ruff: fix S rule (#3363)

conftest.py

@@ -27,7 +27,7 @@
 # might depend on these. This approach is compatible with GHA caching.
 try:
     subprocess.check_output(
-        ["./tools/install-reqs.sh"],
+        ["./tools/install-reqs.sh"],  # noqa: S603
         stderr=subprocess.PIPE,
         text=True,
     )

pyproject.toml

@@ -239,7 +239,6 @@ ignore = [
   "PTH",
   "PLR",
   "PLW",
-  "S",
   "SLF",
   "T",
   "TCH",
@@ -256,6 +255,11 @@ parametrize-values-type = "tuple"
 [tool.ruff.isort]
 known-first-party = ["ansiblelint"]
 
+[tool.ruff.per-file-ignores]
+"test/**/*.py" = ["S"]
+"src/ansiblelint/rules/*.py" = ["S"]
+"src/ansiblelint/testing/*.py" = ["S"]
+
 [tool.setuptools.dynamic]
 optional-dependencies.docs = { file = [".config/requirements-docs.txt"] }
 optional-dependencies.test = { file = [".config/requirements-test.txt"] }

src/ansiblelint/__main__.py

@@ -291,7 +291,7 @@ def _previous_revision() -> Iterator[None]:
     rel_exclude_paths = [normpath(p) for p in options.exclude_paths]
     options.exclude_paths = [abspath(p, worktree_dir) for p in rel_exclude_paths]
     revision = subprocess.run(
-        [*GIT_CMD, "rev-parse", "HEAD^1"],
+        [*GIT_CMD, "rev-parse", "HEAD^1"],  # noqa: S603
         check=True,
         text=True,
         stdout=subprocess.PIPE,
@@ -305,14 +305,14 @@ def _previous_revision() -> Iterator[None]:
     # Run check will fail if worktree_dir already exists
     # pylint: disable=subprocess-run-check
     subprocess.run(
-        [*GIT_CMD, "worktree", "add", "-f", worktree_dir],
+        [*GIT_CMD, "worktree", "add", "-f", worktree_dir],  # noqa: S603
         stdout=subprocess.DEVNULL,
         stderr=subprocess.DEVNULL,
     )
     try:
         with cwd(worktree_dir):
             subprocess.run(
-                [*GIT_CMD, "checkout", revision],
+                [*GIT_CMD, "checkout", revision],  # noqa: S603
                 stdout=subprocess.DEVNULL,
                 stderr=subprocess.DEVNULL,
                 check=True,

src/ansiblelint/config.py

@@ -263,7 +263,7 @@ def get_version_warning() -> str:
             "https://api.github.com/repos/ansible/ansible-lint/releases/latest"
         )
         try:
-            with urllib.request.urlopen(release_url) as url:
+            with urllib.request.urlopen(release_url) as url:  # noqa: S310
                 data = json.load(url)
                 with open(cache_file, "w", encoding="utf-8") as f:
                     json.dump(data, f)

src/ansiblelint/file_utils.py

@@ -422,7 +422,7 @@ def discover_lintables(options: Options) -> dict[str, Any]:
 
     try:
         out_present = subprocess.check_output(
-            git_command_present,
+            git_command_present,  # noqa: S603
             stderr=subprocess.STDOUT,
             text=True,
         ).split("\x00")[:-1]
@@ -432,7 +432,7 @@ def discover_lintables(options: Options) -> dict[str, Any]:
         )
 
         out_absent = subprocess.check_output(
-            git_command_absent,
+            git_command_absent,  # noqa: S603
             stderr=subprocess.STDOUT,
             text=True,
         ).split("\x00")[:-1]

src/ansiblelint/schemas/__main__.py

@@ -73,7 +73,7 @@ def refresh_schemas(min_age_seconds: int = 3600 * 24) -> int:  # noqa: C901
         if etag:
             request.add_header("If-None-Match", f'"{data.get("etag")}"')
         try:
-            with urllib.request.urlopen(request, timeout=10) as response:
+            with urllib.request.urlopen(request, timeout=10) as response:  # noqa: S310
                 if response.status == 200:
                     content = response.read().decode("utf-8").rstrip()
                     etag = response.headers["etag"].strip('"')

src/ansiblelint/utils.py

@@ -73,7 +73,7 @@
 # ansible-lint doesn't need/want to know about encrypted secrets, so we pass a
 # string as the password to enable such yaml files to be opened and parsed
 # successfully.
-DEFAULT_VAULT_PASSWORD = "x"
+DEFAULT_VAULT_PASSWORD = "x"  # noqa: S105
 COLLECTION_PLAY_RE = re.compile(r"^[\w\d_]+\.[\w\d_]+\.[\w\d_]+$")
 
 PLAYBOOK_DIR = os.environ.get("ANSIBLE_PLAYBOOK_DIR", None)

src/ansiblelint/yaml_utils.py

@@ -239,7 +239,9 @@ def get_path_to_play(
             next_play_line_index = None
 
         lc = play.lc  # pylint: disable=invalid-name
-        assert isinstance(lc.line, int)
+        if not isinstance(lc.line, int):
+            msg = f"expected lc.line to be an int, got {lc.line!r}"
+            raise RuntimeError(msg)
         if lc.line == line_index:
             return [play_index]
         if play_index > 0 and prev_play_line_index < line_index < lc.line:
@@ -266,13 +268,14 @@ def get_path_to_task(
     if lineno < 1:
         msg = f"expected lineno >= 1, got {lineno}"
         raise ValueError(msg)
-    if lintable.kind in ("tasks", "handlers"):
-        assert isinstance(ruamel_data, CommentedSeq)
-        return _get_path_to_task_in_tasks_block(lineno, ruamel_data)
-    if lintable.kind == "playbook":
-        assert isinstance(ruamel_data, CommentedSeq)
-        return _get_path_to_task_in_playbook(lineno, ruamel_data)
-    # if lintable.kind in ["yaml", "requirements", "vars", "meta", "reno", "test-meta"]:
+    if lintable.kind in ("tasks", "handlers", "playbook"):
+        if not isinstance(ruamel_data, CommentedSeq):
+            msg = f"expected ruamel_data to be a CommentedSeq, got {ruamel_data!r}"
+            raise ValueError(msg)
+        if lintable.kind in ("tasks", "handlers"):
+            return _get_path_to_task_in_tasks_block(lineno, ruamel_data)
+        if lintable.kind == "playbook":
+            return _get_path_to_task_in_playbook(lineno, ruamel_data)
 
     return []
 
@@ -327,7 +330,7 @@ def _get_path_to_task_in_playbook(
     return []
 
 
-def _get_path_to_task_in_tasks_block(
+def _get_path_to_task_in_tasks_block(  # noqa: C901
     lineno: int,  # 1-based
     tasks_block: CommentedSeq,
     last_lineno: int | None = None,  # 1-based
@@ -369,7 +372,9 @@ def _get_path_to_task_in_tasks_block(
                 task_path: list[str | int] = [task_index]
                 return task_path + list(subtask_path)
 
-        assert isinstance(task.lc.line, int)
+        if not isinstance(task.lc.line, int):
+            msg = f"expected task.lc.line to be an int, got {task.lc.line!r}"
+            raise RuntimeError(msg)
         if task.lc.line == line_index:
             return [task_index]
         if task_index > 0 and prev_task_line_index < line_index < task.lc.line: