Repository navigation
build(mise): add qlty for per-function complexity - #131
Draft
iloveitaly wants to merge 13 commits into
Draft
iloveitaly wants to merge 13 commits into
iloveitaly wants to merge 13 commits into
Conversation
Install the Qlty CLI from GitHub releases so function-level cognitive and cyclomatic scores can be collected during development. Co-authored-by: Michael Bianco <mike@mikebian.co>
Celery's task_prerun and task_postrun receivers have to keep the framework parameter list, and built-in smells cannot be ignored per function. Skip app/celery.py entirely. Co-authored-by: Michael Bianco <mike@mikebian.co>
Keep qlty.toml with the other lint config. The CLI only reads .qlty/qlty.toml, so that path is a symlink. py_lint runs the Python plugins and js_lint runs eslint on web paths. Co-authored-by: Michael Bianco <mike@mikebian.co>
cursor
Bot
force-pushed
the
cursor/add-qlty-dev-3667
branch
from
November 4, 2026 04:31
d74f27d to
7764a2f
Compare
The CLI only reads .qlty/qlty.toml, so drop the lint-folder copy and symlink. Set this tool's minimum_release_age to 0s so latest is not held by the repo-wide 14-day cutoff. Co-authored-by: Michael Bianco <mike@mikebian.co>
Drop the per-tool minimum_release_age override. latest now resolves to 0.659.0, the newest release past the 14-day cutoff. Co-authored-by: Michael Bianco <mike@mikebian.co>
The CLI reads a single qlty.toml, smell thresholds are per language in that file, and the lint recipes filter plugins instead of splitting config. Co-authored-by: Michael Bianco <mike@mikebian.co>
Startup fails when the interpreter is optimized, so assert statements stay in the bytecode. Bandit B101 is skipped for that reason. Co-authored-by: Michael Bianco <mike@mikebian.co>
Ruff, ast-grep, eslint, actionlint, and gitleaks stay in py_lint, js_lint, and dev_lint. Qlty keeps the plugins those recipes do not run. Co-authored-by: Michael Bianco <mike@mikebian.co>
…code The example dict in replace_lines_in_files looked like commented-out Python to python:S125. The type signature already states the shape. Co-authored-by: Michael Bianco <mike@mikebian.co>
Radarlint S1192 flagged the "index.html" literal repeated on the shell and prerender paths. Co-authored-by: Michael Bianco <mike@mikebian.co>
Disable python:S1135 in .qlty/configs/radarlint.properties. Mark the two Stripe client_secret fixtures with nosec B105 so other hardcoded passwords still report. Co-authored-by: Michael Bianco <mike@mikebian.co>
B311, B404, B603, and B607 stay enabled. The two fixture pickers and the just runner are marked nosec. Co-authored-by: Michael Bianco <mike@mikebian.co>
Radarlint S1192 and S107 stay enabled. NOSONAR marks the shared log event and the conversions api parameter list. Co-authored-by: Michael Bianco <mike@mikebian.co>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Per-function cognitive complexity is the signal we want when reviewing whether a function is hard to follow. Qlty reports that score for Python and TypeScript, and its plugin checks should run with the existing lint recipes.
Celery's
task_prerunandtask_postrunreceivers have to keep the framework's parameter list. Built-in smells cannot be ignored per function, soapp/celery.pyis excluded from analysis.Asserts are part of the application.
PYTHONOPTIMIZEandpython -Ostrip them, so startup rejects that mode and Bandit no longer flags assert usage.TODO comments stay in the code. Radarlint
python:S1135is turned off. The two Stripe testclient_secretfixtures are fake values and are ignored only on those lines.The existing fixture random picks and the direnv
justrunner are grandfathered. Bandit still flags newrandomandsubprocessuses.The shared
"fbc resolved"log event andsend_conversion_event's parameter list are grandfathered. Radarlint still flags new duplicated literals and oversized functions.Description
github:qltysh/qltyis in.config/mise.dev.tomlaslatest. It uses the repo-wide 14-day release hold. The lock is 0.659.0 (20 Oct 2026), the newest release past that cutoff.Project config is the standard
.qlty/qlty.toml. The CLI has no config-path flag. Python and JavaScript share that file. Per-language smell thresholds go under[language.<name>.smells].Plugins the existing recipes already run are commented out: ruff and ast-grep (
py_lint), eslint (js_lint), actionlint and gitleaks (dev_lint).py_lintrunsqlty check --filter bandit,radarlint-python. Thejs_lintQlty call is commented out with the eslint plugin.configure_pythonraises ifsys.flags.optimizeis set. Bandit reads.qlty/configs/.banditand skips B101..qlty/configs/radarlint.propertiessetsradarlint.rules.python.S1135=false. Qlty links that file into the working directory when the radarlint-python plugin runs. B105 stays enabled. The twoclient_secretassignments intests/unit/stripe_test.pycarry a same-line# nosec B105.tests/data.pymarks the twochoicefixture picks with# nosec B311.tests/direnv.pymarks thesubprocessimport with# nosec B404and thejustinvocation with# nosec B603, B607. Those rules are not in the global skip list.app/helpers/facebook.pymarks the first"fbc resolved"log line with# NOSONARforpython:S1192, and the*,that openssend_conversion_eventwith# NOSONARforpython:S107. Radarlint only honors that marker on a line inside the issue range. Those rules stay enabled.replace_lines_in_filesin.copier/bootstrap.pyhad a docstring that was a Python dict literal. Radarlintpython:S125treated that as commented-out code. The docstring is now one sentence; the parameter type already states the shape.app/routes/static.pyusesINDEX_HTMLfor the SPA shell and prerender paths. Radarlintpython:S1192flagged the duplicated"index.html"literal.Screenshots / Test
qlty config validatepasses with ruff, ast-grep, eslint, actionlint, and gitleaks commented out.qlty check --filter bandit,radarlint-python app/routes/errors.pyreports nobandit:B101findings.just --dry-runshowspy_lintcalling that filter andjs_lintno longer calling Qlty.qlty check --filter radarlint-python .copier/bootstrap.pyreports no issues.qlty check --filter radarlint-python app/routes/static.pyno longer reportspython:S1192. The three TODO findings on that file are covered by the S1135 disable.tests/routes/static_test.pydid not run here: Redis atredis.workspace.orb.local:6379is unreachable during app import.qlty check --filter bandit,radarlint-python tests/unit/stripe_test.py app/configuration/lang.pyreports no issues. With the properties file moved aside,app/configuration/lang.pystill reportspython:S1135. An unmarkedclient_secretassignment still reportsbandit:B105.qlty check --filter bandit tests/data.py tests/direnv.pyreports no issues. An unmarkedchoice([1])still reportsbandit:B311.qlty check --filter radarlint-python app/helpers/facebook.pyreports no issues. An unmarked 14-parameter function and three"fbc resolved"literals still reportpython:S107andpython:S1192.Links