

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

17     assert Severity.from_string("note") is Severity.LOW
18     assert Severity.from_string("info") is Severity.INFORMATIONAL
19     assert Severity.from_string("nonsense") is Severity.INFORMATIONAL

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

18     assert Severity.from_string("info") is Severity.INFORMATIONAL
19     assert Severity.from_string("nonsense") is Severity.INFORMATIONAL
20

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

22 def test_severity_rank_ordering():
23     assert Severity.CRITICAL.rank > Severity.HIGH.rank > Severity.MEDIUM.rank
24     assert Severity.MEDIUM.rank > Severity.LOW.rank > Severity.INFORMATIONAL.rank

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

23     assert Severity.CRITICAL.rank > Severity.HIGH.rank > Severity.MEDIUM.rank
24     assert Severity.MEDIUM.rank > Severity.LOW.rank > Severity.INFORMATIONAL.rank
25

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

27 def test_severity_at_or_above_inclusive():
28     assert severity_at_or_above(Severity.MEDIUM) == {
29         Severity.CRITICAL,
30         Severity.HIGH,
31         Severity.MEDIUM,
32     }
33

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

35 def test_confidence_parses_loose():
36     assert Confidence.from_string("HIGH") is Confidence.HIGH
37     assert Confidence.from_string("med") is Confidence.MEDIUM

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

36     assert Confidence.from_string("HIGH") is Confidence.HIGH
37     assert Confidence.from_string("med") is Confidence.MEDIUM
38     assert Confidence.from_string("") is Confidence.MEDIUM  # default

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

37     assert Confidence.from_string("med") is Confidence.MEDIUM
38     assert Confidence.from_string("") is Confidence.MEDIUM  # default
39

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

54     )
55     assert a == b
56

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

70     )
71     assert a != b
72

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86     )
87     assert a == b
88

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

91     for cat in Category:
92         assert Category(cat.value) is cat
93

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

130     # MA's `vacuous-assertion` rule said out loud.
131     assert len(fingerprint) == 16, fingerprint
132     assert _VALID_FINGERPRINT.fullmatch(fingerprint), (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

131     assert len(fingerprint) == 16, fingerprint
132     assert _VALID_FINGERPRINT.fullmatch(fingerprint), (
133         f"{fingerprint!r} is not what the suppression loader accepts; a pinned "
134         "fingerprint: entry would no longer match the finding it names"
135     )
136

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

150 
151     assert first == second

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

36 
37     assert len(sources) >= 5, sources
38     assert (root / "README.md").is_file()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

37     assert len(sources) >= 5, sources
38     assert (root / "README.md").is_file()
39

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

50 
51     assert "shell=True)" not in source
52     assert "eval(expression)" not in source

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

51     assert "shell=True)" not in source
52     assert "eval(expression)" not in source
53

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

58 
59     assert exit_code in (0, 1)  # gate may fail on the planted defects; it should
60     assert "Demo tree:" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

59     assert exit_code in (0, 1)  # gate may fail on the planted defects; it should
60     assert "Demo tree:" in out
61     assert "secure-code-agent" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

60     assert "Demo tree:" in out
61     assert "secure-code-agent" in out
62

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

68 
69     assert "0 finding" not in out
70

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

73     """It audits its own tree; a path would silently be ignored."""
74     assert main(["--demo", "some/repo"]) == 2
75     assert "generated tree" in capsys.readouterr().err

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

74     assert main(["--demo", "some/repo"]) == 2
75     assert "generated tree" in capsys.readouterr().err
76

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86 
87     assert "trivy" in out and "osv_scanner" in out
88     assert "install" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

87     assert "trivy" in out and "osv_scanner" in out
88     assert "install" in out
89     assert "--preflight" in out

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

88     assert "install" in out
89     assert "--preflight" in out
90

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

100 
101     assert SCANNERS["trivy"]().unavailable_fix_hint()
102

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

106 
107     assert capsys.readouterr().out == ""
108

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

114 
115     assert "not_a_real_scanner" not in capsys.readouterr().out
116

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

141 
142     assert "rubocop" not in required
143     assert "njsscan" not in required

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

142     assert "rubocop" not in required
143     assert "njsscan" not in required
144     assert "bandit" in required

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

143     assert "njsscan" not in required
144     assert "bandit" in required
145

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

156 
157     assert floor.applies_to_repository(scanner, *inventory)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

45 
46     assert result.passed is True  # nothing tripped, which is true
47     assert result.enforced is False  # but nothing was checked

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

46     assert result.passed is True  # nothing tripped, which is true
47     assert result.enforced is False  # but nothing was checked
48     assert result.configured == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

47     assert result.enforced is False  # but nothing was checked
48     assert result.configured == ()
49

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

53 
54     assert result.enforced is True
55     assert "fail_on_severity" in result.configured

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

54     assert result.enforced is True
55     assert "fail_on_severity" in result.configured
56

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

61     passes for a real one."""
62     assert _gate({"fail_on_severity": []}).enforced is False
63

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

66     """No score can fall below zero."""
67     assert _gate({"min_score": 0}).enforced is False
68

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

70 def test_a_positive_min_score_is_enforcement():
71     assert _gate({"min_score": 4.0}).enforced is True
72

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

74 def test_an_empty_cap_map_is_not_enforcement():
75     assert _gate({"max_unsuppressed": {}}).enforced is False
76

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82 
83     assert set(result.configured) == {"fail_on_severity", "fail_on_new", "min_score"}
84

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

94     behaviour change hiding inside a reporting fix."""
95     assert _gate({}).passed is True
96     assert _gate({"fail_on_severity": ["critical"]}).passed is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

95     assert _gate({}).passed is True
96     assert _gate({"fail_on_severity": ["critical"]}).passed is True
97

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122 
123     assert result.passed is False
124     assert result.enforced is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

123     assert result.passed is False
124     assert result.enforced is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

8     child.mkdir()
9     assert git_tools.find_repo_root(child) == repo
10

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

18 
19     assert git_tools.is_excluded(excluded, tmp_path, ("node_modules/",))
20     assert git_tools.in_scope(tmp_path / "keep.py", (".py",))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

19     assert git_tools.is_excluded(excluded, tmp_path, ("node_modules/",))
20     assert git_tools.in_scope(tmp_path / "keep.py", (".py",))
21     assert git_tools.in_scope(tmp_path / "Dockerfile.dev", ("Dockerfile",))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

20     assert git_tools.in_scope(tmp_path / "keep.py", (".py",))
21     assert git_tools.in_scope(tmp_path / "Dockerfile.dev", ("Dockerfile",))
22     # loc_under returns (primary, test); with no test patterns everything is

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

23     # primary, so the denominator cannot silently shrink.
24     assert git_tools.loc_under(tmp_path, (".py", "Dockerfile"), ("node_modules/",)) == (3, 0, 0)
25

B404 — Consider possible security implications associated with the subprocess module. 🆕

39     """
40     import subprocess
41

B607 — Starting a process with a partial executable path 🆕

41 
42     subprocess.run(["git", "init", "-q", str(tmp_path)], check=True, timeout=120)
43     (tmp_path / "docs").mkdir()

B603 — subprocess call - check for execution of untrusted input. 🆕

41 
42     subprocess.run(["git", "init", "-q", str(tmp_path)], check=True, timeout=120)
43     (tmp_path / "docs").mkdir()

B607 — Starting a process with a partial executable path 🆕

47     (tmp_path / "code.py").write_text("x = 1\n", encoding="utf-8")
48     subprocess.run(
49         ["git", "-C", str(tmp_path), "add", "README.md", "docs/guide.md", "code.py"],
50         check=True,
51         timeout=120,
52     )
53

B603 — subprocess call - check for execution of untrusted input. 🆕

47     (tmp_path / "code.py").write_text("x = 1\n", encoding="utf-8")
48     subprocess.run(
49         ["git", "-C", str(tmp_path), "add", "README.md", "docs/guide.md", "code.py"],
50         check=True,
51         timeout=120,
52     )
53

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

53 
54     assert set(git_tools.tracked_files(tmp_path, "*.md")) == {"README.md", "docs/guide.md"}
55

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63     """
64     assert git_tools.tracked_files(tmp_path, "*.md") == []
65

B404 — Consider possible security implications associated with the subprocess module. 🆕

68     """The index links standalone HTML as well as markdown."""
69     import subprocess
70

B607 — Starting a process with a partial executable path 🆕

70 
71     subprocess.run(["git", "init", "-q", str(tmp_path)], check=True, timeout=120)
72     (tmp_path / "a.md").write_text("# A\n", encoding="utf-8")

B603 — subprocess call - check for execution of untrusted input. 🆕

70 
71     subprocess.run(["git", "init", "-q", str(tmp_path)], check=True, timeout=120)
72     (tmp_path / "a.md").write_text("# A\n", encoding="utf-8")

B607 — Starting a process with a partial executable path 🆕

73     (tmp_path / "b.html").write_text("<p>b</p>\n", encoding="utf-8")
74     subprocess.run(["git", "-C", str(tmp_path), "add", "a.md", "b.html"], check=True, timeout=120)
75

B603 — subprocess call - check for execution of untrusted input. 🆕

73     (tmp_path / "b.html").write_text("<p>b</p>\n", encoding="utf-8")
74     subprocess.run(["git", "-C", str(tmp_path), "add", "a.md", "b.html"], check=True, timeout=120)
75

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

75 
76     assert set(git_tools.tracked_files(tmp_path, "*.md", "*.html")) == {"a.md", "b.html"}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

48         mode = args[self.MODE_INDEX]
49         assert mode in ("dir", "git"), f"argv[{self.MODE_INDEX}] is {mode!r}, not a subcommand"
50         payload = self.payloads.get(mode, [])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103 
104     assert recorder.modes == ["dir", "git"]
105     assert result.outcome is ScannerOutcome.COMPLETED

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

104     assert recorder.modes == ["dir", "git"]
105     assert result.outcome is ScannerOutcome.COMPLETED
106     assert result.scope == "working tree and git history"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

105     assert result.outcome is ScannerOutcome.COMPLETED
106     assert result.scope == "working tree and git history"
107

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119 
120     assert recorder.modes == ["dir"]
121     assert result.outcome is ScannerOutcome.COMPLETED

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

120     assert recorder.modes == ["dir"]
121     assert result.outcome is ScannerOutcome.COMPLETED
122     assert result.scope == "working tree (not a git repository)"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

121     assert result.outcome is ScannerOutcome.COMPLETED
122     assert result.scope == "working tree (not a git repository)"
123

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

133 
134     assert "detect" not in recorder.modes
135     for call in recorder.calls:

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

135     for call in recorder.calls:
136         assert "--source" not in call
137

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

150 
151     assert [f.file_path.name for f in result.findings] == ["UNCOMMITTED.key"]
152     assert result.findings[0].category is Category.SECRETS

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

151     assert [f.file_path.name for f in result.findings] == ["UNCOMMITTED.key"]
152     assert result.findings[0].category is Category.SECRETS
153

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

161 
162     assert [f.file_path.name for f in result.findings] == ["HISTORY.key"]
163

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

175 
176     assert sorted(f.file_path.name for f in result.findings) == ["gone.key", "live.key"]
177

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

187     result = _scanner(tmp_path, recorder).scan(tmp_path, Config())
188     assert len(result.findings) == 2
189

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

189 
190     assert len(merge_corroborating(result.findings)) == 1
191

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

213 
214     assert result.outcome is ScannerOutcome.FAILED
215     assert failing_mode in result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

214     assert result.outcome is ScannerOutcome.FAILED
215     assert failing_mode in result.reason
216

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

228 
229     assert result.outcome is ScannerOutcome.FAILED
230     assert "parse failure" in result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

229     assert result.outcome is ScannerOutcome.FAILED
230     assert "parse failure" in result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

42 
43     assert (row.score, row.letter, row.schema) == (4.2, "A-", SCHEMA)
44

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

52 
53     assert [e.score for e in read(path)] == [0.0, 1.0, 2.0, 3.0, 4.0]
54

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

59 
60     assert len(read(path)) == 1
61

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63 def test_reading_a_missing_history_is_not_an_error(tmp_path):
64     assert read(tmp_path / "nope.jsonl") == []
65

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

81 
82     assert [e.score for e in read(path)] == [1.0, 2.0]
83

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

96     (row,) = read(path)
97     assert row.score == 3.0
98

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

115 def test_no_history_says_so_rather_than_guessing():
116     assert "no scored history" in trend([])
117

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119 def test_the_first_run_has_nothing_to_compare_against():
120     assert "first scored run" in trend([_entry(4.0)])
121

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

125 
126     assert "down" in line and "3.00" in line
127

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

131 
132     assert "up" in line and "3.50" in line
133

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

138 
139     assert "unchanged" in line and "6 scored runs" in line
140

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

150 
151     assert "unchanged" in line
152     assert "down" not in line

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

151     assert "unchanged" in line
152     assert "down" not in line
153

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

155 def test_an_all_unscored_history_reports_nothing_rather_than_zero():
156     assert "no scored history" in trend([_entry(None, None), _entry(None, None)])
157

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

165     (row,) = read(path)
166     assert row.score is None and row.coverage_complete is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

8     first = path.read_text(encoding="utf-8")
9     assert "secure-code-agent:standards" in first
10

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

14 
15     assert content.startswith("# Repo rules")
16     assert content.count("<!-- secure-code-agent:standards -->") == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

15     assert content.startswith("# Repo rules")
16     assert content.count("<!-- secure-code-agent:standards -->") == 1
17

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

20     written = instructions.write_for_targets(["generic", "claude-code"], tmp_path)
21     assert len(written) == 2
22     assert "codex" in instructions.known_targets()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

21     assert len(written) == 2
22     assert "codex" in instructions.known_targets()
23     with pytest.raises(ValueError, match="Unknown target"):

B404 — Consider possible security implications associated with the subprocess module. 🆕

10 from pathlib import Path
11 from subprocess import CompletedProcess
12

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

76 
77     assert len(findings) == 2
78     assert {f.rule_id for f in findings} == {"node_md5"}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

77     assert len(findings) == 2
78     assert {f.rule_id for f in findings} == {"node_md5"}
79     assert {str(f.file_path) for f in findings} == {"/repo/app.js", "/repo/other.js"}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

78     assert {f.rule_id for f in findings} == {"node_md5"}
79     assert {str(f.file_path) for f in findings} == {"/repo/app.js", "/repo/other.js"}
80     # The shared metadata reaches every occurrence, not just the first.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

80     # The shared metadata reaches every occurrence, not just the first.
81     assert all(f.message == "MD5 is a weak hash." for f in findings)
82     assert all(f.severity is Severity.MEDIUM for f in findings)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

81     assert all(f.message == "MD5 is a weak hash." for f in findings)
82     assert all(f.severity is Severity.MEDIUM for f in findings)
83     # match_lines is [start, end]; a multi-line match keeps its end.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

84     spans = {(f.line_start, f.line_end) for f in findings}
85     assert spans == {(8, 8), (3, 4)}
86

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

100 
101     assert [f.rule_id for f in scanner.scan(tmp_path, Config()).findings] == ["express_xss"]
102

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

107     monkeypatch.setattr(scanner, "_exec", lambda *a, **k: _proc(stderr="slow", code=124))
108     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "njsscan.tool_timeout"
109

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

110     monkeypatch.setattr(scanner, "_exec", lambda *a, **k: _proc(stdout="not json"))
111     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "njsscan.tool_error"
112

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

113     monkeypatch.setattr(scanner, "_exec", lambda *a, **k: _proc(stdout=""))
114     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "njsscan.tool_error"
115

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

121 
122     assert scanner.scan(tmp_path, Config()).findings == ()
123

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

157 
158     assert [f.rule_id for f in findings] == ["Security/Eval", "Security/MarshalLoad"]
159     assert [f.line_start for f in findings] == [9, 13]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

158     assert [f.rule_id for f in findings] == ["Security/Eval", "Security/MarshalLoad"]
159     assert [f.line_start for f in findings] == [9, 13]
160     assert findings[1].severity is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

159     assert [f.line_start for f in findings] == [9, 13]
160     assert findings[1].severity is Severity.HIGH
161

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

188 
189     assert scanner.scan(tmp_path, Config()).findings[0].severity is Severity.MEDIUM
190

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

209 
210     assert seen[0][seen[0].index("--only") + 1] == "Security"
211     assert "--force-default-config" in seen[0]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

210     assert seen[0][seen[0].index("--only") + 1] == "Security"
211     assert "--force-default-config" in seen[0]
212

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

217     monkeypatch.setattr(scanner, "_exec", lambda *a, **k: _proc(stderr="slow", code=124))
218     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "rubocop.tool_timeout"
219

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

220     monkeypatch.setattr(scanner, "_exec", lambda *a, **k: _proc(stdout="{"))
221     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "rubocop.tool_error"
222

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

223     monkeypatch.setattr(scanner, "_exec", lambda *a, **k: _proc(stdout=" "))
224     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "rubocop.tool_error"
225

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

231 
232     assert scanner.scan(tmp_path, Config()).findings == ()
233

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

277 
278     assert [f.rule_id for f in findings] == ["gosec.tool_error"]
279     assert "could not load the Go packages" in findings[0].message

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

278     assert [f.rule_id for f in findings] == ["gosec.tool_error"]
279     assert "could not load the Go packages" in findings[0].message
280     assert "go command required" in findings[0].message

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

279     assert "could not load the Go packages" in findings[0].message
280     assert "go command required" in findings[0].message
281

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

293 
294     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "gosec.tool_error"
295

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

319 
320     assert len(findings) == 1
321     assert findings[0].rule_id == "G204"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

320     assert len(findings) == 1
321     assert findings[0].rule_id == "G204"
322     assert findings[0].severity is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

321     assert findings[0].rule_id == "G204"
322     assert findings[0].severity is Severity.HIGH
323     assert findings[0].line_start == 12

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

322     assert findings[0].severity is Severity.HIGH
323     assert findings[0].line_start == 12
324     assert "CWE-78" in findings[0].message

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

323     assert findings[0].line_start == 12
324     assert "CWE-78" in findings[0].message
325     assert findings[0].file_path == Path("/repo/main.go")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

324     assert "CWE-78" in findings[0].message
325     assert findings[0].file_path == Path("/repo/main.go")
326

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

339 
340     assert (finding.line_start, finding.line_end) == (12, 14)
341

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

353 
354     assert "-no-fail" in seen[0]
355     assert any(a.endswith("/...") for a in seen[0])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

354     assert "-no-fail" in seen[0]
355     assert any(a.endswith("/...") for a in seen[0])
356

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

361     monkeypatch.setattr(scanner, "_exec", lambda *a, **k: _proc(stderr="slow", code=124))
362     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "gosec.tool_timeout"
363

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

364     monkeypatch.setattr(scanner, "_exec", lambda *a, **k: _proc(stdout="<html>"))
365     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "gosec.tool_error"
366

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

367     monkeypatch.setattr(scanner, "_exec", lambda *a, **k: _proc(stdout=""))
368     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "gosec.tool_error"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

31 
32     assert Category.CODE_VULNERABILITIES in covered
33     assert Category.CRYPTO in covered

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

32     assert Category.CODE_VULNERABILITIES in covered
33     assert Category.CRYPTO in covered
34     assert Category.SUPPLY_CHAIN in covered

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

33     assert Category.CRYPTO in covered
34     assert Category.SUPPLY_CHAIN in covered
35

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

39     unexamined Terraform file 5.0."""
40     assert Category.CONFIG_IAC not in categories_for_scanner("builtin_rules")
41

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

45     gitleaks and trufflehog are the secrets scanners."""
46     assert Category.SECRETS not in categories_for_scanner("builtin_rules")
47

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

50     """Silence, not a guess."""
51     assert categories_for_scanner("a-scanner-that-does-not-exist") == frozenset()
52

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

54 def test_the_lookup_is_case_insensitive_on_the_scanner_name():
55     assert categories_for_scanner("BUILTIN_RULES") == categories_for_scanner("builtin_rules")
56

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

66         actual = {entry.category for (name, _r), entry in _MAP.items() if name == scanner}
67         assert claimed == actual, scanner

B404 — Consider possible security implications associated with the subprocess module. 🆕

33 import fnmatch
34 import subprocess
35 from pathlib import Path

B607 — Starting a process with a partial executable path 🆕

47     """Repository-relative paths of tracked files, as findings carry them."""
48     r = subprocess.run(
49         ["git", "ls-files"],
50         cwd=REPO,
51         check=True,
52         capture_output=True,
53         text=True,
54         timeout=120,
55     )
56     return [line for line in r.stdout.splitlines() if line]

B603 — subprocess call - check for execution of untrusted input. 🆕

47     """Repository-relative paths of tracked files, as findings carry them."""
48     r = subprocess.run(
49         ["git", "ls-files"],
50         cwd=REPO,
51         check=True,
52         capture_output=True,
53         text=True,
54         timeout=120,
55     )
56     return [line for line in r.stdout.splitlines() if line]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

76     """A parse that yielded nothing would make the check below vacuous."""
77     assert _declared_globs(SCIGNORE.read_text(encoding="utf-8")), (
78         f"no paths: globs parsed out of {SCIGNORE}"
79     )
80

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

90     paths = ["src/secure_code_audit/scanners/_execution.py", "tests/unit/test_x.py"]
91     assert _glob_matches_any("*/src/secure_code_audit/scanners/_execution.py", paths)
92     assert not _glob_matches_any("*/src/secure_code_audit/scanners/base.py", paths), (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

