# Ruff configuration for Nexus
# Docs: https://docs.astral.sh/ruff/
#
# 策略：只拦真正的BUG和安全问题，不强制代码风格升级
# 存量代码不改，新增代码必须通过

target-version = "py310"
line-length = 120

[lint]
# 核心：只选真正影响正确性和安全的规则
select = [
    "F",    # pyflakes — 未定义名称、未使用导入（真正的BUG）
    "S",    # flake8-bandit — 安全问题
    "B",    # flake8-bugbear — 常见BUG模式
]

# 不选的规则（留给以后渐进式启用）：
# "E"    — pycodestyle 风格（缩进、空格等，不影响正确性）
# "UP"   — pyupgrade（Optional→X|None 等，风格升级，存量太多）
# "I"    — isort（导入排序，风格问题）
# "W"    — pycodestyle warnings（风格）

ignore = [
    "S101",   # assert used (fine in tests)
    "S104",   # hardcoded bind all interfaces (0.0.0.0 is intentional)
    "S108",   # /tmp usage
    "S603",   # subprocess call (we validate inputs with shlex.quote)
    "S607",   # subprocess with partial path
    "S311",   # random module (not crypto)
    "B008",   # function call in default argument (FastAPI Depends pattern)
    "B905",   # zip without strict (Python 3.10+)
    "B006",   # mutable default args (FastAPI pattern)
]

[lint.per-file-ignores]
"tests/*.py" = ["S101", "S106"]  # assert + hardcoded password in tests

[format]
quote-style = "double"
indent-style = "space"