Feat/move edu features to edu tz app

.deepsource.toml

@@ -6,4 +6,3 @@ enabled = true
 
   [analyzers.meta]
   runtime_version = "3.x.x"
-

.github/workflows/linter.yml

@@ -28,7 +28,10 @@ jobs:
           cache: pip
       - name: Install pre-commit
         run: pip install pre-commit
+      # Semgrep is skipped here and run as a full-repo scan in the next steps
       - name: Run pre-commit on changed files
+        env:
+          SKIP: frappe-semgrep-rules
         run: |
           pre-commit run \
             --show-diff-on-failure \
@@ -39,10 +42,23 @@ jobs:
       - name: Download Semgrep rules
         run: git clone --depth 1 https://github.com/frappe/semgrep-rules.git frappe-semgrep-rules
 
+      - name: Install Semgrep
+        run: pip install semgrep
+
+      # Blocking: real bugs / security issues only
       - name: Run Semgrep rules
         run: |
-          pip install semgrep
-          semgrep ci --config ./frappe-semgrep-rules/rules --config r/python.lang.correctness
+          semgrep scan --config ./frappe-semgrep-rules/rules \
+            --config r/python.lang.security \
+            --severity=ERROR --error csf_tz
+
+      # Informational: style and i18n warnings, never fails the build
+      - name: Semgrep warnings (non-blocking)
+        if: always()
+        run: |
+          semgrep scan --config ./frappe-semgrep-rules/rules \
+            --config r/python.lang.security \
+            --severity=WARNING csf_tz || true
 
   deps-vulnerable-check:
     name: 'Vulnerable Dependency Check'

.github/workflows/release.yml

@@ -1,8 +1,6 @@
 name: Release
 
 on:
-  push:
-    branches: [version-15]
   workflow_dispatch:
 
 permissions:

.gitignore

@@ -59,3 +59,6 @@ build/
 coverage/
 *.lcov
 .nyc_output
+
+# Semgrep rules cloned by pre-commit / CI
+frappe-semgrep-rules/

.pre-commit-config.yaml

@@ -1,4 +1,4 @@
-exclude: 'node_modules|.git'
+exclude: 'node_modules|.git|frappe-semgrep-rules'
 default_stages: [pre-commit]
 default_install_hook_types: [pre-commit, commit-msg]
 fail_fast: false
@@ -11,6 +11,7 @@ repos:
         files: "csf_tz.*"
         exclude: ".*json$|.*txt$|.*csv|.*md|.*svg"
       - id: end-of-file-fixer
+        exclude: ".*json$"
       - id: check-merge-conflict
       - id: check-ast
       - id: check-json
@@ -19,18 +20,31 @@ repos:
       - id: debug-statements
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.1
+    rev: v0.11.0
     hooks:
       - id: ruff
         name: "Run ruff import sorter"
         args: ["--select=I", "--fix"]
 
       - id: ruff
         name: "Run ruff linter"
+        args: ["--fix"]
 
       - id: ruff-format
         name: "Run ruff formatter"
 
+  - repo: local
+    hooks:
+      - id: frappe-semgrep-rules
+        name: "Frappe Semgrep Security Rules"
+        entry: bash -c 'if [ ! -d frappe-semgrep-rules/.git ]; then rm -rf frappe-semgrep-rules && GIT_TEMPLATE_DIR="" git clone --depth 1 https://github.com/frappe/semgrep-rules.git frappe-semgrep-rules; fi && semgrep scan --config ./frappe-semgrep-rules/rules --config r/python.lang.security --severity=ERROR --error --quiet "$@"' --
+        language: python
+        additional_dependencies: ["semgrep"]
+        types: [python]
+        files: "^csf_tz/.*\\.py$"
+        pass_filenames: true
+        require_serial: true
+
   - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
     rev: v9.22.0
     hooks:
@@ -40,5 +54,5 @@ repos:
 
 ci:
     autoupdate_schedule: weekly
-    skip: []
+    skip: [frappe-semgrep-rules]
     submodules: false

.semgrepignore

@@ -0,0 +1,13 @@
+# Semgrep ignore file. Creating it replaces semgrep's built-in defaults, so they are re-listed.
+.git/
+node_modules/
+__pycache__/
+*.pyc
+*.egg-info/
+dist/
+build/
+frappe-semgrep-rules/
+
+# Test files
+**/test_*.py
+**/tests/

commitlint.config.js

@@ -1,5 +1,4 @@
 module.exports = {
-	parserPreset: "conventional-changelog-conventionalcommits",
 	rules: {
 		"subject-empty": [2, "never"],
 		"type-case": [2, "always", "lower-case"],

csf_tz/__init__.py

@@ -1,7 +1,5 @@
-# -*- coding: utf-8 -*-
-from __future__ import unicode_literals
-import os
 import importlib
+import os
 
 import frappe
 
@@ -12,33 +10,33 @@
 
 
 def load_monkey_patches():
-    """
-    Loads all modules present in monkey_patches to override some logic
-    in Frappe / ERPNext. Returns if patches have already been loaded earlier.
-    """
-    global patches_loaded
+	"""
+	Loads all modules present in monkey_patches to override some logic
+	in Frappe / ERPNext. Returns if patches have already been loaded earlier.
+	"""
+	global patches_loaded
 
-    if patches_loaded:
-        return
+	if patches_loaded:
+		return
 
-    patches_loaded = True
+	patches_loaded = True
 
-    if app_name not in frappe.get_installed_apps():
-        return
+	if app_name not in frappe.get_installed_apps():
+		return
 
-    for module_name in os.listdir(frappe.get_app_path(app_name, "monkey_patches")):
-        if not module_name.endswith(".py") or module_name == "__init__.py":
-            continue
+	for module_name in os.listdir(frappe.get_app_path(app_name, "monkey_patches")):
+		if not module_name.endswith(".py") or module_name == "__init__.py":
+			continue
 
-        importlib.import_module(app_name + ".monkey_patches." + module_name[:-3])
+		importlib.import_module(app_name + ".monkey_patches." + module_name[:-3])
 
 
 old_get_hooks = frappe.get_hooks
 
 
 def get_hooks(*args, **kwargs):
-    load_monkey_patches()
-    return old_get_hooks(*args, **kwargs)
+	load_monkey_patches()
+	return old_get_hooks(*args, **kwargs)
 
 
 frappe.get_hooks = get_hooks
@@ -47,17 +45,17 @@ def get_hooks(*args, **kwargs):
 
 
 def connect(*args, **kwargs):
-    """
-    Patches frappe.connect to load monkey patches once a connection is
-    established with the database.
-    """
+	"""
+	Patches frappe.connect to load monkey patches once a connection is
+	established with the database.
+	"""
 
-    old_connect(*args, **kwargs)
-    load_monkey_patches()
+	old_connect(*args, **kwargs)
+	load_monkey_patches()
 
 
 frappe.connect = connect
 
 
 def console(*data):
-    frappe.publish_realtime("out_to_console", data, user=frappe.session.user)
+	frappe.publish_realtime("out_to_console", data, user=frappe.session.user)