91     assert _glob_matches_any("*/src/secure_code_audit/scanners/_execution.py", paths)
92     assert not _glob_matches_any("*/src/secure_code_audit/scanners/base.py", paths), (
93         "the detector called a stale glob matched"
94     )
95

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103     """Prevents a suppression that silently stopped covering anything."""
104     assert _glob_matches_any(glob, _tracked_paths()), (
105         f".scignore.yaml entry #{entry} ({rule_id}) has paths glob {glob!r}, "
106         "which matches no tracked file. Either the code moved and the glob "
107         "must follow it, or the suppression has outlived its subject and "
108         "should be deleted."
109     )

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

49 
50     assert report.overall is None, (
51         f"a run that scanned no code graded {report.overall}. Nothing was "
52         "examined, so there is nothing to be perfect about."
53     )
54     assert report.letter is None, report.letter

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

53     )
54     assert report.letter is None, report.letter
55     assert all(grade is None for grade in report.per_category.values()), report.per_category

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

54     assert report.letter is None, report.letter
55     assert all(grade is None for grade in report.per_category.values()), report.per_category
56

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

66 
67     assert report.overall == 5.0
68     assert report.letter == "A+"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

67     assert report.overall == 5.0
68     assert report.letter == "A+"
69

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

81 
82     assert report.per_category[Category.SECRETS] is not None
83     assert report.overall is not None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82     assert report.per_category[Category.SECRETS] is not None
83     assert report.overall is not None
84     assert report.overall < 5.0, report.overall

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

83     assert report.overall is not None
84     assert report.overall < 5.0, report.overall
85

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

91 
92     assert scanned_and_clean.per_category[Category.CRYPTO] == 5.0
93     assert unscanned_and_clean.per_category[Category.CRYPTO] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

92     assert scanned_and_clean.per_category[Category.CRYPTO] == 5.0
93     assert unscanned_and_clean.per_category[Category.CRYPTO] is None
94

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

107 
108     assert not result.passed, "a min_score floor was met by scanning nothing"
109     assert "min_score" in result.tripped

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

108     assert not result.passed, "a min_score floor was met by scanning nothing"
109     assert "min_score" in result.tripped
110     assert "nothing measurable was scanned" in " ".join(result.reasons)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

109     assert "min_score" in result.tripped
110     assert "nothing measurable was scanned" in " ".join(result.reasons)
111

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

116 
117     assert evaluate_gates([], report, {"min_score": 3.0}).passed
118

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

144 
145     assert not result.passed, (
146         "a configured severity gate was satisfied by a run that measured nothing; "
147         "the build goes green when the audit never happened"
148     )
149     assert "nothing_measured" in result.tripped, result.tripped

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

148     )
149     assert "nothing_measured" in result.tripped, result.tripped
150     assert "nothing" in " ".join(result.reasons).lower(), result.reasons

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

149     assert "nothing_measured" in result.tripped, result.tripped
150     assert "nothing" in " ".join(result.reasons).lower(), result.reasons
151

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

165 
166     assert result.passed
167     assert result.tripped == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

166     assert result.passed
167     assert result.tripped == ()
168

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

179 
180     assert result.passed, result.reasons
181     assert result.enforced, "the gate must still count as enforced"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

180     assert result.passed, result.reasons
181     assert result.enforced, "the gate must still count as enforced"
182

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

194 
195     assert len(result.reasons) == len(result.tripped), (result.tripped, result.reasons)
196

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

229 
230     assert report.per_category[Category.POLICY_DOCS] is None, (
231         "a tool-unavailable notice graded its own category 5.0; the only "
232         "'evidence' was the tool saying it could not look"
233     )
234     assert report.overall is None, f"overall {report.overall} on a run that scanned nothing"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

233     )
234     assert report.overall is None, f"overall {report.overall} on a run that scanned nothing"
235     assert report.letter is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

234     assert report.overall is None, f"overall {report.overall} on a run that scanned nothing"
235     assert report.letter is None
236

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

248 
249     assert report.per_category_count[Category.POLICY_DOCS] == 1
250     assert report.per_severity_count[Severity.INFORMATIONAL] == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

249     assert report.per_category_count[Category.POLICY_DOCS] == 1
250     assert report.per_severity_count[Severity.INFORMATIONAL] == 1
251

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

263 
264     assert report.per_category[Category.POLICY_DOCS] == 5.0
265     assert report.overall == 5.0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

264     assert report.per_category[Category.POLICY_DOCS] == 5.0
265     assert report.overall == 5.0
266

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

278 
279     assert report.per_category[Category.SECRETS] is not None
280     assert report.overall is not None and report.overall < 5.0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

279     assert report.per_category[Category.SECRETS] is not None
280     assert report.overall is not None and report.overall < 5.0
281

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

294 
295     assert report.per_category[Category.CODE_VULNERABILITIES] is None
296     assert report.overall is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

295     assert report.per_category[Category.CODE_VULNERABILITIES] is None
296     assert report.overall is None
297

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

310 
311     assert report.overall == 0.0, report.overall
312     assert report.loc_scanned == 3

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

311     assert report.overall == 0.0, report.overall
312     assert report.loc_scanned == 3
313     assert Path(tmp_path / "app.py").exists()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

312     assert report.loc_scanned == 3
313     assert Path(tmp_path / "app.py").exists()

B404 — Consider possible security implications associated with the subprocess module. 🆕

17 import shutil
18 import subprocess
19 import sys

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

61     command = _semgrep()
62     assert command is not None
63     result = subprocess.run(

B603 — subprocess call - check for execution of untrusted input. 🆕

62     assert command is not None
63     result = subprocess.run(
64         [
65             *command,
66             "--config",
67             str(offline_ruleset_path()),
68             "--no-rewrite-rule-ids",
69             "--metrics=off",
70             "--json",
71             "--quiet",
72             str(target),
73         ],
74         check=False,
75         capture_output=True,
76         text=True,
77         timeout=300,
78     )
79     assert result.stdout, f"semgrep produced no JSON: {result.stderr[:400]}"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

78     )
79     assert result.stdout, f"semgrep produced no JSON: {result.stderr[:400]}"
80     return {finding["check_id"] for finding in json.loads(result.stdout)["results"]}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

92 
93     assert declared - fired == set(), "rules that never fire are worse than no rules"
94

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

99     # rule matching the shape of a call rather than its danger fails here.
100     assert _scan(tmp_path, "negative") == set()
101

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

105     command = _semgrep()
106     assert command is not None
107     result = subprocess.run(

B603 — subprocess call - check for execution of untrusted input. 🆕

106     assert command is not None
107     result = subprocess.run(
108         [*command, "--validate", "--config", str(offline_ruleset_path()), "--metrics=off"],
109         check=False,
110         capture_output=True,
111         text=True,
112         timeout=120,
113     )
114     assert result.returncode == 0, result.stderr[:500]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

113     )
114     assert result.returncode == 0, result.stderr[:500]
115

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119         rule_id = rule["id"]
120         assert rule_id.startswith("sca.offline."), rule_id
121         meta = rule.get("metadata") or {}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

124         # to arrive unmapped.
125         assert str(meta.get("cwe", "")).startswith("CWE-"), f"{rule_id} has no CWE"
126         assert meta.get("owasp"), f"{rule_id} has no OWASP bucket"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

125         assert str(meta.get("cwe", "")).startswith("CWE-"), f"{rule_id} has no CWE"
126         assert meta.get("owasp"), f"{rule_id} has no OWASP bucket"
127         assert meta.get("confidence") in {"HIGH", "MEDIUM", "LOW"}, rule_id

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

126         assert meta.get("owasp"), f"{rule_id} has no OWASP bucket"
127         assert meta.get("confidence") in {"HIGH", "MEDIUM", "LOW"}, rule_id
128         assert meta.get("version"), f"{rule_id} carries no version"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

127         assert meta.get("confidence") in {"HIGH", "MEDIUM", "LOW"}, rule_id
128         assert meta.get("version"), f"{rule_id} carries no version"
129         assert rule.get("severity") in {"ERROR", "WARNING", "INFO"}, rule_id

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

128         assert meta.get("version"), f"{rule_id} carries no version"
129         assert rule.get("severity") in {"ERROR", "WARNING", "INFO"}, rule_id
130         assert rule.get("languages"), rule_id

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

129         assert rule.get("severity") in {"ERROR", "WARNING", "INFO"}, rule_id
130         assert rule.get("languages"), rule_id
131

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

153         for name in frameworks:
154             assert name not in rule["id"].lower(), f"{rule['id']} names a framework"
155     # The patterns themselves, not just the ids.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

156     for name in frameworks:
157         assert f"{name}." not in body, f"a rule pattern references {name}"
158

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

162 
163     assert profile is not None
164     assert profile.id == ruleset.PROFILE_ID

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

163     assert profile is not None
164     assert profile.id == ruleset.PROFILE_ID
165     assert profile.version == ruleset.PROFILE_VERSION

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

164     assert profile.id == ruleset.PROFILE_ID
165     assert profile.version == ruleset.PROFILE_VERSION
166     assert len(profile.digest) == 64

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

165     assert profile.version == ruleset.PROFILE_VERSION
166     assert len(profile.digest) == 64
167     assert profile.rule_count == len(_declared_rules())

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

166     assert len(profile.digest) == 64
167     assert profile.rule_count == len(_declared_rules())
168     # An audit cites the profile the way a STIG result cites its benchmark.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

168     # An audit cites the profile the way a STIG result cites its benchmark.
169     assert profile.cite().startswith(f"{ruleset.PROFILE_ID}@{ruleset.PROFILE_VERSION}")
170

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

181 
182     assert ruleset.describe(edited).digest != ruleset.describe(original).digest
183

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

185 def test_a_missing_ruleset_is_labelled_not_raised(tmp_path):
186     assert ruleset.describe(tmp_path / "absent.yaml") is None
187

B603 — subprocess call - check for execution of untrusted input. 🆕

217     bandit_lines: set[int] = set()
218     result = subprocess.run(
219         [
220             *_bandit(),
221             "-r",
222             str(target),
223             "-f",
224             "json",
225             "-q",
226             "--severity-level",
227             "low",
228             "--confidence-level",
229             "low",
230         ],
231         check=False,
232         capture_output=True,
233         text=True,
234         timeout=300,
235     )
236     if result.stdout:

B603 — subprocess call - check for execution of untrusted input. 🆕

238 
239     ours = subprocess.run(
240         [
241             *_semgrep(),
242             "--config",
243             str(offline_ruleset_path()),
244             "--no-rewrite-rule-ids",
245             "--metrics=off",
246             "--json",
247             "--quiet",
248             str(target),
249         ],
250         check=False,
251         capture_output=True,
252         text=True,
253         timeout=300,
254     )
255     duplicated = {

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

260 
261     assert duplicated == set(), (
262         f"these Python rules duplicate Bandit, which is already in the floor "
263         f"and already offline: {sorted(duplicated)}"
264     )
265

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

278 
279     assert {"javascript", "go", "ruby", "java"} <= languages
280     for rule in _declared_rules():

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

283             continue
284         assert (rule.get("metadata") or {}).get("covers-gap"), (
285             f"{rule['id']} is a {language} rule, and "
286             f"{_LANGUAGES_WITH_AN_OFFLINE_TOOL[language]} already scans "
287             f"{language} offline. State the gap it leaves in a `covers-gap` "
288             f"metadata field, or delete the rule."
289         )
290

B603 — subprocess call - check for execution of untrusted input. 🆕

323     """Our rule ids for one language, mapped to the line each fired on."""
324     result = subprocess.run(
325         [
326             *_semgrep(),
327             "--config",
328             str(offline_ruleset_path()),
329             "--no-rewrite-rule-ids",
330             "--metrics=off",
331             "--json",
332             "--quiet",
333             str(target),
334         ],
335         check=False,
336         capture_output=True,
337         text=True,
338         timeout=300,
339     )
340     return {

B603 — subprocess call - check for execution of untrusted input. 🆕

362 
363     result = subprocess.run(
364         [*_njsscan(), "--json", str(target)],
365         check=False,
366         capture_output=True,
367         text=True,
368         timeout=300,
369     )
370     payload = json.loads(result.stdout)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

382 
383     assert duplicated == set(), (
384         f"these JavaScript rules duplicate njsscan, which is already in the "
385         f"floor and already offline: {sorted(duplicated)}"
386     )
387

B607 — Starting a process with a partial executable path 🆕

401 
402     result = subprocess.run(
403         [
404             "rubocop",
405             "--only",
406             "Security",
407             "--format",
408             "json",
409             "--force-default-config",
410             str(target),
411         ],
412         check=False,
413         capture_output=True,
414         text=True,
415         timeout=300,
416     )
417     their_lines = {

B603 — subprocess call - check for execution of untrusted input. 🆕

401 
402     result = subprocess.run(
403         [
404             "rubocop",
405             "--only",
406             "Security",
407             "--format",
408             "json",
409             "--force-default-config",
410             str(target),
411         ],
412         check=False,
413         capture_output=True,
414         text=True,
415         timeout=300,
416     )
417     their_lines = {

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

426 
427     assert duplicated == set(), (
428         f"these Ruby rules duplicate RuboCop's Security cops, which are "
429         f"already in the floor and already offline: {sorted(duplicated)}"
430     )

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

136 
137     assert len(resolved) == 1, (
138         f"{action} is pinned {len(resolved)} different ways across {len(pins)} "
139         f"reference(s); a bump updated some and missed others:\n"
140         + "\n".join(f"  {pin}" for pin in sorted(pins, key=lambda p: (str(p.path), p.line)))
141     )
142

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

152 
153     assert len(found) >= 4, (
154         f"only {len(found)} YAML file(s) found under .github/: {found}. "
155         f"The repository has workflows and at least one composite action; "
156         f"finding almost none means the sweep is looking in the wrong place."
157     )
158

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

162     above green without anything being fixed."""
163     assert len(_PINS) >= 15, (
164         f"only {len(_PINS)} pinned `uses:` reference(s) parsed out of "
165         f"{len(_workflow_sources())} file(s). The workflows pin far more than "
166         f"that, so the pattern has drifted from what they write."
167     )
168

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

168 
169     assert len(_REPEATED) >= 4, (
170         f"only {len(_REPEATED)} action(s) are referenced more than once: "
171         f"{_REPEATED}. With fewer, nothing can disagree and the check means "
172         f"nothing."
173     )
174

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

179     for action, reason in _DELIBERATELY_DIVERGENT_PINS.items():
180         assert action in _BY_ACTION, (
181             f"{action} is allowed to diverge but is not referenced anywhere under .github/"
182         )
183         assert reason.strip(), f"{action} is exempted with no stated reason"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

182         )
183         assert reason.strip(), f"{action} is exempted with no stated reason"

B404 — Consider possible security implications associated with the subprocess module. 🆕

26 import re
27 import subprocess
28 from pathlib import Path

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

72     """A glob that matches nothing would make every test below vacuous."""
73     assert _workflow_files(), f"no workflow files found under {WORKFLOWS}"
74

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

78     floor = _pyproject()["tool"]["coverage"]["report"]["fail_under"]
79     assert isinstance(floor, (int, float))
80     assert floor >= 92, (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

79     assert isinstance(floor, (int, float))
80     assert floor >= 92, (
81         f"the house coverage floor is 92; pyproject declares {floor}. "
82         "Lowering it is a decision, not a fix."
83     )
84

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

101     found = _FAIL_UNDER.search(_commands(violating))
102     assert found is not None, "the detector missed a real --cov-fail-under in a run: line"
103     assert found.group("value") == "85"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102     assert found is not None, "the detector missed a real --cov-fail-under in a run: line"
103     assert found.group("value") == "85"
104

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

111     )
112     assert _FAIL_UNDER.search(_commands(clean)) is None, (
113         "the detector fired on a comment that only names the flag"
114     )
115

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

125     found = _FAIL_UNDER.search(_commands(workflow))
126     assert found is None, (
127         f"{workflow.relative_to(REPO)} passes --cov-fail-under"
128         f"{'=' + found.group('value') if found.group('value') else ''}, which "
129         "overrides fail_under in pyproject.toml. Remove the flag and let the "
130         "declared floor govern."
131     )
132

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

166     """
167     assert _INVOCATION.search("python -m pytest -q")
168     assert _INVOCATION.search("  pytest tests/unit/x.py")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

167     assert _INVOCATION.search("python -m pytest -q")
168     assert _INVOCATION.search("  pytest tests/unit/x.py")
169     assert not _INVOCATION.search("python -m build -o cache_dir=.pytest-cache-ci")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

168     assert _INVOCATION.search("  pytest tests/unit/x.py")
169     assert not _INVOCATION.search("python -m build -o cache_dir=.pytest-cache-ci")
170

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

171     total = sum(len(_pytest_commands(w)) for w in _workflow_files())
172     assert total >= 5, f"expected at least 5 pytest invocations across CI, found {total}"
173

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

193     ]
194     assert silent == [], (
195         f"{workflow.relative_to(REPO)} has pytest invocations that say nothing "
196         f"about coverage: {silent}. Add --no-cov if the step is not the one "
197         "measuring it, or --cov if it is."
198     )
199

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

226     addopts = _addopts()
227     assert "--cov=" in addopts, f"addopts does not enable coverage at all: {addopts!r}"
228     assert _writes_a_consumable_artifact(addopts), (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

227     assert "--cov=" in addopts, f"addopts does not enable coverage at all: {addopts!r}"
228     assert _writes_a_consumable_artifact(addopts), (
229         f"addopts reports coverage but writes no artifact a consumer reads: "
230         f"{addopts!r}. One of {CONSUMED_ARTIFACTS} must be produced; "
231         "--cov-report=term alone is invisible to every tool."
232     )
233

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

244     ignored = (REPO / ".gitignore").read_text(encoding="utf-8")
245     assert "coverage.xml" in ignored, "coverage.xml is written by every run and must be gitignored"
246

B607 — Starting a process with a partial executable path 🆕

246 
247     tracked = subprocess.run(
248         ["git", "ls-files", "coverage.xml", "lcov.info", "coverage/lcov.info"],
249         cwd=REPO,
250         check=True,
251         capture_output=True,
252         text=True,
253         timeout=120,
254     ).stdout.split()
255     assert tracked == [], f"a coverage artifact is tracked in git: {tracked}"

B603 — subprocess call - check for execution of untrusted input. 🆕

246 
247     tracked = subprocess.run(
248         ["git", "ls-files", "coverage.xml", "lcov.info", "coverage/lcov.info"],
249         cwd=REPO,
250         check=True,
251         capture_output=True,
252         text=True,
253         timeout=120,
254     ).stdout.split()
255     assert tracked == [], f"a coverage artifact is tracked in git: {tracked}"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

254     ).stdout.split()
255     assert tracked == [], f"a coverage artifact is tracked in git: {tracked}"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

64 
65     assert set(found) == {"fail_on_severity", "fail_on_category"}, sorted(found)
66

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

71 
72     assert declared == set(_schema_vocabulary_gates()), (
73         f"table serves {sorted(declared)}, schema declares "
74         f"{sorted(_schema_vocabulary_gates())}. A vocabulary gate missing from "
75         "_VOCABULARY_GATES is one with its own hand-rolled evaluator, which is "
76         "how the severity/category pair came to be duplicated."
77     )
78

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

85         value = getattr(one, gate.attribute)
86         assert hasattr(value, "value"), f"{gate.name} names {gate.attribute!r}, which has no .value"
87

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

105 
106     assert not result.passed, f"{gate.name} ignored an upper-case configured value"
107     assert gate.name in result.tripped

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

106     assert not result.passed, f"{gate.name} ignored an upper-case configured value"
107     assert gate.name in result.tripped
108

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

118 
119     assert result.passed, f"{gate.name} tripped on a suppressed finding: {result.reasons}"
120

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

127 
128     assert evaluate_gates([finding], report, {}).passed
129     assert evaluate_gates([finding], report, {gate.name: []}).passed

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

128     assert evaluate_gates([finding], report, {}).passed
129     assert evaluate_gates([finding], report, {gate.name: []}).passed
130

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

144 
145     assert "1 finding(s)" in reason, reason
146     assert gate.phrase in reason, f"{gate.name} reason {reason!r} omits {gate.phrase!r}"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

145     assert "1 finding(s)" in reason, reason
146     assert gate.phrase in reason, f"{gate.name} reason {reason!r} omits {gate.phrase!r}"
147     assert getattr(finding, gate.attribute).value in reason, reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

146     assert gate.phrase in reason, f"{gate.name} reason {reason!r} omits {gate.phrase!r}"
147     assert getattr(finding, gate.attribute).value in reason, reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

72     """A glob that matched nothing would make both checks below vacuous."""
73     assert len(_python_sources()) >= 20, len(_python_sources())
74

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

90 
91     assert offenders == [], (
92         f"a dependency advisory is built outside {DEPENDENCY_CONSTRUCTOR}(): {offenders}. "
93         "Call it instead — the DEPENDENCIES category is what keeps these off the "
94         "code-condition score, and a drifted copy is scored as shipped code."
95     )
96

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

105 
106     assert offenders == [], (
107         f"a suppressions finding is built outside {SUPPRESSION_CONSTRUCTOR}(): "
108         f"{offenders}. Both reporters share one constructor; pass what differs."
109     )
110

