mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 17:47:24 +01:00
Krzysztof kuhy Rudnicki
de7d5d17eb
Learner SQL piped into the mysql client could run `\! id` as container root and read every DB. Now: --binary-mode (client commands error out), a refused-backslash-line guard, learner exec as uid 65534, and a random root password (0600 file, via env, adopted live on a legacy container). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WzxdWYGW5NZL5uVpnqmNKo
192 lines
4.8 KiB
TOML
192 lines
4.8 KiB
TOML
[build-system]
|
|
requires = ["setuptools>=61"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[project]
|
|
name = "sql_drills"
|
|
version = "0.2.2"
|
|
description = "SQL drills (MySQL, PostgreSQL): sandboxed grading, LeetCode statement examples"
|
|
requires-python = ">=3.14"
|
|
# Stdlib only on purpose: the tutor server imports it from the system python.
|
|
dependencies = []
|
|
|
|
[tool.setuptools.packages.find]
|
|
include = ["sql_drills*"]
|
|
|
|
[tool.setuptools.package-data]
|
|
sql_drills = ["py.typed", "fixtures/*/*"]
|
|
|
|
[tool.ruff]
|
|
target-version = "py314"
|
|
include = ["*.py", "**/*.py"]
|
|
exclude = [".git", ".venv", "__pycache__", "build", "dist", ".eggs"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["ALL"]
|
|
ignore = [
|
|
"CPY001",
|
|
"D100",
|
|
"D101",
|
|
"D102",
|
|
"D103",
|
|
"D104",
|
|
"D105",
|
|
"D107",
|
|
"D203",
|
|
"D213",
|
|
"COM812",
|
|
"ISC001",
|
|
"S603",
|
|
]
|
|
fixable = ["ALL"]
|
|
unfixable = []
|
|
|
|
[tool.ruff.lint.per-file-ignores]
|
|
"scripts/*.py" = ["INP001"]
|
|
# Table names come from information_schema of a throwaway database.
|
|
"**/_sandbox.py" = ["S608"]
|
|
"**/tests/**/*.py" = ["ARG", "D", "PLC0415", "PLR2004", "S101", "S608", "SLF001"]
|
|
"**/test_*.py" = ["ARG", "D", "PLC0415", "PLR2004", "S101", "S608", "SLF001"]
|
|
|
|
[tool.ruff.lint.pydocstyle]
|
|
convention = "google"
|
|
|
|
[tool.ruff.lint.isort]
|
|
force-single-line = false
|
|
force-sort-within-sections = true
|
|
known-first-party = ["sql_drills"]
|
|
|
|
[tool.ruff.lint.flake8-quotes]
|
|
docstring-quotes = "double"
|
|
inline-quotes = "double"
|
|
|
|
[tool.ruff.lint.flake8-tidy-imports]
|
|
ban-relative-imports = "all"
|
|
|
|
[tool.ruff.format]
|
|
quote-style = "double"
|
|
indent-style = "space"
|
|
skip-magic-trailing-comma = false
|
|
line-ending = "auto"
|
|
docstring-code-format = true
|
|
|
|
[tool.mypy]
|
|
python_version = "3.14"
|
|
strict = true
|
|
warn_return_any = true
|
|
warn_unused_configs = true
|
|
disallow_untyped_defs = true
|
|
disallow_incomplete_defs = true
|
|
check_untyped_defs = true
|
|
disallow_untyped_decorators = true
|
|
no_implicit_optional = true
|
|
warn_redundant_casts = true
|
|
warn_unused_ignores = true
|
|
warn_no_return = true
|
|
warn_unreachable = true
|
|
disallow_any_unimported = true
|
|
disallow_any_explicit = false
|
|
disallow_any_generics = true
|
|
disallow_subclassing_any = true
|
|
strict_equality = true
|
|
extra_checks = true
|
|
ignore_missing_imports = true
|
|
show_error_codes = true
|
|
color_output = true
|
|
exclude = [".venv/"]
|
|
|
|
[tool.pylint.main]
