fix(ci): lint and SAST the same files locally and in CI, and pin the two together

[wshallwshall]

The pre-commit hooks were broader than CI — the dangerous direction.

ruff check in CI named six explicit paths; the ruff-check hook has no exclude, so it runs on every changed Python file. bandit in CI scanned -r messagefoundry tee; its hook scanned everything except tests/harness/samples.

So harness/ (73 findings), tee/ (12), samples/ and docker/ were gated locally and by nothing in CI. Touching any file there failed the commit on errors no CI run could report, and that no green build had ever been able to reveal. I hit it twice in one day: a harness/ import-sort during an unrelated flake fix, and a one-line UP017 in scripts/ that I reverted rather than drag four unrelated bandit findings into a release PR.

A hook looser than CI is an annoyance — CI still catches it. A hook stricter than CI blocks work on a standard the project doesn't enforce, and that's what makes people reach for --no-verify and lose every other gate with it.

Scope now has one definition per tool

• ruff — CI runs ruff check ., matching ruff format --check ., which was already repo-wide while lint was not. pyproject's [tool.ruff] extend-exclude is the single source of truth.
• bandit — CI runs -r . with an --exclude list identical to the hook's; the hook's exclude was widened to match.

99 ruff findings cleared — 88 auto, 11 deliberately

They were not interchangeable:

B905 — zip() without strict=. Three sites, three different answers, which is exactly why a blanket strict=False would have been a fake fix.

• failover.py / sender.py build both operands from the same source one line above → strict=True, which will catch a future divergence that zip's default would silently truncate.
• remote.py is the pairwise idiom zip(x, x[1:]) where lengths differ by design — strict=True would raise on every non-empty input → became itertools.pairwise.

SIM105 — five sites ruff refused to auto-fix, all for the same reason: each carries a comment (# pragma: no cover, "underlying socket already deleted", a two-line rationale) that the contextlib.suppress transform would destroy. Two more would need a new import purely for a style preference. Grandfathered per-line with the reason — the approach [tool.ruff.lint] already documents for this case.

docs/benchmarks/results/ is now ruff-excluded: archived measurement artifacts, the exact scripts a published number came from. Reformatting them edits the record.

Widening bandit surfaced 29 findings CI had never seen

• 9 in scripts/ — subprocess, one urlopen, two try/except/continue in a hand-run Kerberos lab probe. All established reviewed patterns; two already carried # noqa: S603/S310 for ruff's copy of the same rules, and bandit doesn't read noqa, so they now carry # nosec too.
• 20 in packaging/messagefoundry-webconsole/tests/ — literal test credentials (B105/B106). Same "tests carry non-production idioms" case as tests/, one directory deeper; both excludes now name it.

A mistake worth recording

I first measured this as "0 findings, widening is free" and said so. bandit wasn't installed in the worktree venv — python -m bandit failed, and my JSON parse of its error swallowed the failure as an empty result set. The corrected run reports Total lines of code: 114206, a scanned-volume number the broken run never printed. That number is what distinguishes a clean scan from one that never ran, which is the same failure this PR exists to remove.

Drift prevention

tests/test_lint_scope_parity.py reads both configurations and compares them, so narrowing one forces narrowing the other. Mutation-verified in both directions: re-narrowing CI's ruff fails it, and adding an exclude to the ruff hook fails it. It asserts the contract, not a particular scope — widen or narrow freely, provided both sides move together.

Full suite green: 8914 passed, 818 skipped.

🤖 Generated with Claude Code