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

131 
132     assert name in defined, f"{name} is gone from {module}; the lint above now proves nothing"
133

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

159 
160     assert _calls_with_keywords(offending, required) == [("scan", 2)]
161

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

173 
174     assert _calls_with_keywords(innocent, required) == []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

47 
48     assert is_excluded(path, tmp_path, DEFAULT_EXCLUDES), (
49         f"{DEFAULT_OUTPUTS[key]} would be scanned as source"
50     )
51

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

72 
73     assert is_excluded(stored, tmp_path, DEFAULT_EXCLUDES), (
74         f"a stored copy of {name} would be scanned as source"
75     )
76

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

83 
84     assert is_excluded(path, tmp_path, DEFAULT_EXCLUDES)
85

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

94 
95     assert is_excluded(path, tmp_path, DEFAULT_EXCLUDES)
96

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103 
104     assert is_excluded(path, tmp_path, DEFAULT_EXCLUDES)
105

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

121 
122     assert not is_excluded(path, tmp_path, DEFAULT_EXCLUDES)
123

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

130 
131     assert not is_excluded(path, tmp_path, DEFAULT_EXCLUDES)
132

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

147     names = [field.name for field in fields(_OutputPaths)]
148     assert names, "no output fields found; the check would be vacuous"
149     paths = _OutputPaths(**{name: tmp_path / "out" / f"{name}.custom" for name in names})

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

153     missing = [name for name in names if (tmp_path / "out" / f"{name}.custom").resolve() not in own]
154     assert not missing, f"written but readable by the next run: {missing}"
155

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

173 
174     assert load().exclude_patterns == ("node_modules/",)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

118 def test_the_schema_name_is_what_ma_matches_on():
119     assert _document()["schema"] == "secure-code-agent/security-pillar"
120

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

124     release, not an edit — see the module docstring for the order."""
125     assert _document()["schema_version"] == 2
126

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

138 
139     assert set(_document()) - v1_keys == {"scoring_model"}
140

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

144 
145     assert _document()["scoring_model"] == SCORING_MODEL
146

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

150     share one scoring model. Emitting it would assert they did."""
151     assert _document()["scoring_model"] >= 2
152

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

159 def test_no_top_level_key_is_missing():
160     assert set(_document()) >= set(TOP_LEVEL)
161

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

167 
168     assert not extra, f"new keys in a v1 document — bump schema_version instead: {sorted(extra)}"
169

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

174 
175     assert isinstance(value, TOP_LEVEL[key]), (
176         f"{key} is {type(value).__name__}; MA drops the whole pillar on a mistyped field"
177     )
178

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

183 
184     assert set(obj) == set(NESTED[parent]), f"{parent} keys changed"
185     for key, types in NESTED[parent].items():

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

185     for key, types in NESTED[parent].items():
186         assert isinstance(obj[key], types), f"{parent}.{key} is {type(obj[key]).__name__}"
187

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

194 
195     assert json.loads(path.read_text(encoding="utf-8")) == _document() or True
196     # Equality can differ on `generated`; what matters is that it parses.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

196     # Equality can differ on `generated`; what matters is that it parses.
197     assert isinstance(json.loads(path.read_text(encoding="utf-8")), dict)
198

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

225 
226     assert _document()["producer"]["version"] == __version__
227

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

229 def test_producer_tool_is_the_name_ma_keys_on():
230     assert _document()["producer"]["tool"] == "secure-code-agent"
231

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

239 
240     assert version and version.strip() == version
241

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

250     from, and rejects the document if they disagree."""
251     assert _document()["posture"] in {"healthy", "managed debt", "unmanaged debt", "unverified"}
252

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

258 
259     assert document["condition"] is None
260     assert document["posture"] == "unverified"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

259     assert document["condition"] is None
260     assert document["posture"] == "unverified"
261     assert document["evidence_reasons"], "a withheld condition must say why"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

260     assert document["posture"] == "unverified"
261     assert document["evidence_reasons"], "a withheld condition must say why"
262

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

270 
271     assert condition is not None
272     mean = (practice_level + condition) / 2

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

274 
275     assert mean not in numeric
276

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

286 
287     assert set(counts) <= vocabulary, f"unknown severity key: {set(counts) - vocabulary}"
288     assert all(isinstance(v, int) for v in counts.values())

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

287     assert set(counts) <= vocabulary, f"unknown severity key: {set(counts) - vocabulary}"
288     assert all(isinstance(v, int) for v in counts.values())
289

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

294     for name, axis in _document()["reported_not_scored"].items():
295         assert set(axis) == {"count", "loc", "worst_severity"}, name
296         assert isinstance(axis["count"], int), name

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

295         assert set(axis) == {"count", "loc", "worst_severity"}, name
296         assert isinstance(axis["count"], int), name
297         assert axis["loc"] is None or isinstance(axis["loc"], int), name

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

296         assert isinstance(axis["count"], int), name
297         assert axis["loc"] is None or isinstance(axis["loc"], int), name
298         assert axis["worst_severity"] is None or axis["worst_severity"] in {

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

297         assert axis["loc"] is None or isinstance(axis["loc"], int), name
298         assert axis["worst_severity"] is None or axis["worst_severity"] in {
299             s.value for s in Severity
300         }, name
301

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

305     vocabulary anyway, because the obvious next field to add would."""
306     assert {c.value for c in Category} >= {"secrets", "code_vulnerabilities", "dependencies"}

B404 — Consider possible security implications associated with the subprocess module. 🆕

1 import json
2 from subprocess import CompletedProcess
3

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

34 
35     assert findings == ()
36     assert captured[0][1:3] == [str(tmp_path), "--format=json"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

35     assert findings == ()
36     assert captured[0][1:3] == [str(tmp_path), "--format=json"]
37

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

50 
51     assert captured[0][1:4] == ["--locked", str(tmp_path), "--format=json"]
52

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

66 
67     assert len(captured) == 1
68     assert captured[0][1:4] == ["-r", str(requirements), "--format=json"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

67     assert len(captured) == 1
68     assert captured[0][1:4] == ["-r", str(requirements), "--format=json"]
69

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

81     # The outcome is stated, not inferred from the finding's name.
82     assert result.outcome is ScannerOutcome.FAILED
83     assert "JSON parse failure" in result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82     assert result.outcome is ScannerOutcome.FAILED
83     assert "JSON parse failure" in result.reason
84     assert result.findings[0].severity is Severity.INFORMATIONAL

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

83     assert "JSON parse failure" in result.reason
84     assert result.findings[0].severity is Severity.INFORMATIONAL
85

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

91     # either — hence a stated outcome carrying its reason.
92     assert result.outcome is ScannerOutcome.NOT_APPLICABLE
93     assert "No supported Python dependency input" in result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

92     assert result.outcome is ScannerOutcome.NOT_APPLICABLE
93     assert "No supported Python dependency input" in result.reason
94

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102 
103     assert unavailable[0].rule_id == "pip_audit.tool_unavailable"
104     assert invalid_mode[0].rule_id == "pip_audit.tool_error"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103     assert unavailable[0].rule_id == "pip_audit.tool_unavailable"
104     assert invalid_mode[0].rule_id == "pip_audit.tool_error"
105     assert missing[0].rule_id == "pip_audit.tool_error"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

104     assert invalid_mode[0].rule_id == "pip_audit.tool_error"
105     assert missing[0].rule_id == "pip_audit.tool_error"
106

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

120 
121     assert findings == ()
122     assert captured[0] == ["pip-audit", "--format=json"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

121     assert findings == ()
122     assert captured[0] == ["pip-audit", "--format=json"]
123     assert invalid[0].rule_id == "pip_audit.tool_error"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122     assert captured[0] == ["pip-audit", "--format=json"]
123     assert invalid[0].rule_id == "pip_audit.tool_error"
124

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

142 
143     assert findings == ()
144     assert len(captured) == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

143     assert findings == ()
144     assert len(captured) == 1
145     assert str(requirement) in captured[0]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

144     assert len(captured) == 1
145     assert str(requirement) in captured[0]
146

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

155     # both fail coverage, but only one tells an operator to raise the timeout.
156     assert scanner.scan(tmp_path, _config()).outcome is ScannerOutcome.TIMED_OUT
157     monkeypatch.setattr(

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

159     )
160     assert scanner.scan(tmp_path, _config()).outcome is ScannerOutcome.FAILED
161     monkeypatch.setattr(scanner, "_exec", lambda *args, **kwargs: _proc())

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

161     monkeypatch.setattr(scanner, "_exec", lambda *args, **kwargs: _proc())
162     assert scanner.scan(tmp_path, _config()).outcome is ScannerOutcome.FAILED
163

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

180     finding = scanner.scan(tmp_path, _config()).findings[0]
181     assert finding.rule_id == "pip_audit.GHSA-demo"
182     assert "Fix in: 1.1" in finding.message

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

181     assert finding.rule_id == "pip_audit.GHSA-demo"
182     assert "Fix in: 1.1" in finding.message
183

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

191 
192     assert result.outcome is ScannerOutcome.FAILED
193     assert "root must be an object or array" in result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

192     assert result.outcome is ScannerOutcome.FAILED
193     assert "root must be an object or array" in result.reason

B404 — Consider possible security implications associated with the subprocess module. 🆕

16 import os
17 import subprocess
18 from pathlib import Path

B607 — Starting a process with a partial executable path 🆕

32     for args in (["init", "-q"], ["add", "-A"]):
33         subprocess.run(
34             ["git", "-C", str(root), *args], check=True, capture_output=True, timeout=120
35         )
36     # Inherited environment plus `--no-verify`: this machine runs a

B603 — subprocess call - check for execution of untrusted input. 🆕

32     for args in (["init", "-q"], ["add", "-A"]):
33         subprocess.run(
34             ["git", "-C", str(root), *args], check=True, capture_output=True, timeout=120
35         )
36     # Inherited environment plus `--no-verify`: this machine runs a

B607 — Starting a process with a partial executable path 🆕

38     # the feature failing rather than the fixture.
39     subprocess.run(
40         [
41             "git",
42             "-C",
43             str(root),
44             "-c",
45             "user.email=t@example.invalid",
46             "-c",
47             "user.name=t",
48             "commit",
49             "--no-verify",
50             "-qm",
51             "base",
52         ],
53         check=True,
54         capture_output=True,
55         env={**os.environ, "GIT_IDENTITY_OVERRIDE": "1"},
56         timeout=120,
57     )
58     return root

B603 — subprocess call - check for execution of untrusted input. 🆕

38     # the feature failing rather than the fixture.
39     subprocess.run(
40         [
41             "git",
42             "-C",
43             str(root),
44             "-c",
45             "user.email=t@example.invalid",
46             "-c",
47             "user.name=t",
48             "commit",
49             "--no-verify",
50             "-qm",
51             "base",
52         ],
53         check=True,
54         capture_output=True,
55         env={**os.environ, "GIT_IDENTITY_OVERRIDE": "1"},
56         timeout=120,
57     )
58     return root

B607 — Starting a process with a partial executable path 🆕

61 def _head(root: Path) -> str:
62     return subprocess.run(
63         ["git", "-C", str(root), "rev-parse", "HEAD"],
64         capture_output=True,
65         text=True,
66         check=True,
67         timeout=120,
68     ).stdout.strip()
69

B603 — subprocess call - check for execution of untrusted input. 🆕

61 def _head(root: Path) -> str:
62     return subprocess.run(
63         ["git", "-C", str(root), "rev-parse", "HEAD"],
64         capture_output=True,
65         text=True,
66         check=True,
67         timeout=120,
68     ).stdout.strip()
69

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102 
103     assert scope.known
104     assert scope.conformant

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103     assert scope.known
104     assert scope.conformant
105     assert scope.collateral == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

104     assert scope.conformant
105     assert scope.collateral == ()
106

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

116 
117     assert scope.known
118     assert not scope.conformant

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

117     assert scope.known
118     assert not scope.conformant
119     assert scope.collateral == ("src/b.py",)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

118     assert not scope.conformant
119     assert scope.collateral == ("src/b.py",)
120     assert "EXCEEDED" in scope.headline()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119     assert scope.collateral == ("src/b.py",)
120     assert "EXCEEDED" in scope.headline()
121

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

130 
131     assert "src/brand_new.py" in scope.collateral
132

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

143 
144     assert "before.json" not in scope.collateral
145

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

157 
158     assert not scope.known
159     assert not scope.conformant

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

158     assert not scope.known
159     assert not scope.conformant
160     assert expect in (scope.reason or "")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

159     assert not scope.conformant
160     assert expect in (scope.reason or "")
161

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

163 def test_an_unknown_scope_says_so_in_its_headline():
164     assert "unknown" in Scope(reason="no baseline commit recorded").headline()
165

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

180 
181     assert "12 finding(s), none triaged" in headline
182     assert "starting position" in headline

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

181     assert "12 finding(s), none triaged" in headline
182     assert "starting position" in headline
183     assert "F" not in headline

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

182     assert "starting position" in headline
183     assert "F" not in headline
184

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

186 def test_a_triaged_run_reports_its_grade_normally():
187     assert _verdict(untriaged=0, grade="A").headline() == "score 0.00 (A)"
188

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

195 
196     assert verdict.verified_grade == "B"
197     assert verdict.reasons == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

196     assert verdict.verified_grade == "B"
197     assert verdict.reasons == ()
198

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

208 
209     assert callable(mcp_server.main)
210

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

222 
223     assert result["audit_ran"] is True
224     assert result["work_order"], "the work order is the product; it must come back"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

223     assert result["audit_ran"] is True
224     assert result["work_order"], "the work order is the product; it must come back"
225     assert "producer" in result

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

224     assert result["work_order"], "the work order is the product; it must come back"
225     assert "producer" in result
226

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

246 
247     assert added <= {".secure-code/history.jsonl"}, f"left behind: {sorted(added)}"
248     assert not any(name.startswith("secure-code-report") for name in added)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

247     assert added <= {".secure-code/history.jsonl"}, f"left behind: {sorted(added)}"
248     assert not any(name.startswith("secure-code-report") for name in added)
249

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

255 
256     assert result["audit_ran"] is False
257     assert "does not exist" in result["error"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

256     assert result["audit_ran"] is False
257     assert "does not exist" in result["error"]
258

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

268 
269     assert json.loads(out.read_text(encoding="utf-8"))["commit"] == _head(root)
270

B607 — Starting a process with a partial executable path 🆕

287     )
288     subprocess.run(
289         ["git", "-C", str(root), "add", "-A"], check=True, capture_output=True, timeout=120
290     )
291     subprocess.run(

B603 — subprocess call - check for execution of untrusted input. 🆕

287     )
288     subprocess.run(
289         ["git", "-C", str(root), "add", "-A"], check=True, capture_output=True, timeout=120
290     )
291     subprocess.run(

B607 — Starting a process with a partial executable path 🆕

290     )
291     subprocess.run(
292         [
293             "git",
294             "-C",
295             str(root),
296             "-c",
297             "user.email=t@example.invalid",
298             "-c",
299             "user.name=t",
300             "commit",
301             "--no-verify",
302             "-qm",
303             "old",
304         ],
305         check=True,
306         capture_output=True,
307         env={**os.environ, "GIT_IDENTITY_OVERRIDE": "1"},
308         timeout=120,
309     )
310     since = _head(root)

B603 — subprocess call - check for execution of untrusted input. 🆕

290     )
291     subprocess.run(
292         [
293             "git",
294             "-C",
295             str(root),
296             "-c",
297             "user.email=t@example.invalid",
298             "-c",
299             "user.name=t",
300             "commit",
301             "--no-verify",
302             "-qm",
303             "old",
304         ],
305         check=True,
306         capture_output=True,
307         env={**os.environ, "GIT_IDENTITY_OVERRIDE": "1"},
308         timeout=120,
309     )
310     since = _head(root)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

333 
334     assert files == {"old.py", "new.py"}
335

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

344 
345     assert files == {"new.py"}, "the unchanged file's finding leaked into a scoped report"
346

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

354 
355     assert payload["score"]["verified_grade"] is None
356     assert any("scoped to files changed" in r for r in payload["score"]["evidence_reasons"])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

355     assert payload["score"]["verified_grade"] is None
356     assert any("scoped to files changed" in r for r in payload["score"]["evidence_reasons"])
357

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

367 
368     assert exit_code == 2
369     assert "--changed-only" in capsys.readouterr().err

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

368     assert exit_code == 2
369     assert "--changed-only" in capsys.readouterr().err
370

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

380 
381     assert scoped["score"]["loc_scanned"] == full["score"]["loc_scanned"]
382

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

403 
404     assert "none triaged" in markdown
405     assert "starting position" in markdown

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

404     assert "none triaged" in markdown
405     assert "starting position" in markdown
406

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

421 
422     assert "none triaged" in comment
423

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

434 
435     assert "A+" in renderers._markdown(
436         [], report, GateResult(passed=True, reasons=()), [], [], verdict=verdict
437     )
438     assert "A+" in renderers._pr_comment(

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

437     )
438     assert "A+" in renderers._pr_comment(
439         [], report, GateResult(passed=True, reasons=()), verdict=verdict
440     )

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

25 
26     assert assessed.level == 1
27     assert "nothing detectable" in assessed.summary

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

26     assert assessed.level == 1
27     assert "nothing detectable" in assessed.summary
28     assert assessed.signals == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

27     assert "nothing detectable" in assessed.summary
28     assert assessed.signals == ()
29

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

41 
42     assert assessed.level == 2
43     assert any(s.path == "secure-code-agent.json" for s in assessed.signals)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

42     assert assessed.level == 2
43     assert any(s.path == "secure-code-agent.json" for s in assessed.signals)
44

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

59 
60     assert assessed.level == practice.MAX_WITHOUT_CI
61     assert assessed.caps, "a held-down level must say what held it"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

60     assert assessed.level == practice.MAX_WITHOUT_CI
61     assert assessed.caps, "a held-down level must say what held it"
62     assert "capped" in assessed.caps[0]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

61     assert assessed.caps, "a held-down level must say what held it"
62     assert "capped" in assessed.caps[0]
63

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

75 
76     assert assessed.level == 3
77     assert any("CI runs bandit" in s.signal for s in assessed.signals)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

76     assert assessed.level == 3
77     assert any("CI runs bandit" in s.signal for s in assessed.signals)
78

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

92 
93     assert assessed.level == 4
94     assert any("--fail-on-gate" in s.signal for s in assessed.signals)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

93     assert assessed.level == 4
94     assert any("--fail-on-gate" in s.signal for s in assessed.signals)
95

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

110 
111     assert assessed.level == 5
112

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

129 
130     assert assessed.level == 5
131     assert any("expiry" in s.signal for s in assessed.signals)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

130     assert assessed.level == 5
131     assert any("expiry" in s.signal for s in assessed.signals)
132

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

148     # that no security enforcement is claimed.
149     assert assessed.level == practice.MAX_WITHOUT_CI
150     assert not any("CI runs" in s.signal for s in assessed.signals)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

149     assert assessed.level == practice.MAX_WITHOUT_CI
150     assert not any("CI runs" in s.signal for s in assessed.signals)
151

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

163 
164     assert practice.assess(root).level == 3
165

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

180 
181     assert assessed.signals
182     for signal in assessed.signals:

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

182     for signal in assessed.signals:
183         assert signal.path
184         assert (root / signal.path).exists(), signal.path

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

183         assert signal.path
184         assert (root / signal.path).exists(), signal.path
185

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

201 
202     assert practice.assess(clean).level == practice.assess(dirty).level

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

25 
26     assert found == (".go", ".py"), found
27

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

37 
38     assert found == (".py",), found
39

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

49 
50     assert found == (".py",), found
51

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

56 
57     assert extensions_under(tmp_path, (".py",), ()) == (".py",)
58

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

64 
65     assert extensions_under(one, (".py", ".go"), ()) == (".go",)
66

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

73 
74     assert set(got) == {"python", "go", "ruby", "javascript", "typescript", "java"}
75

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82     """
83     assert languages_for((".yaml", ".json", ".md", ".txt")) == ()
84

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

89 
90     assert got == ("javascript",), got

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

32 def test_the_readme_links_exactly_the_expected_languages() -> None:
33     assert set(_language_row(README)) == LANGUAGES
34

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

39 
40     assert text.startswith(NOTICE)
41     assert "](README.md)" in text

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

40     assert text.startswith(NOTICE)
41     assert "](README.md)" in text
42     assert "pip install secure-code-agent" in text

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

41     assert "](README.md)" in text
42     assert "pip install secure-code-agent" in text
43     assert not re.search(r"\b\d+\.\d+\.\d+\b", text), "a version number goes stale"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

42     assert "pip install secure-code-agent" in text
43     assert not re.search(r"\b\d+\.\d+\.\d+\b", text), "a version number goes stale"
44     assert len(text.split()) < 400 or code == "zh-CN" and len(text) < 2000

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

43     assert not re.search(r"\b\d+\.\d+\.\d+\b", text), "a version number goes stale"
44     assert len(text.split()) < 400 or code == "zh-CN" and len(text) < 2000
45     assert set(_language_row(text)) == LANGUAGES - {code}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

44     assert len(text.split()) < 400 or code == "zh-CN" and len(text) < 2000
45     assert set(_language_row(text)) == LANGUAGES - {code}
46

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

54     badges = _badges(README)
55     assert len(badges) >= 4
56

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

57     for image, link in badges:
58         assert "outcomes360" not in image + link
59         if "/pypi/" in image:

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

59         if "/pypi/" in image:
60             assert image.split("/pypi/")[1].split("/")[1].split("?")[0] == "secure-code-agent"
61         if "/github/" in image:

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

61         if "/github/" in image:
62             assert "marshallguillory86/secure-code-agent" in image
63         for workflow in re.findall(r"workflows/([\w.-]+\.yml)", image + link):

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63         for workflow in re.findall(r"workflows/([\w.-]+\.yml)", image + link):
64             assert (ROOT / ".github" / "workflows" / workflow).is_file(), workflow

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

53     ):
54         assert clause in prompt, f"missing constraint clause: {clause!r}"
55

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

58     prompt = generate([_f()])
59     assert "CWE-89" in prompt
60     assert "A03" in prompt

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

59     assert "CWE-89" in prompt
60     assert "A03" in prompt
61     assert "V5.3.5" in prompt

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

60     assert "A03" in prompt
61     assert "V5.3.5" in prompt
62     assert "PW.5.1" in prompt

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

61     assert "V5.3.5" in prompt
62     assert "PW.5.1" in prompt
63

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

66     prompt = generate([_f()])
67     assert "cursor.execute(f'SELECT" in prompt
68

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

71     prompt = generate([_f()])
72     assert "Top 25" in prompt
73

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

79     # The CRITICAL block must appear before the HIGH block.
80     assert prompt.index("1. `B`") < prompt.index("2. `A`")
81

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

84     prompt = generate([])
85     assert "no actionable" in prompt.lower()
86

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

90     prompt = generate([info])
91     assert "no actionable" in prompt.lower()
92

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

99     prompt = generate([f])
100     assert "no actionable" in prompt.lower()

B404 — Consider possible security implications associated with the subprocess module. 🆕

28 import re
29 import subprocess
30 import sys

B607 — Starting a process with a partial executable path 🆕

68 def _git(*args: str) -> list[str]:
69     return subprocess.run(
70         ["git", "-C", str(ROOT), *args], capture_output=True, text=True, check=True, timeout=120
71     ).stdout.split()
72

B603 — subprocess call - check for execution of untrusted input. 🆕

68 def _git(*args: str) -> list[str]:
69     return subprocess.run(
70         ["git", "-C", str(ROOT), *args], capture_output=True, text=True, check=True, timeout=120
71     ).stdout.split()
72

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

81     expected = _tracked_documents()
82     assert len(expected) >= 20, (
83         f"only {len(expected)} documents found; the population is wrong and every "
84         "check below would be measuring almost nothing"
85     )
86

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86 
87     assert {str(p) for p in render_docs.sources(ROOT)} == expected
88

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

96 
97     assert not missing, f"documents with no rendered page — run tools/render_docs.py: {missing}"
98

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103 
104     assert len(names) == len(set(names)), sorted(n for n in names if names.count(n) > 1)
105

B607 — Starting a process with a partial executable path 🆕

113     """
114     subprocess.run(["git", "init", "-q", str(tmp_path)], check=True, timeout=120)
115     (tmp_path / "docs").mkdir()

B603 — subprocess call - check for execution of untrusted input. 🆕

113     """
114     subprocess.run(["git", "init", "-q", str(tmp_path)], check=True, timeout=120)
115     (tmp_path / "docs").mkdir()

B607 — Starting a process with a partial executable path 🆕

118     (tmp_path / "scratch-note.md").write_text("# Not a document\n", encoding="utf-8")
119     subprocess.run(
120         ["git", "-C", str(tmp_path), "add", "README.md", "docs/guide.md"], check=True, timeout=120
121     )
122

B603 — subprocess call - check for execution of untrusted input. 🆕

118     (tmp_path / "scratch-note.md").write_text("# Not a document\n", encoding="utf-8")
119     subprocess.run(
120         ["git", "-C", str(tmp_path), "add", "README.md", "docs/guide.md"], check=True, timeout=120
121     )
122

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122 
123     assert {str(p) for p in render_docs.sources(tmp_path)} == {"README.md", "docs/guide.md"}
124

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

134     ]
135     assert standalone, "no standalone HTML reports found; half this check reads nothing"
136

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

139 
140     assert not unreached, f"the index does not link: {unreached}"
141

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

151 
152     assert not broken, broken[:20]
153

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

164 
165     assert sorted(p.name for p in first.iterdir()) == sorted(p.name for p in second.iterdir())
166     for page in sorted(first.iterdir()):

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

166     for page in sorted(first.iterdir()):
167         assert page.read_bytes() == (second / page.name).read_bytes(), page.name
168

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

185 
186     assert not stale and not orphaned, (
187         "docs/html is out of date — run `python3 tools/render_docs.py`. "
188         f"stale: {stale[:10]} orphaned: {orphaned[:10]}"
189     )
190

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

218     pages = sorted(HTML.glob("*.html"))
219     assert pages, "no rendered pages to check"
220

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

226 
227     assert missing == [], (
228         f"{len(missing)} rendered page(s) carry no {GENERATED_BANNER!r} banner in "
229         f"their first {BANNER_HEAD_LINES} lines, so a consumer audits them as "
230         f"source: {missing[:5]}"
231     )
232

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

246     ]
247     assert banner_lines, "the index carries no banner line"
248

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

249     stripped = re.sub(r"^[^\w@]*", "", banner_lines[0]).strip()
250     assert stripped.startswith(GENERATED_BANNER), (
251         f"the banner does not lead its line once comment markers are stripped: {stripped[:80]!r}"
252     )
253

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

267     stylesheet = HTML / "style.css"
268     assert stylesheet.is_file(), "the reading copy has no stylesheet"
269

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

270     head = "\n".join(stylesheet.read_text(encoding="utf-8").split("\n")[:BANNER_HEAD_LINES])
271     assert GENERATED_BANNER in head, (
272         f"docs/html/style.css carries no {GENERATED_BANNER!r} banner, so a consumer "
273         "audits it as source and reports it as duplicating its own source file"
274     )
275

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

277     stripped = re.sub(r"^[^\w@]*", "", banner_line).strip()
278     assert stripped.startswith(GENERATED_BANNER), stripped[:80]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

71     payload = json.loads(json_path.read_text(encoding="utf-8"))
72     assert "Coverage: **FAILED**" in markdown_text
73     # Without a verdict no output may claim a grade — the conservative

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

74     # default, so an unwired caller cannot accidentally present one.
75     assert "Finding score (not a verified grade)" in markdown_text
76     assert "bandit 1.9.4" in markdown_text

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

75     assert "Finding score (not a verified grade)" in markdown_text
76     assert "bandit 1.9.4" in markdown_text
77     assert "inputs=requirements-audit.txt" in markdown_text

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

76     assert "bandit 1.9.4" in markdown_text
77     assert "inputs=requirements-audit.txt" in markdown_text
78     assert "CWE-89" in markdown_text

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

77     assert "inputs=requirements-audit.txt" in markdown_text
78     assert "CWE-89" in markdown_text
79     assert payload["coverage"]["scanners"][0]["command"] == ["/tools/bandit"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

78     assert "CWE-89" in markdown_text
79     assert payload["coverage"]["scanners"][0]["command"] == ["/tools/bandit"]
80     assert payload["coverage"]["scanners"][0]["scope"].startswith("mode=requirements")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

79     assert payload["coverage"]["scanners"][0]["command"] == ["/tools/bandit"]
80     assert payload["coverage"]["scanners"][0]["scope"].startswith("mode=requirements")
81     assert payload["score"]["coverage_complete"] is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

80     assert payload["coverage"]["scanners"][0]["scope"].startswith("mode=requirements")
81     assert payload["score"]["coverage_complete"] is False
82     # `qualification` was a label; `verified_grade` is the claim itself, and

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

83     # withholding it is what stops a thinner scan from earning a better letter.
84     assert payload["score"]["verified_grade"] is None
85     assert payload["score"]["evidence_status"] == "incomplete"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

84     assert payload["score"]["verified_grade"] is None
85     assert payload["score"]["evidence_status"] == "incomplete"
86     assert "Scanner coverage: **FAILED**" in comment.read_text(encoding="utf-8")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

85     assert payload["score"]["evidence_status"] == "incomplete"
86     assert "Scanner coverage: **FAILED**" in comment.read_text(encoding="utf-8")
87     assert "not a verified grade" in comment.read_text(encoding="utf-8")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86     assert "Scanner coverage: **FAILED**" in comment.read_text(encoding="utf-8")
87     assert "not a verified grade" in comment.read_text(encoding="utf-8")
88

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

97 
98     assert "_None._" in path.read_text(encoding="utf-8")
99     assert json.loads((tmp_path / "empty.json").read_text(encoding="utf-8"))["coverage"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

98     assert "_None._" in path.read_text(encoding="utf-8")
99     assert json.loads((tmp_path / "empty.json").read_text(encoding="utf-8"))["coverage"] is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

36 
37     assert profile is not None, "the offline ruleset is not present in the package"
38     assert profile.version in PINNED, (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

37     assert profile is not None, "the offline ruleset is not present in the package"
38     assert profile.version in PINNED, (
39         f"PROFILE_VERSION is {profile.version!r} but no digest is pinned for it. "
40         f"Add the new version to PINNED with the digest below."
41     )
42     assert profile.digest == PINNED[profile.version], (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

41     )
42     assert profile.digest == PINNED[profile.version], (
43         f"the offline ruleset changed but still claims {profile.version}.\n"
44         f"  expected {PINNED[profile.version]}\n"
45         f"  actual   {profile.digest}\n"
46         f"Bump PROFILE_VERSION and add the new digest to PINNED. If the change "
47         f"is genuinely cosmetic — a comment, whitespace — it still changes the "
48         f"digest, so it still needs a patch bump: reports cite the digest."
49     )
50

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

60 
61     assert profile.cite() == f"sca-offline@{profile.version} ({profile.digest[:12]})"
62     assert profile.rule_count > 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

61     assert profile.cite() == f"sca-offline@{profile.version} ({profile.digest[:12]})"
62     assert profile.rule_count > 0
63     assert profile.cwes, "no rule declares a CWE, so nothing can be traced to a standard"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

62     assert profile.rule_count > 0
63     assert profile.cwes, "no rule declares a CWE, so nothing can be traced to a standard"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

36 
37     assert "suppressions" not in result
38

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

49 
50     assert result["suppressions"][0]["kind"] == "external"
51     assert "test double" in result["suppressions"][0]["justification"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

50     assert result["suppressions"][0]["kind"] == "external"
51     assert "test double" in result["suppressions"][0]["justification"]
52

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63 
64     assert result["suppressions"][0]["kind"] == "external"
65     assert "test tree" in result["suppressions"][0]["justification"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

64     assert result["suppressions"][0]["kind"] == "external"
65     assert "test tree" in result["suppressions"][0]["justification"]
66

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

72 
73     assert result.get("suppressions")
74

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

83 
84     assert result["locations"][0]["physicalLocation"]["artifactLocation"]["uri"] == "src/app.py"
85     assert result["properties"]["axis"] == "test tree"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

84     assert result["locations"][0]["physicalLocation"]["artifactLocation"]["uri"] == "src/app.py"
85     assert result["properties"]["axis"] == "test tree"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

25 
26     assert invocation["executionSuccessful"] is True
27     assert invocation["properties"]["coverageStatus"] == status.value

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

26     assert invocation["executionSuccessful"] is True
27     assert invocation["properties"]["coverageStatus"] == status.value
28

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

45 
46     assert [notification["level"] for notification in notifications] == ["warning", "warning"]
47     assert all(

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

46     assert [notification["level"] for notification in notifications] == ["warning", "warning"]
47     assert all(
48         notification["descriptor"]["id"] == "scanner-coverage" for notification in notifications
49     )
50     assert all(

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

49     )
50     assert all(
51         entry in notification["message"]["text"]
52         for entry, notification in zip(coverage.unread_languages, notifications, strict=True)
53     )
54

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63 
64     assert coverage.status is CoverageStatus.PARTIAL
65     notification = sarif.emit([], coverage)["runs"][0]["invocations"][0][

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

68 
69     assert notification["level"] == "warning"
70     assert notification["descriptor"]["id"] == "scanner-coverage"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

69     assert notification["level"] == "warning"
70     assert notification["descriptor"]["id"] == "scanner-coverage"
71     assert "gosec" in notification["message"]["text"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

70     assert notification["descriptor"]["id"] == "scanner-coverage"
71     assert "gosec" in notification["message"]["text"]
72     assert "binary is not installed" in notification["message"]["text"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

71     assert "gosec" in notification["message"]["text"]
72     assert "binary is not installed" in notification["message"]["text"]
73

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

81 
82     assert coverage.status is CoverageStatus.PARTIAL
83     assert coverage.unread_languages

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82     assert coverage.status is CoverageStatus.PARTIAL
83     assert coverage.unread_languages
84

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

87 
88     assert invocation["executionSuccessful"] is True
89     assert invocation["properties"]["coverageStatus"] == "partial"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

88     assert invocation["executionSuccessful"] is True
89     assert invocation["properties"]["coverageStatus"] == "partial"
90     assert len(notifications) == len(coverage.unread_languages)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

89     assert invocation["properties"]["coverageStatus"] == "partial"
90     assert len(notifications) == len(coverage.unread_languages)
91     assert notifications[0]["level"] == "warning"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

90     assert len(notifications) == len(coverage.unread_languages)
91     assert notifications[0]["level"] == "warning"
92     assert "shell" in notifications[0]["message"]["text"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

91     assert notifications[0]["level"] == "warning"
92     assert "shell" in notifications[0]["message"]["text"]
93

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

104 
105     assert invocation["executionSuccessful"] is True
106     assert (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

105     assert invocation["executionSuccessful"] is True
106     assert (
107         "toolExecutionNotifications" not in invocation
108         or not invocation["toolExecutionNotifications"]
109     )

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

49     doc = sarif.emit([_f()])
50     assert doc["version"] == "2.1.0"
51     assert "$schema" in doc

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

50     assert doc["version"] == "2.1.0"
51     assert "$schema" in doc
52     assert "runs" in doc and len(doc["runs"]) == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

51     assert "$schema" in doc
52     assert "runs" in doc and len(doc["runs"]) == 1
53     run = doc["runs"][0]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

54     driver = run["tool"]["driver"]
55     assert driver["name"] == "secure-code-agent"
56     assert any(r["id"] == "bandit.B608" for r in driver["rules"])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

55     assert driver["name"] == "secure-code-agent"
56     assert any(r["id"] == "bandit.B608" for r in driver["rules"])
57     assert run["results"][0]["ruleId"] == "bandit.B608"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

56     assert any(r["id"] == "bandit.B608" for r in driver["rules"])
57     assert run["results"][0]["ruleId"] == "bandit.B608"
58     assert run["results"][0]["fingerprints"]["secure-code-agent/v1"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

57     assert run["results"][0]["ruleId"] == "bandit.B608"
58     assert run["results"][0]["fingerprints"]["secure-code-agent/v1"]
59     assert "invocations" not in run

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

58     assert run["results"][0]["fingerprints"]["secure-code-agent/v1"]
59     assert "invocations" not in run
60

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

64     levels = [r["level"] for r in doc["runs"][0]["results"]]
65     assert "error" in levels
66     assert "note" in levels

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

65     assert "error" in levels
66     assert "note" in levels
67

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

84 
85     assert invocation["executionSuccessful"] is True
86     assert invocation["properties"]["coverageStatus"] == "failed"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

85     assert invocation["executionSuccessful"] is True
86     assert invocation["properties"]["coverageStatus"] == "failed"
87     assert invocation["properties"]["scannerExecutions"][0]["scope"].startswith("mode=")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86     assert invocation["properties"]["coverageStatus"] == "failed"
87     assert invocation["properties"]["scannerExecutions"][0]["scope"].startswith("mode=")
88     assert invocation["toolExecutionNotifications"][0]["level"] == "error"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

87     assert invocation["properties"]["scannerExecutions"][0]["scope"].startswith("mode=")
88     assert invocation["toolExecutionNotifications"][0]["level"] == "error"
89

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

94     sarif.write(findings, out)
95     assert out.exists()
96     payload = json.loads(out.read_text(encoding="utf-8"))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

96     payload = json.loads(out.read_text(encoding="utf-8"))
97     assert payload["version"] == "2.1.0"
98

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

99     re_ingested = sarif.ingest(out)
100     assert re_ingested
101     assert re_ingested[0].canonical_cwe == "CWE-89"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

100     assert re_ingested
101     assert re_ingested[0].canonical_cwe == "CWE-89"
102

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

106 
107     assert [f.rule_id for f in findings] == ["external_sarif.tool_error"]
108     assert [e.outcome for e in executions] == [ScannerOutcome.FAILED]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

107     assert [f.rule_id for f in findings] == ["external_sarif.tool_error"]
108     assert [e.outcome for e in executions] == [ScannerOutcome.FAILED]
109     assert "could not read" in executions[0].reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

108     assert [e.outcome for e in executions] == [ScannerOutcome.FAILED]
109     assert "could not read" in executions[0].reason
110

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

117 
118     assert [f.rule_id for f in findings] == ["external_sarif.tool_error"]
119     assert [e.outcome for e in executions] == [ScannerOutcome.FAILED]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

118     assert [f.rule_id for f in findings] == ["external_sarif.tool_error"]
119     assert [e.outcome for e in executions] == [ScannerOutcome.FAILED]
120     assert "not valid JSON" in executions[0].reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119     assert [e.outcome for e in executions] == [ScannerOutcome.FAILED]
120     assert "not valid JSON" in executions[0].reason
121

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

128 
129     assert executions[0].outcome is ScannerOutcome.FAILED
130     assert "no runs" in executions[0].reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

129     assert executions[0].outcome is ScannerOutcome.FAILED
130     assert "no runs" in executions[0].reason
131

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

152 
153     assert executions[0].name == "trivy"
154     assert executions[0].version == "0.60.0"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

153     assert executions[0].name == "trivy"
154     assert executions[0].version == "0.60.0"
155     assert executions[0].scope == "sarif-import:trivy.sarif"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

154     assert executions[0].version == "0.60.0"
155     assert executions[0].scope == "sarif-import:trivy.sarif"
156     # Covers the required ground, but as an artifact we did not watch run.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

156     # Covers the required ground, but as an artifact we did not watch run.
157     assert executions[0].outcome is ScannerOutcome.UNVERIFIED
158     assert report.status is CoverageStatus.COMPLETE

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

157     assert executions[0].outcome is ScannerOutcome.UNVERIFIED
158     assert report.status is CoverageStatus.COMPLETE
159     assert report.failures == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

158     assert report.status is CoverageStatus.COMPLETE
159     assert report.failures == ()
160     assert report.unverified == ("trivy",)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

159     assert report.failures == ()
160     assert report.unverified == ("trivy",)
161

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

182 
183     assert executions[0].outcome is ScannerOutcome.FAILED
184     assert evaluate_coverage(executions, ["gitleaks"]).status is CoverageStatus.FAILED

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

183     assert executions[0].outcome is ScannerOutcome.FAILED
184     assert evaluate_coverage(executions, ["gitleaks"]).status is CoverageStatus.FAILED
185

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

200 
201     assert executions[0].name == "osv_scanner"
202

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

219 
220     assert executions[0].name == "semgrep"
221

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

235         report = evaluate_coverage(pair, ["trivy"])
236         assert report.status is CoverageStatus.COMPLETE
237         assert report.unverified == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

236         assert report.status is CoverageStatus.COMPLETE
237         assert report.unverified == ()
238

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

248 
249     assert report.status is CoverageStatus.FAILED
250

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

271 
272     assert executions[0].outcome is ScannerOutcome.UNVERIFIED
273

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

279 
280     assert executions[0].outcome is ScannerOutcome.FAILED
281     assert "not an object" in executions[0].reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

280     assert executions[0].outcome is ScannerOutcome.FAILED
281     assert "not an object" in executions[0].reason
282     assert [f.rule_id for f in findings] == ["external_sarif.tool_error"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

281     assert "not an object" in executions[0].reason
282     assert [f.rule_id for f in findings] == ["external_sarif.tool_error"]
283

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

296 
297     assert executions[0].outcome is ScannerOutcome.FAILED
298     assert "not an array" in executions[0].reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

297     assert executions[0].outcome is ScannerOutcome.FAILED
298     assert "not an array" in executions[0].reason
299     assert evaluate_coverage(executions, ["trivy"]).status is CoverageStatus.FAILED

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

298     assert "not an array" in executions[0].reason
299     assert evaluate_coverage(executions, ["trivy"]).status is CoverageStatus.FAILED
300

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

318 
319     assert len(findings) == 1
320     assert executions[0].outcome is ScannerOutcome.UNVERIFIED

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

319     assert len(findings) == 1
320     assert executions[0].outcome is ScannerOutcome.UNVERIFIED
321

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

331 
332     assert schema.startswith("https://docs.oasis-open.org/sarif/")
333     assert "raw.githubusercontent.com" not in schema

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

332     assert schema.startswith("https://docs.oasis-open.org/sarif/")
333     assert "raw.githubusercontent.com" not in schema

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

50     """
51     assert scanners.SCANNERS, "the registry is empty; this test would pass vacuously"
52     for name, cls in scanners.SCANNERS.items():

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

53         instance = cls()  # raises TypeError if `scan` is unimplemented
54         assert callable(instance.scan), name
55         annotation = inspect.signature(cls.scan).return_annotation

