utils.install.lint package¶

Subpackages¶

utils.install.lint.ansible package

Submodules¶

utils.install.lint.actionlint module¶

Install actionlint via GitHub-release prebuilt binary.

utils.install.lint.actionlint.ensure() → None¶

utils.install.lint.eslint module¶

Install ESLint (locally in repo root via npm).

utils.install.lint.eslint.ensure() → None¶

utils.install.lint.hadolint module¶

Install hadolint via GitHub-release prebuilt binary.

utils.install.lint.hadolint.ensure() → None¶

utils.install.lint.markdownlint_cli2 module¶

Install markdownlint-cli2 via npm global.

utils.install.lint.markdownlint_cli2.ensure() → None¶

utils.install.lint.mbake module¶

Install mbake via pip.

utils.install.lint.mbake.ensure() → None¶

utils.install.lint.mermaid_cli module¶

Install @mermaid-js/mermaid-cli (mmdc) and the chrome-headless-shell it renders with.

mmdc comes from npm with PUPPETEER_SKIP_DOWNLOAD set; the browser is provisioned afterwards through the puppeteer that npm installed next to mmdc, at the revision its puppeteer-core pins. unzip is ensured first because puppeteer extracts the browser with it. Puppeteer installs the browser’s shared libraries only through apt-get (--install-deps); on dnf, yum and pacman the libraries ldd reports missing are installed by soname, and a font by the distribution’s font provide, because the browser aborts in its font fallback (SkFontMgr_FontConfigInterface ... Not implemented) on a host without any font. Every failure aborts install-lint.

utils.install.lint.mermaid_cli.browser_cache() → Path¶

utils.install.lint.mermaid_cli.browser_executable() → Path | None¶

utils.install.lint.mermaid_cli.browser_installed() → bool¶

utils.install.lint.mermaid_cli.browser_revision() → str | None¶

utils.install.lint.mermaid_cli.ensure() → None¶

utils.install.lint.mermaid_cli.fonts_installed() → bool¶

utils.install.lint.mermaid_cli.missing_libraries(executable: Path) → list[str]¶

Return the shared libraries the dynamic loader cannot resolve.

Parameters:: executable – the browser binary.
Returns:: Sorted sonames ldd reports as not found.

utils.install.lint.packages module¶

Best-effort install of the distro-packaging lint validators.

scripts/lint/packages.sh validates the generated packaging metadata with each ecosystem’s native parser. This installer provisions those parsers wherever the platform’s package manager can: on Debian (apt) the lint container gets dpkg-parsechangelog (dpkg-dev), rpmspec (rpm) and rpmlint; on Arch (pacman) a dev host gets namcap.

Every install is best-effort and per-command: cross-distro tools are often unavailable, and scripts/lint/packages.sh skips absent ones, so a failed candidate MUST NOT break the lint bootstrap. The validators are intentionally kept out of the install stamp’s required-tool set so a non-Debian environment never loops trying to install a tool it cannot. This group is installed explicitly by the lint-packages make target (an explicit group bypasses the stamp), so the commands are provisioned every run rather than only on the first all-mode install.

utils.install.lint.packages.ensure() → None¶

utils.install.lint.php module¶

Install the PHP CLI via system package manager (parser for lint-php).

Provisioning is best effort: a host without PHP, or one that cannot install it, must not fail the whole gate. scripts/lint/php.sh skips loudly instead.

utils.install.lint.php.ensure() → None¶

utils.install.lint.pinned module¶

Read a lint tool’s pinned release from the sys-lint role.

roles/sys-lint/meta/services.yml is the SPOT for both the repository and the version of every GitHub-release lint tool. Each entry carries the repository / ref pair that utils.update.repository already scans, so the existing update-repository-refs CI job bumps the pins to the latest semver tag and opens a PR – the same machinery that keeps roles/pkgmgr current.

The installers therefore never ask GitHub which version is current: that made every install non-reproducible and turned a DNS hiccup into a hard make install-lint failure.

The pins are parsed by hand instead of through utils.cache.yaml because every lint-* target depends on install-lint, which bootstraps the toolchain on a bare interpreter – PyYAML is not installed yet at that point, and importing it here fails the whole lint stage with ModuleNotFoundError. _parse_pins therefore only understands the two-level shape this one file uses; tests/unit/python/utils/install/lint/test_pinned_versions.py cross-checks it against PyYAML so the two readings cannot drift apart.

utils.install.lint.pinned.pinned_release(tool: str, roles_dir: Path | None = None) → tuple[str, str]¶

The (owner/repo, version) roles/sys-lint pins for tool.

Parameters:

tool – the tool’s service key, e.g. actionlint.
roles_dir – roles tree to read; defaults to the project’s own.

Returns:

the GitHub slug and the version without a leading v.

Raises:

RuntimeError – the services file, the repository or the ref is missing or malformed. Guessing any of them would install a tool nobody chose.

utils.install.lint.pinned.resolve_release(tool: str, roles_dir: Path | None = None) → tuple[str, str]¶

The (owner/repo, version) an installer should fetch for tool.

Parameters:

tool – the tool’s service key, e.g. actionlint.
roles_dir – roles tree to read; defaults to the project’s own.

Returns:

the pinned slug, and the pinned version unless <TOOL>_VERSION in the environment overrides it for a one-off install.

utils.install.lint.playwright module¶

Install @playwright/test (locally in repo root via npm).

utils.install.lint.playwright.ensure() → None¶

utils.install.lint.ruby module¶

Install the Ruby CLI via system package manager (parser for lint-ruby).

Provisioning is best effort: a host without Ruby, or one that cannot install it, must not fail the whole gate. scripts/lint/ruby.sh skips loudly instead.

utils.install.lint.ruby.ensure() → None¶

utils.install.lint.ruff module¶

Install the ruff version pinned in pyproject.toml so every environment matches.

The pin lives in [project.optional-dependencies].dev (one SPOT, Dependabot keeps it current). Host venvs, the lint container and CI all read that same pin, so a rule that is preview-gated in one release and stable in the next (e.g. ISC004, or S310 firing on urllib.request.Request) cannot disagree across environments.

utils.install.lint.ruff.ensure() → None¶: Install the pinned ruff, reinstalling whenever the found version drifts.

utils.install.lint.shellcheck module¶

Install shellcheck via system package manager.

utils.install.lint.shellcheck.ensure() → None¶

utils.install.lint.shfmt module¶

Install shfmt via GitHub-release prebuilt binary.

utils.install.lint.shfmt.ensure() → None¶

utils.install.lint.sqlfluff module¶

Install sqlfluff via pip (parser for lint-sql).

Provisioning is best effort: a host that cannot reach PyPI must not fail the whole gate. scripts/lint/sql.sh skips loudly instead.

utils.install.lint.sqlfluff.ensure() → None¶

utils.install.lint.stylelint module¶

Install stylelint (locally in repo root via npm; parser for lint-css).

Provisioning is best effort: a host that cannot reach the npm registry must not fail the whole gate. scripts/lint/css.sh skips loudly instead.

utils.install.lint.stylelint.ensure() → None¶