mirror of
https://github.com/kuhyx/signal-bot.git
synced 2026-11-11 15:34:07 +01:00
Krzysztof kuhy Rudnicki
53e231ee14
Some checks are pending
CI / check (push) Waiting to run
Shelter cannot work on this phone, and it would not have helped anyway.
It cannot work: setting a Device Owner makes Android enable
no_add_managed_profile, no_add_private_profile and no_add_clone_profile on
every user, which kills Shelter, Island, Private Space and app cloning
alike. Verified on-device rather than inferred -- `pm create-user
--profileOf 0 --managed` returns "Cannot add user: no_add_managed_profile is
enabled". This is the Android 11 COMP deprecation, enforced in three places
in DevicePolicyManagerService and unchanged through Android 16.
It would not have helped: a second Signal *app* is not a second Signal
*account*. Every account needs its own phone number, so the second number
was always the real requirement -- and once you have one, signal-cli can
register it as a PRIMARY device with no phone app, no QR scan and no work
profile at all. That is strictly better than both the linked-device setup
and the Shelter plan: the bot cannot read personal DMs and never posts as
the account owner.
scripts/register_bot.sh drives that flow. It gates on signal-cli >= 0.14.7
rather than hoping: stable container tag 0.100 bundles 0.14.5, and on
2026-03-06 Signal made the post-quantum ratchet mandatory and de-registered
every account whose client lacked it -- a stale client is how a bot dies
silently months later. Verified that the recommended CI tag really does
bundle 0.14.7 instead of assuming it.
Rehearsed offline, not written blind. fake_signal grew /v1/accounts,
/v1/register/{number}, /v1/register/{number}/verify/{token} and
/v1/groups/{number}, so the whole runbook including every error path
(missing captcha, stray verify, wrong code, unregistered number, empty group
list, out-of-range and non-numeric picks) runs against the fake. The picker
was proven to resolve the group the user actually pointed at.
Prompts now read from $SIGNAL_TTY instead of /dev/tty directly. A hard-coded
/dev/tty made the interactive path untestable without a real terminal; the
seam is the same idea as the injected clock and transport on the Python side,
and is what let the picker be rehearsed at all.
live_smoke.sh and register_bot.sh share scripts/lib_signal.sh so the two
cannot drift, and shellcheck now runs with -x so the sourced lib is actually
linted from its callers.
201 tests, 100% branch coverage, all 23 gates green.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013yaBT45KhHqxTKVCTA87iy
109 lines
3.6 KiB
YAML
109 lines
3.6 KiB
YAML
# Pre-commit hooks for signal-bot.
|
|
#
|
|
# Install with: pre-commit install
|
|
# Run manually: pre-commit run --all-files
|
|
#
|
|
# Every hook is `language: system` because the tools already live in .venv;
|
|
# pre-commit must not build isolated environments for them. fail_fast so a
|
|
# later check cannot run after an earlier one has already rejected the commit.
|
|
fail_fast: true
|
|
|
|
repos:
|
|
- repo: https://github.com/pre-commit/pre-commit-hooks
|
|
rev: v4.6.0
|
|
hooks:
|
|
- id: trailing-whitespace
|
|
args: [--markdown-linebreak-ext=md]
|
|
- id: end-of-file-fixer
|
|
- id: check-yaml
|
|
- id: check-json
|
|
- id: check-toml
|
|
- id: check-merge-conflict
|
|
- id: check-case-conflict
|
|
- id: check-executables-have-shebangs
|
|
- id: check-shebang-scripts-are-executable
|
|
- id: detect-private-key
|
|
- id: debug-statements
|
|
- id: check-ast
|
|
- id: mixed-line-ending
|
|
args: [--fix=lf]
|
|
|
|
- repo: local
|
|
hooks:
|
|
# Suppressions are blocked mechanically, not by discipline. This repo
|
|
# has zero of them and the only way it stays that way is a gate: the
|
|
# rule is "fix the finding, or ask first", and a habit is not a gate.
|
|
- id: no-noqa
|
|
name: block noqa / type:ignore comments
|
|
entry: '(?i)#\s*(noqa|type:\s*ignore)'
|
|
language: pygrep
|
|
types: [python]
|
|
|
|
- id: no-ruff-noqa
|
|
name: block file-level ruff noqa
|
|
entry: '(?i)#\s*ruff:\s*noqa'
|
|
language: pygrep
|
|
types: [python]
|
|
|
|
# The shared 250-line cap. Checks only the files in the commit, so an
|
|
# unrelated commit never breaks. No baseline, no allowlist -- those are
|
|
# suppressions. The exemption list lives with the checker in ~/utils so
|
|
# this repo's idea of the rule cannot drift from every other repo's.
|
|
- id: file-length
|
|
name: file length <= 250 lines
|
|
entry: scripts/check_file_length.sh
|
|
language: system
|
|
|
|
# Four markdown namespaces (README / CLAUDE* / DOCS* / TODO*), plus the
|
|
# rule that a TODO carries "REMOVE ME AFTER FINISH" and nothing else may.
|
|
- id: md-naming
|
|
name: markdown naming convention
|
|
entry: scripts/check_md_naming.sh
|
|
language: system
|
|
files: \.md$
|
|
|
|
# Exact pins at newest stable. Runs repo-wide: a pin goes stale because
|
|
# upstream released, not because this commit touched the manifest.
|
|
- id: dependency-freshness
|
|
name: dependencies are newest stable
|
|
entry: scripts/check_dependency_freshness.sh --all
|
|
language: system
|
|
pass_filenames: false
|
|
always_run: true
|
|
|
|
- id: ruff-format
|
|
name: ruff format
|
|
entry: .venv/bin/ruff format --check
|
|
language: system
|
|
types_or: [python, pyi]
|
|
|
|
- id: ruff
|
|
name: ruff (ALL rules)
|
|
entry: .venv/bin/ruff check --force-exclude
|
|
language: system
|
|
types_or: [python, pyi]
|
|
|
|
- id: mypy
|
|
name: mypy --strict
|
|
entry: .venv/bin/mypy
|
|
language: system
|
|
pass_filenames: false
|
|
args: [signal_bot, fake_signal]
|
|
|
|
- id: shellcheck
|
|
name: shellcheck
|
|
# Same severity floor as CI: a stricter runner version must not be
|
|
# the thing that discovers a finding this hook let through.
|
|
entry: shellcheck -x --severity=style
|
|
language: system
|
|
types: [shell]
|
|
|
|
# 100% branch coverage, no omits. Runs on every commit: coverage is the
|
|
# whole point of the suite, and a partial run cannot prove it.
|
|
- id: pytest
|
|
name: pytest (100% branch coverage)
|
|
entry: .venv/bin/python -m pytest -q
|
|
language: system
|
|
pass_filenames: false
|
|
always_run: true
|