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

55         annotation = inspect.signature(cls.scan).return_annotation
56         assert annotation in (ScanResult, "ScanResult"), (
57             f"{name}.scan is annotated {annotation!r}; the orchestrator reads "
58             f"`.outcome` and `.findings` off the return value"
59         )
60

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

83 
84     assert offenders == [], (
85         f"{source.name} builds a control finding by hand: {offenders}. "
86         f"Outcome and control finding must be set together — see "
87         f"Scanner._control_result in base.py."
88     )
89

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

98         if outcome is ScannerOutcome.COMPLETED:
99             assert ScanResult(outcome=outcome).findings == ()
100             continue

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102             ScanResult(outcome=outcome)
103         assert ScanResult(outcome=outcome, reason="stated").reason == "stated"
104

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

120 
121     assert execution_from_result("x", completed).finding_count == 3
122     assert execution_from_result("x", failed).finding_count == 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

121     assert execution_from_result("x", completed).finding_count == 3
122     assert execution_from_result("x", failed).finding_count == 0
123     assert len(failed.findings) == 3

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122     assert execution_from_result("x", failed).finding_count == 0
123     assert len(failed.findings) == 3
124

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

139     # on which ruleset ran. Both are reproducibility claims, not decoration.
140     assert scoped == {"pip_audit"} or scoped == {"pip_audit", "semgrep"}, scoped

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63 
64     assert [f.rule_id for f in result] == ["real"]
65

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

77         finding = _finding(path, scanner=scanner)
78         assert _drop_excluded([finding], tmp_path, _config("vendor/")) == [], scanner
79

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

90 
91     assert _drop_excluded([control], tmp_path, _config("*", "**", "tests/")) == [control]
92

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

96 
97     assert _drop_excluded(findings, tmp_path, _config()) == findings
98

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

108 
109     assert _drop_excluded([_finding(outside)], tmp_path, _config("tests/")) != []
110

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

123 
124     assert [f.file_path for f in result] == [target]

B404 — Consider possible security implications associated with the subprocess module. 🆕

2 import os
3 import subprocess
4 import sys

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

29 
30     assert scanner.command == (str(executable.resolve()),)
31     assert scanner.is_available()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

30     assert scanner.command == (str(executable.resolve()),)
31     assert scanner.is_available()
32

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

42 
43     assert scanner.command == ()
44     assert not scanner.is_available()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

43     assert scanner.command == ()
44     assert not scanner.is_available()
45

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

55 
56     assert scanner.command == (sys.executable, "-m", "bandit")
57     assert os.path.isabs(scanner.command[0])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

56     assert scanner.command == (sys.executable, "-m", "bandit")
57     assert os.path.isabs(scanner.command[0])
58

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

74 
75     assert scanner.command == ("/tools/bandit", "wrapper")
76     assert scanner.binary_version() == "bandit 1.9.4"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

75     assert scanner.command == ("/tools/bandit", "wrapper")
76     assert scanner.binary_version() == "bandit 1.9.4"
77

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

85     )
86     assert scanner.binary_version() is None
87

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

88     result = scanner._exec(["bandit"], tmp_path, 1)
89     assert result.returncode == 124
90     assert "timeout" in result.stderr

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

89     assert result.returncode == 124
90     assert "timeout" in result.stderr
91

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

99 
100     assert environment["PATH"] == "/tools"
101     assert environment["LANG"] == "C"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

100     assert environment["PATH"] == "/tools"
101     assert environment["LANG"] == "C"
102     assert "SECRET_TOKEN" not in environment

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

101     assert environment["LANG"] == "C"
102     assert "SECRET_TOKEN" not in environment
103

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

129     # command; either way the tree's executable is never what runs.
130     assert not any("pwn.sh" in part for part in scanner.command)
131     assert scanner.ignored_command is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

130     assert not any("pwn.sh" in part for part in scanner.command)
131     assert scanner.ignored_command is True
132

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

143 
144     assert scanner.command == (str(tool.resolve()),)
145

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

155 
156     assert scanner.command  # the operator asserted the tree is theirs
157

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

170 
171     assert Config().trust_target_config is False
172

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

174 def test_defaults_never_allow_executables_from_the_tree(tmp_path):
175     assert target_executables_allowed(Config(), tmp_path) is False
176

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

191 
192     assert target_executables_allowed(cfg, target) is False
193     # Since the untrusted config stopped choosing the command at all, the

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

195     # what this pins is unchanged — the tree's executable is never it.
196     assert str(executable) not in scanner.command
197     assert scanner.ignored_command is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

196     assert str(executable) not in scanner.command
197     assert scanner.ignored_command is True
198

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

203     declared = set(floor.FLOOR_NAMES) | set(floor.OPTIONAL_NAMES)
204     assert not set(floor.FLOOR_NAMES) & set(floor.OPTIONAL_NAMES)
205     # Every registered scanner has a stated position. A tool nobody decided

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

206     # about is the gap this floor exists to remove.
207     assert declared == set(SCANNERS), f"undeclared: {set(SCANNERS) ^ declared}"
208

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

213     for policy in (*floor.FLOOR, *floor.OPTIONAL):
214         assert policy.licence, f"{policy.name} has no licence recorded"
215         assert policy.rationale, f"{policy.name} has no rationale"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

214         assert policy.licence, f"{policy.name} has no licence recorded"
215         assert policy.rationale, f"{policy.name} has no rationale"
216     for policy in floor.OPTIONAL:

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

218         # statements, and only one of them is useful.
219         assert policy.optional_because, f"{policy.name} is optional with no reason"
220

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

224 
225     assert all(floor.default_enabled(n) for n in floor.COMMIT_CADENCE_NAMES)
226     assert not any(floor.default_enabled(n) for n in floor.OPTIONAL_NAMES)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

225     assert all(floor.default_enabled(n) for n in floor.COMMIT_CADENCE_NAMES)
226     assert not any(floor.default_enabled(n) for n in floor.OPTIONAL_NAMES)
227     # Repository-cadence tools are in the floor but are not invoked inline:

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

228     # their answers do not move between commits and they take minutes.
229     assert not any(floor.default_enabled(n) for n in floor.REPOSITORY_CADENCE_NAMES)
230

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

234 
235     assert set(floor.COMMIT_CADENCE_NAMES) | set(floor.REPOSITORY_CADENCE_NAMES) == set(
236         floor.FLOOR_NAMES
237     )
238     assert not set(floor.COMMIT_CADENCE_NAMES) & set(floor.REPOSITORY_CADENCE_NAMES)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

237     )
238     assert not set(floor.COMMIT_CADENCE_NAMES) & set(floor.REPOSITORY_CADENCE_NAMES)
239     # A deferred tool must still be named somewhere, or deferring it is just

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

240     # dropping it. The renderer and preflight both read this list.
241     assert floor.REPOSITORY_CADENCE_NAMES
242

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

249     for policy in floor.FLOOR:
250         assert "AGPL" not in policy.licence, f"{policy.name} is AGPL and in the floor"
251

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

258     # question the change did not touch.
259     assert floor.expand_required(["floor"]) == list(floor.COMMIT_CADENCE_NAMES)
260     assert floor.expand_required(["bandit", "floor", "bandit"])[0] == "bandit"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

259     assert floor.expand_required(["floor"]) == list(floor.COMMIT_CADENCE_NAMES)
260     assert floor.expand_required(["bandit", "floor", "bandit"])[0] == "bandit"
261     assert len(floor.expand_required(["floor", "floor"])) == len(floor.COMMIT_CADENCE_NAMES)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

260     assert floor.expand_required(["bandit", "floor", "bandit"])[0] == "bandit"
261     assert len(floor.expand_required(["floor", "floor"])) == len(floor.COMMIT_CADENCE_NAMES)
262

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

268     python_only = ({".py"}, {"main.py"})
269     assert floor.applies_to_repository("bandit", *python_only)
270     assert not floor.applies_to_repository("trivy", *python_only)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

269     assert floor.applies_to_repository("bandit", *python_only)
270     assert not floor.applies_to_repository("trivy", *python_only)
271     # Secrets and supply chain are not tied to a language.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

271     # Secrets and supply chain are not tied to a language.
272     assert floor.applies_to_repository("gitleaks", *python_only)
273     assert floor.applies_to_repository("scorecard", *python_only)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

272     assert floor.applies_to_repository("gitleaks", *python_only)
273     assert floor.applies_to_repository("scorecard", *python_only)
274

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

287 
288     assert scanner.binary_version() is None
289

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

298     # operator should not have to learn that from a timeout.
299     assert scorecard.cfg(Config()).timeout_seconds == scorecard.default_timeout_seconds
300     assert scorecard.cfg(Config()).timeout_seconds > bandit.cfg(Config()).timeout_seconds

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

299     assert scorecard.cfg(Config()).timeout_seconds == scorecard.default_timeout_seconds
300     assert scorecard.cfg(Config()).timeout_seconds > bandit.cfg(Config()).timeout_seconds
301

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

307 
308     assert ScorecardScanner().cfg(config).timeout_seconds == 30
309

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

328 
329     assert "-c" not in scanner.command
330     assert scanner.ignored_command is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

329     assert "-c" not in scanner.command
330     assert scanner.ignored_command is True
331     assert not marker.exists()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

330     assert scanner.ignored_command is True
331     assert not marker.exists()
332

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

344         scanner.configure(tmp_path, cfg)
345         assert scanner.command[1:] == ("-m", "bandit")
346         assert scanner.ignored_command is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

345         assert scanner.command[1:] == ("-m", "bandit")
346         assert scanner.ignored_command is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

41 
42     assert coverage.status is CoverageStatus.FAILED
43     assert gate.passed is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

42     assert coverage.status is CoverageStatus.FAILED
43     assert gate.passed is False
44     assert "require_scanners" in gate.tripped

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

43     assert gate.passed is False
44     assert "require_scanners" in gate.tripped
45

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

51 
52     assert coverage.status is CoverageStatus.PARTIAL
53     assert gate.passed is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

52     assert coverage.status is CoverageStatus.PARTIAL
53     assert gate.passed is True
54

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

61 
62     assert execution.outcome is ScannerOutcome.NOT_APPLICABLE
63     assert coverage.status is CoverageStatus.FAILED

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

62     assert execution.outcome is ScannerOutcome.NOT_APPLICABLE
63     assert coverage.status is CoverageStatus.FAILED
64

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

68 
69     assert coverage.status is CoverageStatus.FAILED
70     assert "was not selected" in coverage.failures[0]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

69     assert coverage.status is CoverageStatus.FAILED
70     assert "was not selected" in coverage.failures[0]
71

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

85 
86     assert coverage.status is CoverageStatus.FAILED
87     assert "did not complete" in coverage.failures[0]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86     assert coverage.status is CoverageStatus.FAILED
87     assert "did not complete" in coverage.failures[0]
88

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

95         collapsed = worst_by_name([_execution("bandit", pair[0]), _execution("bandit", pair[1])])
96         assert collapsed["bandit"].outcome is ScannerOutcome.UNAVAILABLE

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

51 def test_letter_grade_boundaries():
52     assert letter_grade(5.0) == "A+"
53     assert letter_grade(4.85) == "A+"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

52     assert letter_grade(5.0) == "A+"
53     assert letter_grade(4.85) == "A+"
54     assert letter_grade(4.84) == "A"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

53     assert letter_grade(4.85) == "A+"
54     assert letter_grade(4.84) == "A"
55     assert letter_grade(4.0) == "A-"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

54     assert letter_grade(4.84) == "A"
55     assert letter_grade(4.0) == "A-"
56     assert letter_grade(3.0) == "B"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

55     assert letter_grade(4.0) == "A-"
56     assert letter_grade(3.0) == "B"
57     assert letter_grade(0.0) == "F"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

56     assert letter_grade(3.0) == "B"
57     assert letter_grade(0.0) == "F"
58

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

61     r = score([], loc_scanned=10_000)
62     assert r.overall == 5.0
63     assert r.letter == "A+"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

62     assert r.overall == 5.0
63     assert r.letter == "A+"
64     assert r.worst_category is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63     assert r.letter == "A+"
64     assert r.worst_category is None
65

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

70     # Single HIGH SQLi (top25) on a 12k repo → high but not catastrophic
71     assert 3.0 < r.overall < 4.5
72     assert r.worst_category is Category.CODE_VULNERABILITIES

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

71     assert 3.0 < r.overall < 4.5
72     assert r.worst_category is Category.CODE_VULNERABILITIES
73

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

81     # Suppressed CRITICAL ignored; LOW logging finding is the worst.
82     assert r.worst_category is Category.LOGGING_OBSERVABILITY
83

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

91     # SECRETS should be the worst.
92     assert r.worst_category is Category.SECRETS
93     assert r.per_category[Category.SECRETS] < r.per_category[Category.LOGGING_OBSERVABILITY]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

92     assert r.worst_category is Category.SECRETS
93     assert r.per_category[Category.SECRETS] < r.per_category[Category.LOGGING_OBSERVABILITY]
94

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

98     boosted = _f(Severity.HIGH, Category.CODE_VULNERABILITIES, cwe_top25=True)
99     assert finding_score(boosted) > finding_score(base)
100

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

105     gate = evaluate_gates(findings, r, {"fail_on_severity": ["high"]})
106     assert not gate.passed
107     assert "fail_on_severity" in gate.tripped

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

106     assert not gate.passed
107     assert "fail_on_severity" in gate.tripped
108

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

113     gate = evaluate_gates(findings, r, {"fail_on_severity": ["critical", "high"]})
114     assert gate.passed
115

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

120     gate = evaluate_gates(findings, r, {"fail_on_new": True})
121     assert not gate.passed
122

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

127     gate = evaluate_gates(findings, r, {"max_unsuppressed": {"high": 2}})
128     assert not gate.passed
129     assert any("max_unsuppressed" in t for t in gate.tripped)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

128     assert not gate.passed
129     assert any("max_unsuppressed" in t for t in gate.tripped)
130

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

135     gate = evaluate_gates(findings, r, {"min_score": 4.0})
136     assert not gate.passed
137

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

139 def test_absent_gate_config_has_no_active_gates():
140     assert active_gates({}) == ()
141

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

154 
155     assert active_gates(inert) == ()
156

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

158 def test_a_single_real_gate_is_enough():
159     assert active_gates({"min_score": 4.0}) == ("min_score",)
160     assert active_gates({"fail_on_severity": ["high"]}) == ("fail_on_severity",)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

159     assert active_gates({"min_score": 4.0}) == ("min_score",)
160     assert active_gates({"fail_on_severity": ["high"]}) == ("fail_on_severity",)
161     assert active_gates({"require_scanners": ["bandit"]}) == ("require_scanners",)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

160     assert active_gates({"fail_on_severity": ["high"]}) == ("fail_on_severity",)
161     assert active_gates({"require_scanners": ["bandit"]}) == ("require_scanners",)
162

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

164 def test_active_gates_reports_every_configured_gate():
165     assert active_gates(
166         {"fail_on_new": True, "min_score": 4.0, "max_unsuppressed": {"critical": 0}}
167     ) == ("fail_on_new", "min_score", "max_unsuppressed")
168

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

198 
199     assert category_subtotal(one, Category.CODE_VULNERABILITIES) == finding_score(one[0])
200

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

210     # Rank discount: sum of 1/sqrt(k) for k = 1..100, about 2*sqrt(n).
211     assert subtotal == pytest.approx(unit * 18.59, rel=0.01)
212     assert subtotal < unit * 100

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

211     assert subtotal == pytest.approx(unit * 18.59, rel=0.01)
212     assert subtotal < unit * 100
213

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

230         current = category_subtotal(running, Category.CODE_VULNERABILITIES)
231         assert current >= previous, f"adding finding {n} lowered the subtotal"
232         previous = current

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

241 
242     assert category_subtotal(buried, Category.CODE_VULNERABILITIES) >= category_subtotal(
243         critical_only, Category.CODE_VULNERABILITIES
244     )
245

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

252 
253     assert category_subtotal(ten_distinct, Category.CODE_VULNERABILITIES) > category_subtotal(
254         ten_of_one, Category.CODE_VULNERABILITIES
255     )
256     assert category_subtotal(ten_distinct, Category.CODE_VULNERABILITIES) == pytest.approx(

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

255     )
256     assert category_subtotal(ten_distinct, Category.CODE_VULNERABILITIES) == pytest.approx(
257         finding_score(ten_distinct[0]) * 10
258     )
259

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

270 
271     assert subtotal > worst
272     assert subtotal < worst * 10

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

271     assert subtotal > worst
272     assert subtotal < worst * 10
273

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

282 
283     assert category_subtotal(with_suppressed, Category.CODE_VULNERABILITIES) == pytest.approx(
284         category_subtotal(live, Category.CODE_VULNERABILITIES)
285     )
286

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

307 
308     assert set(report.per_severity_count) == set(Severity), (
309         "a ScoreReport must carry every Severity; three call sites index it"
310     )
311     assert report.per_severity_count[Severity.CRITICAL] == 0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

310     )
311     assert report.per_severity_count[Severity.CRITICAL] == 0
312     assert report.per_severity_count[Severity.LOW] == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

311     assert report.per_severity_count[Severity.CRITICAL] == 0
312     assert report.per_severity_count[Severity.LOW] == 1
313     assert set(report.per_category_count) == set(Category), (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

312     assert report.per_severity_count[Severity.LOW] == 1
313     assert set(report.per_category_count) == set(Category), (
314         "`as_table` indexes per_category_count for every Category"
315     )
316

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

332 
333     assert set(axis.per_severity_count) == {Severity.LOW}
334     assert axis.worst_severity is Severity.LOW

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

333     assert set(axis.per_severity_count) == {Severity.LOW}
334     assert axis.worst_severity is Severity.LOW

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

104     """
105     assert pillar_mod.posture(level, condition) == expected
106

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

115     """
116     assert pillar_mod.posture(5, None) == "unverified"
117     assert pillar_mod.posture(5, 5.0) == "healthy"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

116     assert pillar_mod.posture(5, None) == "unverified"
117     assert pillar_mod.posture(5, 5.0) == "healthy"
118

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

133 
134     assert built.condition is None
135     assert built.condition_letter is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

134     assert built.condition is None
135     assert built.condition_letter is None
136     assert built.posture == "unverified"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

135     assert built.condition_letter is None
136     assert built.posture == "unverified"
137     assert built.verified_grade is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

136     assert built.posture == "unverified"
137     assert built.verified_grade is None
138     assert built.evidence_status == "incomplete"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

137     assert built.verified_grade is None
138     assert built.evidence_status == "incomplete"
139

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

143 
144     assert built.condition == 5.0
145     assert built.condition_letter == "A+"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

144     assert built.condition == 5.0
145     assert built.condition_letter == "A+"
146     assert built.posture == "healthy"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

145     assert built.condition_letter == "A+"
146     assert built.posture == "healthy"
147     assert built.verified_grade == "A+"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

146     assert built.posture == "healthy"
147     assert built.verified_grade == "A+"
148     assert built.evidence_status == "complete"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

147     assert built.verified_grade == "A+"
148     assert built.evidence_status == "complete"
149

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

160 
161     assert measured.condition is not None
162     assert unmeasured.condition is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

161     assert measured.condition is not None
162     assert unmeasured.condition is None
163     assert unmeasured.posture != "healthy"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

162     assert unmeasured.condition is None
163     assert unmeasured.posture != "healthy"
164

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

177 
178     assert document["schema"] == "secure-code-agent/security-pillar"
179     # v2 = v1 plus `scoring_model`; see tests/unit/test_pillar_contract.py,

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

180     # which pins the whole shape and the release ordering a bump requires.
181     assert document["schema_version"] == 2
182     assert document["pillar"] == "security"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

181     assert document["schema_version"] == 2
182     assert document["pillar"] == "security"
183     assert document["scope"] == "owned"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

182     assert document["pillar"] == "security"
183     assert document["scope"] == "owned"
184     assert document["practice"]["level"] == 4

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

183     assert document["scope"] == "owned"
184     assert document["practice"]["level"] == 4
185     assert isinstance(document["condition"], float)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

184     assert document["practice"]["level"] == 4
185     assert isinstance(document["condition"], float)
186     assert document["posture"] in {"healthy", "managed debt", "unmanaged debt", "unverified"}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

185     assert isinstance(document["condition"], float)
186     assert document["posture"] in {"healthy", "managed debt", "unmanaged debt", "unverified"}
187     # No field offers the two axes combined.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

187     # No field offers the two axes combined.
188     assert "overall" not in document
189     assert "combined" not in document

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

188     assert "overall" not in document
189     assert "combined" not in document
190     assert "average" not in document

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

189     assert "combined" not in document
190     assert "average" not in document
191

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

199 
200     assert reloaded["practice"]["level"] == 3
201     assert reloaded["producer"]["tool"] == "secure-code-agent"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

200     assert reloaded["practice"]["level"] == 3
201     assert reloaded["producer"]["tool"] == "secure-code-agent"
202     assert reloaded["notes"]["never_average"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

201     assert reloaded["producer"]["tool"] == "secure-code-agent"
202     assert reloaded["notes"]["never_average"]
203

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

218         combines = "practice" in operands and "condition" in operands
219         assert not combines, (
220             f"{PILLAR_SOURCE.name} line {node.lineno} combines practice and "
221             f"condition arithmetically; ADR 007 §2 forbids it"
222         )
223

