feat/more-ruff (#5559)

Co-authored-by: Darragh Elliott <me@delliott.net>
Reviewed-on: #5559
Co-authored-by: delliott <delliott@fsfe.org>
Co-committed-by: delliott <delliott@fsfe.org>

build/fsfe_website_build/lib/misc.py

@@ -87,7 +87,8 @@ def run_command(commands: list[str]) -> str:
     and command error handling across the project.
     """
     try:
-        result = subprocess.run(
+        result = subprocess.run(  # noqa: S603 allow callsing subprocess without knowing the args
+            # we validate that they are okay elsewhere in the code
             commands,
             capture_output=True,
             # Get output as str instead of bytes

fsfe.org/internal/subdir.py

@@ -35,7 +35,7 @@ def run(source: Path, languages: list[str], processes: int, working_dir: Path) -
         return
 
     url = raw_url._replace(query=f"token={git_token}").geturl()
-    r = requests.get(url)
+    r = requests.get(url, timeout=10)
 
     if not r.ok:
         message = "Failed to retrieve activities file"

pyproject.toml

@@ -64,6 +64,7 @@ select = [
   "RSE",   # Unneeded exception parentheses
   "RUF",   # the ruff developer's own rules
   "SIM",   # Simplify
+  "S",     # flake8-bandit, more secutiry checks
   "T20",   # Warn about prints
   "TC",    # Type checking
   "TRY",   # Error handling stuff
@@ -78,6 +79,7 @@ ignore = [
 "build/fsfe_website_build_tests*/*" = [
   "D",      # We do not need to document the tests.
   "TRY003", # Dont worry about big exceptions in tests
+  "S101",   # Allow asserts in tests
 ]
 [tool.pyright]
 typeCheckingMode = "strict"