host
c127beaa98
Phase 1 of audit-hardening CI expansion (baseline origin/main aebc623):
- lint: ruff E9 hard gate; full E,F@120 report-only (baseline 111 items)
- typecheck: mypy default mode, production scope, report-only (baseline 24)
- security: bandit production scope, report-only (baseline 287, High 5)
- depscan: pip-audit on requirements-ci.txt, hard gate (0 vulns; repo has
no production dependency manifest, see summary)
- coverage: production 58 files, fail-under=75 (baseline measured 76%)
- release build: E9 + pip-audit hard gates before packaging; full reports
stay in host-verify to avoid drift
No production code changed; CI billing failure mode unchanged.
13 lines
721 B
INI
13 lines
721 B
INI
# Mypy 配置：默认（非 strict）模式。
|
||
# 代码库基本无类型注解，strict / disallow-untyped-defs 在基线下会
|
||
# 淹没真实错误，故第一阶段只用默认模式 + 缺失第三方导入忽略。
|
||
# ignore_missing_imports：psycopg 等驱动是宿主侧延迟加载，CI 环境
|
||
# 不保证安装，缺导入不应算类型错误。
|
||
# exclude：测试目录与 work/ 不进类型检查。测试大量用动态 mock /
|
||
# 模块遮蔽（如 test_queue_sandbox 的 queue 遮蔽），属于测试脚手架
|
||
# artifact，不是生产类型错误；生产范围另见 workflow 的 mypy 命令。
|
||
[mypy]
|
||
ignore_missing_imports = True
|
||
show_error_codes = True
|
||
exclude = (?x)(^|/)(tests|work)/|test_[^/]*\.py$
|