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

230 
231     assert document["coverage"]["status"] == CoverageStatus.FAILED.value
232     assert "bandit" in document["coverage"]["scanners_missing"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

231     assert document["coverage"]["status"] == CoverageStatus.FAILED.value
232     assert "bandit" in document["coverage"]["scanners_missing"]
233     assert document["evidence_reasons"], "a withheld grade must say why"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

232     assert "bandit" in document["coverage"]["scanners_missing"]
233     assert document["evidence_reasons"], "a withheld grade must say why"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

10 def test_top25_set_contains_known_entries():
11     assert "CWE-89" in CWE_TOP25_2025  # SQL injection
12     assert "CWE-79" in CWE_TOP25_2025  # XSS

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

11     assert "CWE-89" in CWE_TOP25_2025  # SQL injection
12     assert "CWE-79" in CWE_TOP25_2025  # XSS
13     assert "CWE-798" in CWE_TOP25_2025  # hardcoded creds

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

12     assert "CWE-79" in CWE_TOP25_2025  # XSS
13     assert "CWE-798" in CWE_TOP25_2025  # hardcoded creds
14

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

16 def test_is_top25_handles_none():
17     assert is_top25(None) is False
18

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

20 def test_is_top25_match():
21     assert is_top25("CWE-89") is True
22     assert is_top25("CWE-9999") is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

21     assert is_top25("CWE-89") is True
22     assert is_top25("CWE-9999") is False
23

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

25 def test_cwe_url_generates_mitre_link():
26     assert cwe_url("CWE-89") == "https://cwe.mitre.org/data/definitions/89.html"
27

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

30     entry = lookup("bandit", "B608")
31     assert entry is not None
32     assert entry.canonical_cwe == "CWE-89"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

31     assert entry is not None
32     assert entry.canonical_cwe == "CWE-89"
33

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

37     entry = lookup("pip_audit", "GHSA-anything")
38     assert entry is not None
39     assert entry.canonical_cwe == "CWE-1104"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

38     assert entry is not None
39     assert entry.canonical_cwe == "CWE-1104"
40

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

42 def test_lookup_unknown_returns_none():
43     assert lookup("unknown_scanner", "X") is None
44

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

46 def test_owasp_label_resolves_bucket():
47     assert "Injection" in owasp_label("A03")
48     assert "Broken Access Control" in owasp_label("A01")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

47     assert "Injection" in owasp_label("A03")
48     assert "Broken Access Control" in owasp_label("A01")
49     # Unknown id → unchanged

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

49     # Unknown id → unchanged
50     assert owasp_label("Z99") == "Z99"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

60 
61     assert finding.canonical_cwe == "CWE-78"
62     assert finding.asvs_section == "V5.3.8"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

61     assert finding.canonical_cwe == "CWE-78"
62     assert finding.asvs_section == "V5.3.8"
63     assert finding.nist_ssdf == "PW.5.1"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

62     assert finding.asvs_section == "V5.3.8"
63     assert finding.nist_ssdf == "PW.5.1"
64

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

69 
70     assert lookup("bandit", "B101") is None
71     assert finding.canonical_cwe == "CWE-703"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

70     assert lookup("bandit", "B101") is None
71     assert finding.canonical_cwe == "CWE-703"
72

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

77 
78     assert finding.canonical_cwe == "CWE-1234"
79

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82     """Not every finding has one, and inventing one would be worse."""
83     assert _finding(rule_id="B9999").canonical_cwe is None
84

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

93 
94     assert finding.owasp_top10 == "A02"
95

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

104 
105     assert curated.owasp_top10 == derived.owasp_top10 == "A03"
106

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

110     would put a standard's name behind a claim it does not make."""
111     assert owasp_for_cwe("CWE-703") is None
112     assert _finding(rule_id="B101", scanner_cwe="CWE-703").owasp_top10 is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

111     assert owasp_for_cwe("CWE-703") is None
112     assert _finding(rule_id="B101", scanner_cwe="CWE-703").owasp_top10 is None
113

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

117     findings carrying no CWE it could not fire for them at all."""
118     assert _finding(rule_id="B999", scanner_cwe="CWE-78").cwe_top25 is True
119     assert _finding(rule_id="B999", scanner_cwe="CWE-703").cwe_top25 is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

118     assert _finding(rule_id="B999", scanner_cwe="CWE-78").cwe_top25 is True
119     assert _finding(rule_id="B999", scanner_cwe="CWE-703").cwe_top25 is False
120

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

127 def test_bandit_issue_cwe_is_read_from_its_real_shape():
128     assert _cwe_of({"issue_cwe": {"id": 78, "link": "..."}}) == "CWE-78"
129

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

131 def test_a_bandit_result_without_a_cwe_is_not_invented():
132     assert _cwe_of({}) is None
133     assert _cwe_of({"issue_cwe": None}) is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

132     assert _cwe_of({}) is None
133     assert _cwe_of({"issue_cwe": None}) is None
134     assert _cwe_of({"issue_cwe": {}}) is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

133     assert _cwe_of({"issue_cwe": None}) is None
134     assert _cwe_of({"issue_cwe": {}}) is None
135     assert _cwe_of({"issue_cwe": "CWE-78"}) is None  # not the documented shape

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

134     assert _cwe_of({"issue_cwe": {}}) is None
135     assert _cwe_of({"issue_cwe": "CWE-78"}) is None  # not the documented shape
136

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

168 
169     assert finding.canonical_cwe == "CWE-327"
170     assert finding.owasp_top10 == "A02"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

169     assert finding.canonical_cwe == "CWE-327"
170     assert finding.owasp_top10 == "A02"
171     assert finding.severity is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

170     assert finding.owasp_top10 == "A02"
171     assert finding.severity is Severity.HIGH
172     assert finding.confidence is Confidence.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

171     assert finding.severity is Severity.HIGH
172     assert finding.confidence is Confidence.HIGH
173     assert finding.category is Category.CODE_VULNERABILITIES

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

172     assert finding.confidence is Confidence.HIGH
173     assert finding.category is Category.CODE_VULNERABILITIES
174

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

206 
207     assert offenders == [], (
208         f"{offenders} read a CWE from their scanner but never pass it to "
209         f"_make_finding via scanner_cwe= or cwe_override=, so it is dropped "
210         f"before it reaches scoring, the Top-25 bonus or SARIF"
211     )

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63 
64     assert list(table) == [("bandit", "B000")]
65     entry = table[("bandit", "B000")]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

65     entry = table[("bandit", "B000")]
66     assert entry.canonical_cwe == "CWE-89"
67     assert entry.category is Category.CODE_VULNERABILITIES

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

66     assert entry.canonical_cwe == "CWE-89"
67     assert entry.category is Category.CODE_VULNERABILITIES
68     assert entry.severity is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

67     assert entry.category is Category.CODE_VULNERABILITIES
68     assert entry.severity is Severity.HIGH
69     assert entry.confidence is Confidence.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

68     assert entry.severity is Severity.HIGH
69     assert entry.confidence is Confidence.HIGH
70     assert entry.fix_hint == "Do the other thing."

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

69     assert entry.confidence is Confidence.HIGH
70     assert entry.fix_hint == "Do the other thing."
71

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82 
83     assert entry is not None
84     assert entry.canonical_cwe == "CWE-95"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

83     assert entry is not None
84     assert entry.canonical_cwe == "CWE-95"
85     assert entry.owasp_top10 == "A03"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

84     assert entry.canonical_cwe == "CWE-95"
85     assert entry.owasp_top10 == "A03"
86     assert entry.category is Category.CODE_VULNERABILITIES

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

85     assert entry.owasp_top10 == "A03"
86     assert entry.category is Category.CODE_VULNERABILITIES
87     assert entry.severity is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

86     assert entry.category is Category.CODE_VULNERABILITIES
87     assert entry.severity is Severity.HIGH
88     assert entry.confidence is Confidence.MEDIUM

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

87     assert entry.severity is Severity.HIGH
88     assert entry.confidence is Confidence.MEDIUM
89

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

93     that happened to name a surviving rule."""
94     assert len(_MAP) >= 30, f"the shipped table has only {len(_MAP)} entries"
95     assert _DATA_FILE.is_file()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

94     assert len(_MAP) >= 30, f"the shipped table has only {len(_MAP)} entries"
95     assert _DATA_FILE.is_file()
96

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

174     """
175     assert _table(tmp_path, "version: 1\nentries: []\n") == {}
176

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

186 
187     assert url.startswith(OWASP_TOP10_2021_URL)
188     assert url.endswith("/")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

187     assert url.startswith(OWASP_TOP10_2021_URL)
188     assert url.endswith("/")
189     assert "A03_2021-Injection" in url

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

188     assert url.endswith("/")
189     assert "A03_2021-Injection" in url
190     assert owasp_url("A03:2021-Injection") == url, "the long form must resolve the same"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

189     assert "A03_2021-Injection" in url
190     assert owasp_url("A03:2021-Injection") == url, "the long form must resolve the same"
191

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

198     """
199     assert owasp_url("A11") == OWASP_TOP10_2021_URL
200     assert owasp_url("not-a-bucket") == OWASP_TOP10_2021_URL

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

199     assert owasp_url("A11") == OWASP_TOP10_2021_URL
200     assert owasp_url("not-a-bucket") == OWASP_TOP10_2021_URL

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

69     entries, errors = load_overlay(path)
70     assert errors == [], errors
71     install_overlay(entries)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

79 
80     assert lookup("semgrep", rule) is None or lookup("semgrep", rule).canonical_cwe != "CWE-22"
81

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

92 
93     assert std.canonical_cwe == "CWE-22"
94     assert std.owasp_top10 == "A01"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

93     assert std.canonical_cwe == "CWE-22"
94     assert std.owasp_top10 == "A01"
95     assert std.asvs_section == "V12.3.1"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

94     assert std.owasp_top10 == "A01"
95     assert std.asvs_section == "V12.3.1"
96     assert std.nist_ssdf == "PW.5.1"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

95     assert std.asvs_section == "V12.3.1"
96     assert std.nist_ssdf == "PW.5.1"
97     assert std.fix_hint == "Resolve and contain the path."

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

96     assert std.nist_ssdf == "PW.5.1"
97     assert std.fix_hint == "Resolve and contain the path."
98

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

119 
120     assert std.canonical_cwe == "CWE-22", "the mapping did apply"
121     assert std.severity is Severity.MEDIUM, "severity must be the default, not the overlay's"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

120     assert std.canonical_cwe == "CWE-22", "the mapping did apply"
121     assert std.severity is Severity.MEDIUM, "severity must be the default, not the overlay's"
122     assert std.confidence is Confidence.MEDIUM

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

121     assert std.severity is Severity.MEDIUM, "severity must be the default, not the overlay's"
122     assert std.confidence is Confidence.MEDIUM
123     assert std.category is Category.POLICY_DOCS, "category must stay the scanner's default"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122     assert std.confidence is Confidence.MEDIUM
123     assert std.category is Category.POLICY_DOCS, "category must stay the scanner's default"
124

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

140 
141     assert entries == {}
142     assert len(errors) == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

141     assert entries == {}
142     assert len(errors) == 1
143     assert field in errors[0]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

142     assert len(errors) == 1
143     assert field in errors[0]
144     assert "D32" in errors[0], f"the refusal must say why: {errors[0]}"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

143     assert field in errors[0]
144     assert "D32" in errors[0], f"the refusal must say why: {errors[0]}"
145

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

154     curated = lookup("bandit", "B102")
155     assert curated.canonical_cwe == "CWE-95", "premise: the shipped value"
156

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

173 
174     assert std.canonical_cwe == "CWE-94"
175     assert std.severity is Severity.HIGH, "the curated severity must survive the overlay"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

174     assert std.canonical_cwe == "CWE-94"
175     assert std.severity is Severity.HIGH, "the curated severity must survive the overlay"
176     assert std.category is Category.CODE_VULNERABILITIES

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

175     assert std.severity is Severity.HIGH, "the curated severity must survive the overlay"
176     assert std.category is Category.CODE_VULNERABILITIES
177

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

201 
202     assert std.canonical_cwe == "CWE-78"
203

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

212     """
213     assert overlay_for("bandit", "B102") is None
214

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

225 
226     assert std.canonical_cwe == "CWE-95"
227     assert std.owasp_top10 == "A03"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

226     assert std.canonical_cwe == "CWE-95"
227     assert std.owasp_top10 == "A03"
228     assert std.severity is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

227     assert std.owasp_top10 == "A03"
228     assert std.severity is Severity.HIGH
229

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

236 
237     assert entries == {}
238     assert len(errors) == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

237     assert entries == {}
238     assert len(errors) == 1
239     assert "does-not-exist.yaml" in errors[0]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

238     assert len(errors) == 1
239     assert "does-not-exist.yaml" in errors[0]

B404 — Consider possible security implications associated with the subprocess module. 🆕

9 
10 import subprocess
11 import sys

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

29 
30     assert result.returncode == 0
31     assert result.stdout.strip() == "hello"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

30     assert result.returncode == 0
31     assert result.stdout.strip() == "hello"
32

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

39 
40     assert Path(result.stdout.strip()).resolve() == tmp_path.resolve()
41

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

56 
57     assert result.returncode == 0
58     assert Path(result.stdout.strip()).resolve() == tmp_path.resolve()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

57     assert result.returncode == 0
58     assert Path(result.stdout.strip()).resolve() == tmp_path.resolve()
59

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

68 
69     assert result.returncode == 124
70     assert result.stdout == ""

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

69     assert result.returncode == 124
70     assert result.stdout == ""
71     assert "timeout after 1s" in result.stderr

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

70     assert result.stdout == ""
71     assert "timeout after 1s" in result.stderr
72

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

77 
78     assert result.returncode == 3
79

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

83 
84     assert result.returncode == 1
85

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

97 
98     assert result.stdout.strip() == payload
99     assert not marker.exists()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

98     assert result.stdout.strip() == payload
99     assert not marker.exists()
100

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

113 
114     assert result.stdout.strip() == "||True"
115

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

124 
125     assert env == {k: f"v-{k}" for k in ("PATH", "HOME", "LANG", "LC_ALL", "TMPDIR", "TEMP", "TMP")}
126

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

131 
132     assert "LC_ALL" not in SubprocessExecution._sanitized_env()
133

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

159 
160     assert (reason is not None) is expect_reason
161

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

167 
168     assert reason is not None
169     assert "probe" in reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

168     assert reason is not None
169     assert "probe" in reason
170     assert "exited 1" in reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

169     assert "probe" in reason
170     assert "exited 1" in reason
171     assert "refusing to record this as a clean scan" in reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

170     assert "exited 1" in reason
171     assert "refusing to record this as a clean scan" in reason
172

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

180 
181     assert findings == []
182

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

186 
187     assert isinstance(result, subprocess.CompletedProcess)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

132 def test_the_population_is_not_empty():
133     assert len(_PINNED) >= 20
134     assert _documented_patterns(), "the documentation shows no paths: example to hold"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

133     assert len(_PINNED) >= 20
134     assert _documented_patterns(), "the documentation shows no paths: example to hold"
135

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

140 
141     assert _suppresses(pattern, rel) is excluded, (
142         f"paths: [{pattern!r}] {'suppresses' if not excluded else 'misses'} {rel}, "
143         f"while exclude_patterns {'excludes' if excluded else 'keeps'} it"
144     )
145

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

149     """The example a reader copies has to work, at the root and below it."""
150     assert _suppresses(pattern, _sample(pattern)), f"documented paths: [{pattern!r}] is inert"
151     assert _suppresses(pattern, f"pkg/{_sample(pattern)}")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

150     assert _suppresses(pattern, _sample(pattern)), f"documented paths: [{pattern!r}] is inert"
151     assert _suppresses(pattern, f"pkg/{_sample(pattern)}")
152

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

157     and only in the direction of the entry the operator already wrote."""
158     assert _suppresses("*/src/app.py", "src/app.py")
159     assert not _suppresses("*/src/app.py", "lib/app.py")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

158     assert _suppresses("*/src/app.py", "src/app.py")
159     assert not _suppresses("*/src/app.py", "lib/app.py")
160

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

163     """The answer the changelog gives to "I meant only the root one"."""
164     assert _suppresses("conftest.py", "pkg/conftest.py")
165     assert _suppresses("/conftest.py", "conftest.py")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

164     assert _suppresses("conftest.py", "pkg/conftest.py")
165     assert _suppresses("/conftest.py", "conftest.py")
166     assert not _suppresses("/conftest.py", "pkg/conftest.py")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

165     assert _suppresses("/conftest.py", "conftest.py")
166     assert not _suppresses("/conftest.py", "pkg/conftest.py")

B404 — Consider possible security implications associated with the subprocess module. 🆕

3 import datetime
4 import subprocess
5 import sys

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

45     rules, errors = load(tmp_path / "missing.yaml")
46     assert rules == []
47     assert errors == []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

46     assert rules == []
47     assert errors == []
48

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

53     _, errors = load(p)
54     assert errors
55     assert any("reason" in e for e in errors)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

54     assert errors
55     assert any("reason" in e for e in errors)
56

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

61     _, errors = load(p)
62     assert errors
63     assert any("expires" in e for e in errors)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

62     assert errors
63     assert any("expires" in e for e in errors)
64

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

70     _, errors = load(p)
71     assert errors
72     assert any("days" in e for e in errors)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

71     assert errors
72     assert any("days" in e for e in errors)
73

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

91 
92     assert rules == []
93     assert any("requires `file` or `paths`" in e for e in errors), errors

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

92     assert rules == []
93     assert any("requires `file` or `paths`" in e for e in errors), errors
94

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

100     rules, errors = load(p)
101     assert not errors
102     out = apply([_f()], rules)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102     out = apply([_f()], rules)
103     assert out[0].suppressed is True
104     assert "known" in out[0].suppression_note

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103     assert out[0].suppressed is True
104     assert "known" in out[0].suppression_note
105

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

112     out = apply([_f()], rules)
113     assert out[0].suppressed is False
114

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

121     expired = expired_findings(rules, p)
122     assert len(expired) == 1
123     assert expired[0].severity is Severity.CRITICAL

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122     assert len(expired) == 1
123     assert expired[0].severity is Severity.CRITICAL
124

B607 — Starting a process with a partial executable path 🆕

139     # rather than the scan target.
140     subprocess.run(
141         ["git", "init", "-q", "."], cwd=tmp_path, check=True, capture_output=True, timeout=120
142     )
143     (tmp_path / "a.py").write_text("def f():\n    return 1\n", encoding="utf-8")

B603 — subprocess call - check for execution of untrusted input. 🆕

139     # rather than the scan target.
140     subprocess.run(
141         ["git", "init", "-q", "."], cwd=tmp_path, check=True, capture_output=True, timeout=120
142     )
143     (tmp_path / "a.py").write_text("def f():\n    return 1\n", encoding="utf-8")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

147 
148     assert code == 1
149     assert "could not be applied" in capsys.readouterr().err

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

148     assert code == 1
149     assert "could not be applied" in capsys.readouterr().err
150

B607 — Starting a process with a partial executable path 🆕

155 
156     subprocess.run(
157         ["git", "init", "-q", "."], cwd=tmp_path, check=True, capture_output=True, timeout=120
158     )
159     (tmp_path / "a.py").write_text("def f():\n    return 1\n", encoding="utf-8")

B603 — subprocess call - check for execution of untrusted input. 🆕

155 
156     subprocess.run(
157         ["git", "init", "-q", "."], cwd=tmp_path, check=True, capture_output=True, timeout=120
158     )
159     (tmp_path / "a.py").write_text("def f():\n    return 1\n", encoding="utf-8")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

160 
161     assert main([str(tmp_path), "--json-output", str(tmp_path / "out.json")]) == 0
162

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

197     first, second = _gitleaks_findings(18, 999)
198     assert first.fingerprint == second.fingerprint
199     assert first.line_start != second.line_start

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

198     assert first.fingerprint == second.fingerprint
199     assert first.line_start != second.line_start
200

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

215     )
216     assert rule.matches(first) is True
217     assert rule.matches(second) is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

216     assert rule.matches(first) is True
217     assert rule.matches(second) is False
218

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

234     )
235     assert rule.matches(second) is True
236

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

270     rules, errors = _load_entry(tmp_path, extra)
271     assert rules == [], f"{extra!r} produced a usable rule"
272     assert errors, f"{extra!r} was silently accepted"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

271     assert rules == [], f"{extra!r} produced a usable rule"
272     assert errors, f"{extra!r} was silently accepted"
273

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

276     rules, errors = _load_entry(tmp_path, "fingerprint: 0aaa689f8a967d8c\n  line: 18")
277     assert errors == []
278     assert rules[0].fingerprint == "0aaa689f8a967d8c" and rules[0].line == 18

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

277     assert errors == []
278     assert rules[0].fingerprint == "0aaa689f8a967d8c" and rules[0].line == 18
279

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

310 
311     assert rules == []
312     assert any(message in e for e in errors), errors

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

311     assert rules == []
312     assert any(message in e for e in errors), errors
313

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

339 
340     assert rules == []
341     assert any(str(path) in e for e in errors), errors

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

340     assert rules == []
341     assert any(str(path) in e for e in errors), errors
342

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

357 
358     assert rules == []
359     assert any("pyyaml not installed" in e for e in errors), errors

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

358     assert rules == []
359     assert any("pyyaml not installed" in e for e in errors), errors
360