|
|
# The repo root on the path, so pylint resolves the package's own imports the
|
|
# same way pytest does instead of reporting import-error for them.
|
|
init-hook = "import sys; sys.path.insert(0, 'sql_drills')"
|
|
analyse-fallback-blocks = true
|
|
persistent = true
|
|
jobs = 0
|
|
py-version = "3.14"
|
|
ignore = [".venv", "__pycache__"]
|
|
# Test suites intentionally use patterns (protected-access, fixture-arg
|
|
# shadowing) that don't apply to source code; ruff's per-file-ignores carry
|
|
# the equivalent exemptions, so tests stay linted -- by ruff. This is the same
|
|
# source-only pylint scope wake-alarm / diet-guard / testsAndMisc use. It has
|
|
# to be `ignore-paths`, not `ignore = ["tests"]`: `ignore` only matches the
|
|
# basename of what pylint is *given*, and pre-commit hands it explicit file
|
|
# paths, so a directory name in `ignore` never fires under the hook.
|
|
ignore-paths = ["^(.*/)?tests/.*$"]
|
|
ignore-patterns = [".*\\.pyi$"]
|
|
|
|
[tool.pylint.messages_control]
|
|
enable = "all"
|
|
disable = [
|
|
"missing-module-docstring",
|
|
"missing-class-docstring",
|
|
"missing-function-docstring",
|
|
"use-implicit-booleaness-not-comparison-to-zero",
|
|
]
|
|
|
|
[tool.pylint.design]
|
|
min-public-methods = 0
|
|
max-module-lines = 1000
|
|
max-attributes = 10
|
|
|
|
[tool.pylint.typecheck]
|
|
generated-members = [
|
|
".*\\.assert_called_once_with",
|
|
".*\\.assert_called_once",
|
|
".*\\.assert_called",
|
|
".*\\.assert_not_called",
|
|
".*\\.assert_any_call",
|
|
".*\\.call_args",
|
|
".*\\.call_args_list",
|
|
".*\\.call_count",
|
|
]
|
|
|
|
[tool.bandit]
|
|
exclude_dirs = ["tests", ".venv"]
|
|
|
|
[tool.pytest.ini_options]
|
|
markers = [
|
|
"docker: needs a live sql-drills MySQL or PostgreSQL container (skipped when it is down)",
|
|
"network: fetches a real LeetCode statement at runtime (skipped when unavailable)",
|
|
]
|
|
testpaths = ["sql_drills/tests"]
|
|
python_files = ["test_*.py", "*_test.py"]
|
|
python_classes = ["Test*"]
|
|
python_functions = ["test_*"]
|
|
addopts = [
|
|
"-v",
|
|
"--strict-markers",
|
|
"--strict-config",
|
|
"-ra",
|
|
"--cov=sql_drills",
|
|
"--cov-branch",
|
|
"--cov-report=term-missing",
|
|
"--cov-report=lcov",
|
|
]
|
|
filterwarnings = [
|
|
"error",
|
|
"ignore::DeprecationWarning",
|
|
"default::pytest.PytestUnraisableExceptionWarning",
|
|
]
|
|
|
|
[tool.coverage.run]
|
|
source = ["sql_drills"]
|
|
branch = true
|
|
omit = [
|
|
"*/__pycache__/*",
|
|
"*/tests/*",
|
|
"*/.venv/*",
|
|
]
|
|
|
|
[tool.coverage.report]
|
|
fail_under = 100
|
|
show_missing = true
|
|
skip_covered = false
|
|
exclude_lines = [
|
|
"pragma: no cover",
|
|
"raise NotImplementedError",
|
|
"raise AssertionError",
|
|
"if TYPE_CHECKING:",
|
|
'if __name__ == "__main__":',
|
|
]
|
|
partial_branches = ["pragma: no branch"]
|