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

366     rules, errors = load(path)
367     assert errors == [], errors
368     assert len(rules) == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

367     assert errors == [], errors
368     assert len(rules) == 1
369     return path, rules

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

392 
393     assert len(found) == 1
394     assert "B999" in found[0].message

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

393     assert len(found) == 1
394     assert "B999" in found[0].message
395     assert found[0].rule_id == "suppressions.unused.B999"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

394     assert "B999" in found[0].message
395     assert found[0].rule_id == "suppressions.unused.B999"
396

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

408 
409     assert unused_findings(rules, [_f(rule_id="B608")], path) == []
410

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

424 
425     assert rules[0].expired
426     assert expired_findings(rules, path) != []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

425     assert rules[0].expired
426     assert expired_findings(rules, path) != []
427     assert unused_findings(rules, [_f(rule_id="B608")], path) == []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

426     assert expired_findings(rules, path) != []
427     assert unused_findings(rules, [_f(rule_id="B608")], path) == []
428

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

443 
444     assert found[0].severity is Severity.INFORMATIONAL
445     assert SEVERITY_WEIGHT[found[0].severity] == 0.0

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

444     assert found[0].severity is Severity.INFORMATIONAL
445     assert SEVERITY_WEIGHT[found[0].severity] == 0.0
446     assert found[0].category is Category.POLICY_DOCS

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

445     assert SEVERITY_WEIGHT[found[0].severity] == 0.0
446     assert found[0].category is Category.POLICY_DOCS
447

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

461 
462     assert len(unused_findings(rules, [], path)) == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

71 
72     assert [str(f.file_path) for f in primary] == [str(tmp_path / "src" / "app.py")]
73     assert len(axes["test tree"]) == 2

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

72     assert [str(f.file_path) for f in primary] == [str(tmp_path / "src" / "app.py")]
73     assert len(axes["test tree"]) == 2
74

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

84 
85     assert len(primary) + sum(len(v) for v in axes.values()) == len(findings)
86

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

96 
97     assert len(axes["test tree"]) == 700
98     assert score(kept, 10_000).overall == score(primary_only, 10_000).overall

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

97     assert len(axes["test tree"]) == 700
98     assert score(kept, 10_000).overall == score(primary_only, 10_000).overall
99

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

129     # Neither grades the code condition.
130     assert primary == []
131     assert {f.rule_id for f in axes["test tree"]} == {"gitleaks.private-key", "B101"}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

130     assert primary == []
131     assert {f.rule_id for f in axes["test tree"]} == {"gitleaks.private-key", "B101"}
132

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

134     gated = gated_findings([], (axes["test tree"],), {"fail_on_category": ["secrets"]})
135     assert [f.rule_id for f in gated] == ["gitleaks.private-key"]
136     assert Category.SECRETS in GATED_FROM_ANY_AXIS

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

135     assert [f.rule_id for f in gated] == ["gitleaks.private-key"]
136     assert Category.SECRETS in GATED_FROM_ANY_AXIS
137

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

147 
148     assert gated_findings([], ([smell],), {"fail_on_severity": ["high"]}) == []
149

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

160 
161     assert gated_findings([], ([secret],), {}) == []
162     assert len(gated_findings([], ([secret],), {"fail_on_category": ["secrets"]})) == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

161     assert gated_findings([], ([secret],), {}) == []
162     assert len(gated_findings([], ([secret],), {"fail_on_category": ["secrets"]})) == 1
163

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

168 
169     assert gated_findings(primary, (), {}) == primary
170

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

188 
189     assert primary == 3
190     assert test == 2

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

189     assert primary == 3
190     assert test == 2
191

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

197 
198     assert loc_under(tmp_path, (".py",), (), ()) == (2, 0, 0)
199

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

214 
215     assert report.count == 3
216     assert report.loc == 4_284

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

215     assert report.count == 3
216     assert report.loc == 4_284
217     assert report.per_severity_count == {Severity.LOW: 1, Severity.MEDIUM: 2}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

216     assert report.loc == 4_284
217     assert report.per_severity_count == {Severity.LOW: 1, Severity.MEDIUM: 2}
218     assert "not scored" in report.headline()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

217     assert report.per_severity_count == {Severity.LOW: 1, Severity.MEDIUM: 2}
218     assert "not scored" in report.headline()
219

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

224 
225     assert report.count == 0
226     assert "nothing found" in report.headline()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

225     assert report.count == 0
226     assert "nothing found" in report.headline()
227

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

232 
233     assert report.loc is None
234     assert report.count == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

233     assert report.loc is None
234     assert report.count == 1
235     assert "documentation" in report.headline()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

234     assert report.count == 1
235     assert "documentation" in report.headline()
236

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

260 
261     assert (primary, test, docs) == (3, 0, 2)
262

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

268 
269     assert loc_under(tmp_path, (".yml",), (), (), (), ()) == (2, 0, 0)
270

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

282 
283     assert primary == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

29 def _report_text() -> str:
30     assert REPORT.is_file(), f"published report is missing: {REPORT}"
31     return REPORT.read_text(encoding="utf-8")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

35     """GitHub Pages publishes the committed files without Jekyll processing."""
36     assert (ROOT / "docs" / ".nojekyll").is_file()
37

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

40     """GitHub Pages publishes the site at the committed custom domain."""
41     assert (ROOT / "docs" / "CNAME").read_text(encoding="utf-8").strip() == DOMAIN
42

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

45     """The published report contains the package version it documents."""
46     assert __version__ in _report_text()
47

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

55         if tag == "script":
56             assert "src" not in attrs
57         if tag == "link" and "stylesheet" in attrs.get("rel", "").lower().split():

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

60             value = attrs.get(attribute, "")
61             assert not value.lower().startswith(("http://", "https://")), (
62                 f"{tag} {attribute} points outside the published report: {value}"
63             )
64

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

69     for path_fragment in ("/Users/", "/home/", "/private/tmp", "C:\\"):
70         assert path_fragment not in report
71

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

75     readme = (ROOT / "README.md").read_text(encoding="utf-8")
76     assert f"{PAGES}example-report.html" in readme
77     assert f"{PAGES}html/" in readme

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

76     assert f"{PAGES}example-report.html" in readme
77     assert f"{PAGES}html/" in readme
78     assert "marshallguillory86.github.io/secure-code-agent" not in readme

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

77     assert f"{PAGES}html/" in readme
78     assert "marshallguillory86.github.io/secure-code-agent" not in readme
79     assert "outcomes360" not in readme.lower()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

78     assert "marshallguillory86.github.io/secure-code-agent" not in readme
79     assert "outcomes360" not in readme.lower()
80

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

84     contributing = (ROOT / "CONTRIBUTING.md").read_text(encoding="utf-8")
85     assert "example-report.html" in contributing

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

37 def test_landing_page_exists_and_declares_english() -> None:
38     assert LANDING_PAGE.is_file()
39     _, parser = parse_landing_page()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

41     html_tags = tags(parser, "html")
42     assert html_tags
43     assert html_tags[0].get("lang") == "en"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

42     assert html_tags
43     assert html_tags[0].get("lang") == "en"
44

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

49 
50     assert images
51     image = images[0]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

52     image_path = (DOCS / image["src"]).resolve()
53     assert image_path.is_file()
54     assert image_path.is_relative_to((DOCS / "brand").resolve())

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

53     assert image_path.is_file()
54     assert image_path.is_relative_to((DOCS / "brand").resolve())
55     assert image["alt"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

54     assert image_path.is_relative_to((DOCS / "brand").resolve())
55     assert image["alt"]
56     assert len(image["alt"]) >= 20

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

55     assert image["alt"]
56     assert len(image["alt"]) >= 20
57     assert int(image["width"]) >= 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

56     assert len(image["alt"]) >= 20
57     assert int(image["width"]) >= 1
58     assert int(image["height"]) >= 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

57     assert int(image["width"]) >= 1
58     assert int(image["height"]) >= 1
59

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

64 
65     assert "example-report.html" in hrefs
66     assert "html/" in hrefs

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

65     assert "example-report.html" in hrefs
66     assert "html/" in hrefs
67     assert "https://github.com/marshallguillory86/secure-code-agent" in hrefs

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

66     assert "html/" in hrefs
67     assert "https://github.com/marshallguillory86/secure-code-agent" in hrefs
68     assert "https://pypi.org/project/secure-code-agent/" in hrefs

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

67     assert "https://github.com/marshallguillory86/secure-code-agent" in hrefs
68     assert "https://pypi.org/project/secure-code-agent/" in hrefs
69

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

73 
74     assert "pip install secure-code-agent" in "".join(parser.text_parts)
75

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

87 
88     assert properties.get("og:title")
89     assert properties.get("og:description")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

88     assert properties.get("og:title")
89     assert properties.get("og:description")
90     image_url = properties.get("og:image", "")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

90     image_url = properties.get("og:image", "")
91     assert image_url.startswith(PAGES_URL)
92     image_path = Path(urlparse(image_url).path.lstrip("/"))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

92     image_path = Path(urlparse(image_url).path.lstrip("/"))
93     assert (DOCS / image_path).is_file()
94     assert properties.get("og:url") == PAGES_URL

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

93     assert (DOCS / image_path).is_file()
94     assert properties.get("og:url") == PAGES_URL
95     assert names.get("twitter:card") == "summary_large_image"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

94     assert properties.get("og:url") == PAGES_URL
95     assert names.get("twitter:card") == "summary_large_image"
96

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

100 
101     assert tags(parser, "style")
102     assert not tags(parser, "script") or all("src" not in attrs for attrs in tags(parser, "script"))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

101     assert tags(parser, "style")
102     assert not tags(parser, "script") or all("src" not in attrs for attrs in tags(parser, "script"))
103     assert not tags(parser, "link") or all(

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

102     assert not tags(parser, "script") or all("src" not in attrs for attrs in tags(parser, "script"))
103     assert not tags(parser, "link") or all(
104         "stylesheet" not in attrs.get("rel", "").lower().split() for attrs in tags(parser, "link")
105     )
106     for tag in ("script", "link", "img"):

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

106     for tag in ("script", "link", "img"):
107         assert all(
108             not attrs.get(attribute, "").lower().startswith(("http://", "https://"))
109             for attrs in tags(parser, tag)
110             for attribute in ("src", "href")
111         )
112     assert "<script src" not in html.lower()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

111         )
112     assert "<script src" not in html.lower()
113

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

117 
118     assert "outcomes360" not in html.lower()
119

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

124 
125     assert "marshallguillory86.github.io/secure-code-agent" not in html

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

30     resolved = str(secure_code_audit.__file__)
31     assert REPO_SRC in resolved, (
32         "the suite imported secure_code_audit from outside this checkout's "
33         f"src/ — it is testing an installed copy at {resolved}"
34     )
35     assert "site-packages" not in resolved, (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

34     )
35     assert "site-packages" not in resolved, (
36         f"the suite imported secure_code_audit from site-packages: {resolved}"
37     )

B404 — Consider possible security implications associated with the subprocess module. 🆕

2 from pathlib import Path
3 from subprocess import CompletedProcess
4

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

50 
51     assert findings[0].rule_id == "B608"
52     assert findings[0].severity is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

51     assert findings[0].rule_id == "B608"
52     assert findings[0].severity is Severity.HIGH
53     assert findings[0].line_end == 9

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

52     assert findings[0].severity is Severity.HIGH
53     assert findings[0].line_end == 9
54

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

55     monkeypatch.setattr(scanner, "_exec", lambda *args, **kwargs: _proc(stderr="slow", code=124))
56     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "bandit.tool_timeout"
57     monkeypatch.setattr(scanner, "_exec", lambda *args, **kwargs: _proc(stdout="bad json"))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

57     monkeypatch.setattr(scanner, "_exec", lambda *args, **kwargs: _proc(stdout="bad json"))
58     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "bandit.tool_error"
59

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

89 
90     assert result.outcome is ScannerOutcome.FAILED, (
91         "bandit exited 2 and the scan was reported as a completed clean run"
92     )
93     assert result.findings[0].rule_id == "bandit.tool_error"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

92     )
93     assert result.findings[0].rule_id == "bandit.tool_error"
94     assert "internal error" in result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

93     assert result.findings[0].rule_id == "bandit.tool_error"
94     assert "internal error" in result.reason
95

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

123 
124     assert result.outcome is ScannerOutcome.COMPLETED
125     assert [f.rule_id for f in result.findings] == ["B608"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

124     assert result.outcome is ScannerOutcome.COMPLETED
125     assert [f.rule_id for f in result.findings] == ["B608"]
126

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

138 
139     assert scanner.scan(tmp_path, config).findings == ()
140     assert "--quiet" in captured

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

139     assert scanner.scan(tmp_path, config).findings == ()
140     assert "--quiet" in captured
141     assert captured.count("--exclude") == 1

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

140     assert "--quiet" in captured
141     assert captured.count("--exclude") == 1
142     assert captured[captured.index("--exclude") + 1] == ",".join(

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

141     assert captured.count("--exclude") == 1
142     assert captured[captured.index("--exclude") + 1] == ",".join(
143         [str(tmp_path / "tests"), str(tmp_path / "build"), str(tmp_path / ".venv")]
144     )
145

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

151 
152     assert excludes == [
153         str(tmp_path / "tests") + "/*",
154         str(tmp_path / "build") + "/*",
155         str(tmp_path / "**/__pycache__") + "/*",
156         str(tmp_path / "**/*.min.js"),
157     ]
158

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

179     findings = scanner.scan(tmp_path, Config()).findings
180     assert findings[0].severity is Severity.CRITICAL
181     assert findings[0].category is Category.SECRETS

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

180     assert findings[0].severity is Severity.CRITICAL
181     assert findings[0].category is Category.SECRETS
182     assert "REDACTED" in findings[0].message

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

181     assert findings[0].category is Category.SECRETS
182     assert "REDACTED" in findings[0].message
183

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

186     )
187     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "gitleaks.tool_error"
188

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

200 
201     assert result.outcome is ScannerOutcome.FAILED
202     assert "JSON parse failure" in result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

201     assert result.outcome is ScannerOutcome.FAILED
202     assert "JSON parse failure" in result.reason
203

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

224 
225     assert {finding.severity for finding in findings} == {Severity.CRITICAL, Severity.MEDIUM}
226     assert all(finding.file_path == project / "package-lock.json" for finding in findings)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

225     assert {finding.severity for finding in findings} == {Severity.CRITICAL, Severity.MEDIUM}
226     assert all(finding.file_path == project / "package-lock.json" for finding in findings)
227

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

235     # coverage — only this one means "raise the timeout".
236     assert scanner.scan(tmp_path, Config()).outcome is ScannerOutcome.TIMED_OUT
237     monkeypatch.setattr(scanner, "_exec", lambda *args, **kwargs: _proc(stderr="boom", code=2))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

237     monkeypatch.setattr(scanner, "_exec", lambda *args, **kwargs: _proc(stderr="boom", code=2))
238     assert scanner.scan(tmp_path, Config()).outcome is ScannerOutcome.FAILED
239     monkeypatch.setattr(scanner, "_exec", lambda *args, **kwargs: _proc(stdout="bad"))

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

239     monkeypatch.setattr(scanner, "_exec", lambda *args, **kwargs: _proc(stdout="bad"))
240     assert scanner.scan(tmp_path, Config()).outcome is ScannerOutcome.FAILED
241

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

288     findings = scanner.scan(tmp_path, Config()).findings
289     assert findings[0].canonical_cwe == "CWE-95"
290     assert findings[0].severity is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

289     assert findings[0].canonical_cwe == "CWE-95"
290     assert findings[0].severity is Severity.HIGH
291

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

297     monkeypatch.setattr(SemgrepScanner, "_exec", invalid_exec)
298     assert scanner.scan(tmp_path, Config()).findings[0].rule_id == "semgrep.tool_error"
299

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

313 
314     assert result.outcome is ScannerOutcome.FAILED
315     execution = execution_from_result("gitleaks", result)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

315     execution = execution_from_result("gitleaks", result)
316     assert evaluate_coverage([execution], ["gitleaks"]).status is CoverageStatus.FAILED
317

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

326 
327     assert [f.rule_id for f in findings] == ["gitleaks.tool_error"]
328

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

337 
338     assert result.findings == ()
339     assert result.outcome is ScannerOutcome.COMPLETED

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

338     assert result.findings == ()
339     assert result.outcome is ScannerOutcome.COMPLETED
340

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

351 
352     assert result.outcome is ScannerOutcome.FAILED
353     assert "must be a JSON array" in result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

352     assert result.outcome is ScannerOutcome.FAILED
353     assert "must be a JSON array" in result.reason
354

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

374     config_arg = captured["args"][captured["args"].index("--config") + 1]
375     assert config_arg.endswith("semgrep-offline.yaml")
376     assert not config_arg.startswith("p/")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

375     assert config_arg.endswith("semgrep-offline.yaml")
376     assert not config_arg.startswith("p/")
377     # Rule ids would otherwise be prefixed with the config file's path,

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

378     # varying by install location and destabilizing baseline fingerprints.
379     assert "--no-rewrite-rule-ids" in captured["args"]
380

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

388 
389     assert result.outcome is ScannerOutcome.FAILED
390     assert "packaged ruleset" in result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

389     assert result.outcome is ScannerOutcome.FAILED
390     assert "packaged ruleset" in result.reason
391

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

397 
398     assert _cwe_from_rule({"properties": {"tags": ["CWE-78", "security"]}}) == "CWE-78"
399     assert _cwe_from_rule({"properties": {"cwe": ["CWE-89: SQL Injection"]}}) == "CWE-89"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

398     assert _cwe_from_rule({"properties": {"tags": ["CWE-78", "security"]}}) == "CWE-78"
399     assert _cwe_from_rule({"properties": {"cwe": ["CWE-89: SQL Injection"]}}) == "CWE-89"
400     assert _cwe_from_rule({"properties": {"cwe": "CWE-22"}}) == "CWE-22"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

399     assert _cwe_from_rule({"properties": {"cwe": ["CWE-89: SQL Injection"]}}) == "CWE-89"
400     assert _cwe_from_rule({"properties": {"cwe": "CWE-22"}}) == "CWE-22"
401     assert _cwe_from_rule({"properties": {"tags": ["security"]}}) is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

400     assert _cwe_from_rule({"properties": {"cwe": "CWE-22"}}) == "CWE-22"
401     assert _cwe_from_rule({"properties": {"tags": ["security"]}}) is None
402     assert _cwe_from_rule({}) is None

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

401     assert _cwe_from_rule({"properties": {"tags": ["security"]}}) is None
402     assert _cwe_from_rule({}) is None
403

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

408     path = semgrep_scanner.offline_ruleset_path()
409     assert path is not None, "the offline ruleset must ship with the package"
410     rules = yaml.safe_load(path.read_text(encoding="utf-8"))["rules"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

410     rules = yaml.safe_load(path.read_text(encoding="utf-8"))["rules"]
411     assert rules
412     for rule in rules:

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

412     for rule in rules:
413         assert rule["id"].startswith("sca.offline.")
414         assert rule["metadata"]["cwe"].startswith("CWE-")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

413         assert rule["id"].startswith("sca.offline.")
414         assert rule["metadata"]["cwe"].startswith("CWE-")
415         assert rule["severity"] in {"ERROR", "WARNING", "INFO"}

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

414         assert rule["metadata"]["cwe"].startswith("CWE-")
415         assert rule["severity"] in {"ERROR", "WARNING", "INFO"}

B404 — Consider possible security implications associated with the subprocess module. 🆕

7 from pathlib import Path
8 from subprocess import CompletedProcess
9

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

55     findings = TrivyScanner().scan(tmp_path, Config()).findings
56     assert len(findings) == 1
57     assert findings[0].severity is Severity.INFORMATIONAL

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

56     assert len(findings) == 1
57     assert findings[0].severity is Severity.INFORMATIONAL
58     assert "trivy" in findings[0].rule_id

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

57     assert findings[0].severity is Severity.INFORMATIONAL
58     assert "trivy" in findings[0].rule_id
59

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

109     findings = TrivyScanner().scan(tmp_path, Config()).findings
110     assert {f.canonical_cwe for f in findings} >= {None, "CWE-1104"} or len(findings) == 2
111

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

112     cats = {f.category for f in findings}
113     assert Category.DEPENDENCIES in cats
114     assert Category.CONFIG_IAC in cats

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

113     assert Category.DEPENDENCIES in cats
114     assert Category.CONFIG_IAC in cats
115

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122     findings = CheckovScanner().scan(tmp_path, Config()).findings
123     assert findings[0].severity is Severity.INFORMATIONAL
124

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

162     findings = CheckovScanner().scan(tmp_path, Config()).findings
163     assert findings
164     assert all(f.category is Category.CONFIG_IAC for f in findings)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

163     assert findings
164     assert all(f.category is Category.CONFIG_IAC for f in findings)
165     assert findings[0].scanner == "checkov"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

164     assert all(f.category is Category.CONFIG_IAC for f in findings)
165     assert findings[0].scanner == "checkov"
166

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

173     findings = HadolintScanner().scan(tmp_path, Config()).findings
174     assert findings[0].severity is Severity.INFORMATIONAL
175

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

184     # incomplete, so the outcome says so and carries the reason.
185     assert result.outcome is ScannerOutcome.NOT_APPLICABLE
186     assert "No Dockerfiles found" in result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

185     assert result.outcome is ScannerOutcome.NOT_APPLICABLE
186     assert "No Dockerfiles found" in result.reason
187

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

218     findings = HadolintScanner().scan(tmp_path, Config()).findings
219     assert len(findings) == 2
220

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

221     by_rule = {f.rule_id: f for f in findings}
222     assert by_rule["hadolint.DL3002"].severity is Severity.HIGH  # USER root → HIGH
223     assert by_rule["hadolint.DL3007"].severity is Severity.LOW  # latest tag → LOW

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

222     assert by_rule["hadolint.DL3002"].severity is Severity.HIGH  # USER root → HIGH
223     assert by_rule["hadolint.DL3007"].severity is Severity.LOW  # latest tag → LOW
224

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

231     findings = OsvScanner().scan(tmp_path, Config()).findings
232     assert findings[0].severity is Severity.INFORMATIONAL
233

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

264     findings = OsvScanner().scan(tmp_path, Config()).findings
265     assert len(findings) == 1
266     f = findings[0]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

266     f = findings[0]
267     assert f.category is Category.DEPENDENCIES
268     assert f.severity is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

267     assert f.category is Category.DEPENDENCIES
268     assert f.severity is Severity.HIGH
269     assert "GHSA-x84v-xcm2-53pg" in f.message

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

268     assert f.severity is Severity.HIGH
269     assert "GHSA-x84v-xcm2-53pg" in f.message
270     # The resolved executable is argv[0]; the subcommand follows it.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

270     # The resolved executable is argv[0]; the subcommand follows it.
271     assert captured[:3] == [OsvScanner.binary, "scan", "source"]
272

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

291     result = OsvScanner().scan(tmp_path, Config())
292     assert result.outcome is ScannerOutcome.NOT_APPLICABLE
293     assert "no package sources" in (result.reason or "").lower()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

292     assert result.outcome is ScannerOutcome.NOT_APPLICABLE
293     assert "no package sources" in (result.reason or "").lower()
294

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

295     coverage = evaluate_coverage([execution_from_result("osv_scanner", result)], required=())
296     assert coverage.status is CoverageStatus.COMPLETE
297

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

308     result = OsvScanner().scan(tmp_path, Config())
309     assert result.outcome is ScannerOutcome.FAILED
310

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

311     coverage = evaluate_coverage([execution_from_result("osv_scanner", result)], required=())
312     assert coverage.status is CoverageStatus.PARTIAL
313

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

320     findings = TruffleHogScanner().scan(tmp_path, Config()).findings
321     assert findings[0].severity is Severity.INFORMATIONAL
322

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

366     findings = TruffleHogScanner().scan(tmp_path, Config()).findings
367     assert len(findings) == 2
368

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

369     by_detector = {f.rule_id: f for f in findings}
370     assert by_detector["trufflehog.AWS"].severity is Severity.CRITICAL
371     assert by_detector["trufflehog.GenericApiKey"].severity is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

370     assert by_detector["trufflehog.AWS"].severity is Severity.CRITICAL
371     assert by_detector["trufflehog.GenericApiKey"].severity is Severity.HIGH
372     # Category should always be SECRETS.

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

372     # Category should always be SECRETS.
373     assert all(f.category is Category.SECRETS for f in findings)
374

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

381     findings = ScorecardScanner().scan(tmp_path, Config()).findings
382     assert findings[0].severity is Severity.INFORMATIONAL
383

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

390 
391     assert result.outcome is ScannerOutcome.NOT_APPLICABLE
392     assert "remote GitHub URL" in result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

391     assert result.outcome is ScannerOutcome.NOT_APPLICABLE
392     assert "remote GitHub URL" in result.reason
393

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

396     s = ScorecardScanner._score_to_severity
397     assert s(None) is None
398     assert s(10) is None  # passed cleanly

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

397     assert s(None) is None
398     assert s(10) is None  # passed cleanly
399     assert s(-1) is Severity.INFORMATIONAL

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

398     assert s(10) is None  # passed cleanly
399     assert s(-1) is Severity.INFORMATIONAL
400     assert s(0) is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

399     assert s(-1) is Severity.INFORMATIONAL
400     assert s(0) is Severity.HIGH
401     assert s(2) is Severity.HIGH

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

400     assert s(0) is Severity.HIGH
401     assert s(2) is Severity.HIGH
402     assert s(5) is Severity.MEDIUM

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

401     assert s(2) is Severity.HIGH
402     assert s(5) is Severity.MEDIUM
403     assert s(8) is Severity.LOW

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

402     assert s(5) is Severity.MEDIUM
403     assert s(8) is Severity.LOW
404

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

434     by_name = {f.rule_id: f for f in findings}
435     assert by_name["scorecard.Security-Policy"].category is Category.POLICY_DOCS
436     assert by_name["scorecard.Pinned-Dependencies"].category is Category.SUPPLY_CHAIN

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

435     assert by_name["scorecard.Security-Policy"].category is Category.POLICY_DOCS
436     assert by_name["scorecard.Pinned-Dependencies"].category is Category.SUPPLY_CHAIN
437

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

452 
453     assert result.outcome is ScannerOutcome.FAILED
454     execution = execution_from_result("trufflehog", result)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

454     execution = execution_from_result("trufflehog", result)
455     assert evaluate_coverage([execution], ["trufflehog"]).status is CoverageStatus.FAILED
456

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

466 
467     assert [f.rule_id for f in scanner.scan(tmp_path, Config()).findings] == [
468         "trufflehog.tool_error"
469     ]
470

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

482 
483     assert result.findings == ()
484     assert result.outcome is ScannerOutcome.COMPLETED

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

483     assert result.findings == ()
484     assert result.outcome is ScannerOutcome.COMPLETED

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

58 def test_a_confident_finding_from_a_trusted_rule_is_a_fix():
59     assert tier_of(_f("B602")) is Tier.FIX
60

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63     """B105 is the case this whole module exists for."""
64     assert tier_of(_f("B105", message="Possible hardcoded password: 'password'")) is Tier.REVIEW
65

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

68     """The scanner said it was guessing. Say so rather than overruling it."""
69     assert tier_of(_f("B113", confidence=Confidence.LOW)) is Tier.REVIEW
70

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

72 def test_a_test_tree_finding_is_a_suppression_candidate():
73     assert tier_of(_f("B105"), axis="test tree") is Tier.ACCEPT
74

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

76 def test_a_documentation_finding_is_a_suppression_candidate():
77     assert tier_of(_f("B105"), axis="documentation") is Tier.ACCEPT
78

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82     test tree is not what an operator asked for."""
83     assert tier_of(_f("B602", confidence=Confidence.HIGH), axis="test tree") is Tier.ACCEPT
84

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

116 
117     assert tier_of(finding) is Tier.FIX
118

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

136 
137     assert tier_of(finding) is Tier.REVIEW
138

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

144 
145     assert tier_of(finding, axis="test tree") is Tier.ACCEPT
146

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

150     promotion puts noise at the top of the work order."""
151     assert tier_of(_f("B105", message="no quoted value here")) is Tier.REVIEW
152

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

163 
164     assert sum(len(v) for v in grouped.values()) == 3
165

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

171 
172     assert sum(len(v) for v in grouped.values()) == 0
173

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

178 
179     assert sum(len(v) for v in grouped.values()) == 0
180

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

190 
191     assert [f.severity for f in ordered] == [Severity.CRITICAL, Severity.MEDIUM, Severity.LOW]
192

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

203 
204     assert reason and "heuristic" in reason
205

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

209 
210     assert reason and "low confidence" in reason
211

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

213 def test_a_fix_tier_finding_needs_no_excuse():
214     assert reason_for(_f("B602")) is None
215

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

220     for rule_id, reason in LOW_PRECISION.items():
221         assert len(reason) > 120, f"{rule_id} has no substantive justification"
222         assert any(ch.isdigit() for ch in reason), (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

221         assert len(reason) > 120, f"{rule_id} has no substantive justification"
222         assert any(ch.isdigit() for ch in reason), (
223             f"{rule_id} cites no measurement — every entry should name what was counted"
224         )
225

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

244 
245     assert len(order.splitlines()) < 200, "the ACCEPT tier is still being listed per finding"
246     assert "| `B101` | 500 |" in order, "the summary lost the count"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

245     assert len(order.splitlines()) < 200, "the ACCEPT tier is still being listed per finding"
246     assert "| `B101` | 500 |" in order, "the summary lost the count"
247     assert ".scignore.yaml" in order, "no suppression was drafted"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

246     assert "| `B101` | 500 |" in order, "the summary lost the count"
247     assert ".scignore.yaml" in order, "no suppression was drafted"
248

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

260     # had to be found and changed by hand.
261     assert "more in" in order
262     assert f"{120 - _MAX_BLOCKS} more in" in order

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

261     assert "more in" in order
262     assert f"{120 - _MAX_BLOCKS} more in" in order
263     assert "in the JSON report" in order

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

262     assert f"{120 - _MAX_BLOCKS} more in" in order
263     assert "in the JSON report" in order
264     assert "JSON report" in order, "no pointer to where the rest live"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

263     assert "in the JSON report" in order
264     assert "JSON report" in order, "no pointer to where the rest live"

B404 — Consider possible security implications associated with the subprocess module. 🆕

49 from pathlib import Path
50 from subprocess import CompletedProcess
51

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

96 
97     assert result.outcome is ScannerOutcome.FAILED, result.outcome
98     assert "429" in result.reason, (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

97     assert result.outcome is ScannerOutcome.FAILED, result.outcome
98     assert "429" in result.reason, (
99         f"trivy named a rate limit and a remedy and the reason dropped both: {result.reason!r}"
100     )
101     assert "Maven" in result.reason, result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

100     )
101     assert "Maven" in result.reason, result.reason
102

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

109 
110     assert "SARIF" in result.reason, result.reason
111

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122 
123     assert result.outcome is ScannerOutcome.FAILED
124     assert result.reason and result.reason.strip(), result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

123     assert result.outcome is ScannerOutcome.FAILED
124     assert result.reason and result.reason.strip(), result.reason
125     assert "SARIF" in result.reason, result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

124     assert result.reason and result.reason.strip(), result.reason
125     assert "SARIF" in result.reason, result.reason
126

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

139 
140     assert result.outcome is ScannerOutcome.COMPLETED, result.reason
141

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

148 
149     assert result.outcome is ScannerOutcome.COMPLETED, result.reason
150     assert list(result.findings) == []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

149     assert result.outcome is ScannerOutcome.COMPLETED, result.reason
150     assert list(result.findings) == []
151

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

158 
159     assert result.outcome is ScannerOutcome.FAILED
160     assert "unknown flag" in result.reason, result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

159     assert result.outcome is ScannerOutcome.FAILED
160     assert "unknown flag" in result.reason, result.reason

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

48 
49     assert [f.fingerprint for f in result.fixed] == ["a"]
50     assert [f.fingerprint for f in result.unresolved] == ["b"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

49     assert [f.fingerprint for f in result.fixed] == ["a"]
50     assert [f.fingerprint for f in result.unresolved] == ["b"]
51

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

55 
56     assert [f.fingerprint for f in result.introduced] == ["z"]
57

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

63 
64     assert result.fixed == ()
65     assert [f.fingerprint for f in result.suppressed] == ["a"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

64     assert result.fixed == ()
65     assert [f.fingerprint for f in result.suppressed] == ["a"]
66

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

75 
76     assert (result.fixed, result.introduced, result.unresolved) == ((), (), ())
77

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

84 def test_fixing_something_and_breaking_nothing_is_an_improvement():
85     assert compare([_f("a")], []).improved is True
86

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

92 
93     assert result.fixed and result.introduced
94     assert result.improved is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

93     assert result.fixed and result.introduced
94     assert result.improved is False
95

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

97 def test_changing_nothing_is_not_an_improvement():
98     assert compare([_f("a")], [_f("a")]).improved is False
99

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

101 def test_silencing_everything_is_not_an_improvement():
102     assert compare([_f("a")], [_f("a", suppressed=True)]).improved is False
103

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

108 
109     assert result.improved is False
110

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122 
123     assert result.passed is True
124     assert "nothing to fix, nothing broken" in result.headline()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

123     assert result.passed is True
124     assert "nothing to fix, nothing broken" in result.headline()
125

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

131 
132     assert result.passed is False
133

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

137 
138     assert result.regressed is True
139     assert result.passed is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

138     assert result.regressed is True
139     assert result.passed is False
140

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

142 def test_silencing_fails_the_gate():
143     assert compare([_f("a")], [_f("a", suppressed=True)]).passed is False
144

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

146 def test_doing_the_work_passes():
147     assert compare([_f("a")], []).passed is True
148

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

171 
172     assert result.fixed == ()
173     assert [f.fingerprint for f in result.suppressed] == ["a"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

172     assert result.fixed == ()
173     assert [f.fingerprint for f in result.suppressed] == ["a"]
174     assert result.improved is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

173     assert [f.fingerprint for f in result.suppressed] == ["a"]
174     assert result.improved is False
175

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

188 
189     assert [f.fingerprint for f in result.fixed] == ["a"]
190     assert result.improved is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

189     assert [f.fingerprint for f in result.fixed] == ["a"]
190     assert result.improved is True
191

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

196 
197     assert [f.fingerprint for f in result.fixed] == ["a"]
198

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

204 
205     assert [f.fingerprint for f in result.fixed] == ["a"]
206

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

216     headline = result.headline()
217     assert "not proven" in headline
218     assert "introduced" in headline

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

217     assert "not proven" in headline
218     assert "introduced" in headline
219

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

223 
224     assert any("critical" in note for note in result.notes)
225

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

229 
230     assert any("Nothing was resolved" in note for note in result.notes)
231

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

251 
252     assert result.unresolved == ()
253     assert [f.fingerprint for f in result.deferred] == ["a"]

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

252     assert result.unresolved == ()
253     assert [f.fingerprint for f in result.deferred] == ["a"]
254     assert result.passed is True

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

253     assert [f.fingerprint for f in result.deferred] == ["a"]
254     assert result.passed is True
255

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

260 
261     assert [f.fingerprint for f in result.unresolved] == ["a"]
262     assert result.passed is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

261     assert [f.fingerprint for f in result.unresolved] == ["a"]
262     assert result.passed is False
263

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

269 
270     assert [f.fingerprint for f in result.introduced] == ["z"]
271     assert result.passed is False

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

270     assert [f.fingerprint for f in result.introduced] == ["z"]
271     assert result.passed is False
272

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

278     headline = result.headline()
279     assert "nothing required" in headline
280     assert "clean before and after" not in headline

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

279     assert "nothing required" in headline
280     assert "clean before and after" not in headline
281

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

314 
315     assert [f.fingerprint for f in v.fixed] == ["old-one"]
316     assert [f.fingerprint for f in v.introduced] == ["brand-new"], (

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

315     assert [f.fingerprint for f in v.fixed] == ["old-one"]
316     assert [f.fingerprint for f in v.introduced] == ["brand-new"], (
317         "a finding that arrived already suppressed is invisible to verification"
318     )
319     assert v.regressed, "introducing and silencing a finding must count as a regression"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

318     )
319     assert v.regressed, "introducing and silencing a finding must count as a regression"
320     assert not v.passed, "a patch that introduces and silences a finding must not pass"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

319     assert v.regressed, "introducing and silencing a finding must count as a regression"
320     assert not v.passed, "a patch that introduces and silences a finding must not pass"
321     assert any("suppress" in n.lower() for n in v.notes), v.notes

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

320     assert not v.passed, "a patch that introduces and silences a finding must not pass"
321     assert any("suppress" in n.lower() for n in v.notes), v.notes
322

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

336 
337     assert [f.fingerprint for f in v.suppressed] == ["known"]
338     assert v.introduced == ()

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

337     assert [f.fingerprint for f in v.suppressed] == ["known"]
338     assert v.introduced == ()
339     assert v.regressed

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

338     assert v.introduced == ()
339     assert v.regressed

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

69 
70     assert data["counts"]["fix"] == len(tiers[triage.Tier.FIX])
71     assert data["counts"]["review"] == len(tiers[triage.Tier.REVIEW])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

70     assert data["counts"]["fix"] == len(tiers[triage.Tier.FIX])
71     assert data["counts"]["review"] == len(tiers[triage.Tier.REVIEW])
72     assert data["counts"]["accept"] == len(tiers[triage.Tier.ACCEPT])

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

71     assert data["counts"]["review"] == len(tiers[triage.Tier.REVIEW])
72     assert data["counts"]["accept"] == len(tiers[triage.Tier.ACCEPT])
73

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

78 
79     assert entry["rule_id"] == "B608"
80     assert entry["title"] == "SQL injection"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

79     assert entry["rule_id"] == "B608"
80     assert entry["title"] == "SQL injection"
81     assert entry["fix_hint"] == "Use a parameterised query."

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

80     assert entry["title"] == "SQL injection"
81     assert entry["fix_hint"] == "Use a parameterised query."
82     assert entry["path"] == "src/app.py"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

81     assert entry["fix_hint"] == "Use a parameterised query."
82     assert entry["path"] == "src/app.py"
83     assert entry["line_start"] == 12

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

82     assert entry["path"] == "src/app.py"
83     assert entry["line_start"] == 12
84     assert entry["code_snippet"] == "query = 'SELECT ' + name"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

83     assert entry["line_start"] == 12
84     assert entry["code_snippet"] == "query = 'SELECT ' + name"
85     assert entry["standards"]["cwe"] == "CWE-89"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

84     assert entry["code_snippet"] == "query = 'SELECT ' + name"
85     assert entry["standards"]["cwe"] == "CWE-89"
86     assert entry["standards"]["owasp_top10"] == "A03"

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

85     assert entry["standards"]["cwe"] == "CWE-89"
86     assert entry["standards"]["owasp_top10"] == "A03"
87

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

97     for internal in ("fingerprint", "is_new", "suppressed", "suppression_note"):
98         assert internal not in entry
99

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

109 
110     assert len(data["fix"]["shown"]) == remediation._MAX_BLOCKS
111     assert data["fix"]["omitted"] == 5

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

110     assert len(data["fix"]["shown"]) == remediation._MAX_BLOCKS
111     assert data["fix"]["omitted"] == 5
112     assert data["counts"]["fix"] == remediation._MAX_BLOCKS + 5

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

111     assert data["fix"]["omitted"] == 5
112     assert data["counts"]["fix"] == remediation._MAX_BLOCKS + 5
113

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

121         pytest.skip("this rule no longer lands in the review tier")
122     assert review[0]["review_note"], "a demoted finding without its reason is a bare claim"
123

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

129 
130     assert entry["review_note"] is None
131

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

135 
136     assert data["counts"] == {"fix": 0, "review": 0, "accept": 0}
137     assert data["fix"]["shown"] == []

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

136     assert data["counts"] == {"fix": 0, "review": 0, "accept": 0}
137     assert data["fix"]["shown"] == []
138

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

141     """A consumer reads it to know whether it can still parse this."""
142     assert remediation.as_data([])["schema_version"] == (remediation.WORK_ORDER_SCHEMA_VERSION)

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

81 
82     assert len(order.split("\n")) <= MAX_LINES, (
83         f"{count} findings produced {len(order.split(chr(10)))} lines; "
84         f"a work order is a prompt, not a backlog"
85     )
86

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

91 
92     assert len(order.split()) <= MAX_WORDS
93

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

103 
104     assert huge <= small * 1.5, f"12 findings: {small} lines, 5000: {huge}"
105

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

114 
115     assert "more in" in order, "findings were omitted without saying so"
116     assert "in the JSON report" in order

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

115     assert "more in" in order, "findings were omitted without saying so"
116     assert "in the JSON report" in order
117

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

122 
123     assert "more line(s) — open the file" in order
124     fenced = order.count("line 39 of context")

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

124     fenced = order.count("line 39 of context")
125     assert fenced == 0, "the full 40-line context reached the prompt"
126

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

146     ):
147         assert marker in order, f"constraint lost in compression: {marker!r}"
148

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

153 
154     assert len(order.split("\n")) > 40, "the work order is suspiciously empty"
155     assert "§FIX" in order

B101 — Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. 🆕

154     assert len(order.split("\n")) > 40, "the work order is suspiciously empty"
155     assert "§FIX" in order

CVE-2026-111749 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-112907 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-112912 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

CVE-2026-112913 — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

GHSA-xmj3-9gf7-h52w — Trivy finding (vuln / misconfig / secret). 🆕

💡 Fix: Trivy routes vuln/misconfig/secret into different categories — see the finding's category field for the specific guidance.

Informational

suppressions.unused.gitleaks.curl-auth-user — Suppression with no subject. 🆕

rule_id: gitleaks.curl-auth-user; expires 2027-09-11; reason: False positive on a test fixture, and now only in git history. This is the test file for the triage rule that recognises credential *references* -- its fixtures are shell and GitHub Actions variable names, which is the pattern the rule under test exists to recognise as safe. No credential is or was present: the variable spellings are names, and the one credential-shaped string is an invented fake that never authenticated anything. The fixtures are now assembled from parts at runtime so this source carries no matching literal, and a test asserts that; these hits are the earlier committed revision, which gitleaks reads because it scans history as well as the working tree. Not rewriting a pushed branch to hide a false positive. The reason above is deliberately paraphrased -- quoting the expression verbatim is what created the finding in the first place.

💡 Fix: Delete the entry if the finding is fixed, or point it at where the code moved. An entry that matches nothing reads as protection and provides none.

Acknowledged (suppressed)