Static-analysis review: prioritized findings report - #14
Conversation
Add a thin flake.nix orchestrator that delegates to a modular nix/ tree: flake-utils + a plain mkShell, one file per concern, and a single nix/versions.nix as the source of truth for tool versions. Provides: - nix develop: Python 3.12 dev shell with cmax on PATH (a shell function shadows it interactively to run the working tree) plus ruff, mypy, bandit, shellcheck, and helper commands (cmax-test, cmax-lint, ...). - nix build .#cmax: buildPythonApplication of the cmax CLI, with an install check for `cmax --version` and the bundled cmax.yaml / run.sh resources. - nix build .#oci-cmax: native per-system OCI image (amd64 + aarch64) via dockerTools.buildLayeredImage. - Report-only static analysis: analysis-ruff, -ruff-format, -mypy, -bandit, -shellcheck, and a combined `analysis` summary. These never gate. - nix flake check: sandbox-safe gates only (package build + nixfmt). - nix run .#test: pytest in the host environment (the suite's command stubs hard-code /bin/bash and /bin/cat, absent in the hermetic sandbox). pyproject.toml gains [tool.ruff], [tool.mypy], and [tool.bandit] config so the analysers run the same way inside and outside Nix. Docs: nix/README.md plus a "Develop with Nix" quickstart in README.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TiU7ttVHcNojp2T1TEutgX
Run the flake's report-only analysers (ruff 0.16.4, mypy 2.1.0, bandit 1.9.4, shellcheck 0.11.0) over the codebase and triage the results. - STATIC_ANALYSIS.md: findings grouped by priority (P1 security -> P2 correctness -> P3 maintainability -> P4 style, plus shell), with counts, representative file:line examples, and a recommended fix order. Notably: 3 bandit findings to act on (2 XML parsing + 1 urlopen scheme); the ~28 subprocess findings and 5 hardcoded-password false positives are documented as accepted; 9 ruff bug-class + 75 mypy type findings for correctness; 157 E501 + 11-file ruff-format diff as mechanical style work. - reports/static-analysis/: the verbatim tool outputs for reference. - .gitattributes: exempt the captured reports from whitespace checks. No code under cmax/ is changed; this is a review, not a fix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TiU7ttVHcNojp2T1TEutgX
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit d946ce2. Configure here.
| cmax-fmt-check() { ruff format --check cmax ; } | ||
| cmax-types() { mypy cmax ; } | ||
| cmax-sec() { bandit -r cmax ; } | ||
| cmax-shellcheck() { find cmax/scripts -name '*.sh' -print0 | xargs -0 shellcheck ; } |
There was a problem hiding this comment.
Devshell shellcheck drops source following
Medium Severity
cmax-shellcheck runs shellcheck without -x (and without the sorted find used by .#analysis-shellcheck). The flake and README say the shell helpers invoke the same commands as the report targets so results cannot drift.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit d946ce2. Configure here.
| pkgs.bashInteractive | ||
| pkgs.coreutils | ||
| pkgs.dockerTools.caCertificates | ||
| ]; |
There was a problem hiding this comment.
OCI image omitted python3 binary
Medium Severity
The image comment and nix/README.md say audit scripts call python3, but contents only add cmax, bash, coreutils, and CA certs. cmax audit spawns those scripts with the container PATH, which has no python3, so Python checks are skipped as unavailable.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit d946ce2. Configure here.
2 participants
Summary
First pass over the
cmaxcodebase with the flake's report-only analysers (from #13). Runs every analyser, commits the raw outputs, and adds one prioritized document so a maintainer can act on the signal and skip the noise.No code under
cmax/is changed — this is a review, not a fix.STATIC_ANALYSIS.md— findings grouped by priority, with counts, representativefile:lineexamples, and a recommended fix order.reports/static-analysis/— the verbatim tool outputs (ruff, ruff-format, mypy, bandit, shellcheck, summary)..gitattributes— exempts the captured reports from whitespace checks (they are kept exactly as produced).Generated by
nix build .#analysis. Tool versions (pinned by the flake): ruff 0.16.4, mypy 2.1.0, bandit 1.9.4, shellcheck 0.11.0.Findings at a glance
xml.etreeparses (usedefusedxml) + oneurlopenscheme check. The ~28 subprocess findings and 5 hardcoded-password hits are false positives / by design (documented).zipwithoutstrict=, a loop-variable closure); the rest are maintainability (58) and line-length (157).Nonehandling ondict/Anyaccess.ruff format).SC2034unused-variable are mostly noise.Priority order
P1 security → P2 correctness → P3 maintainability → P4 style, plus a shell section. The document gives the counts, examples, a suggested sequence of work, and a "Reproduce & fix" footer.
🤖 Generated with Claude Code
Note
Low Risk
Documentation and tooling only—no changes to
cmax/runtime logic. Risk is limited to new build/docs surface area and committed analyzer snapshots, not altered audit or security behavior.Overview
Adds a first-pass static-analysis review of
cmaxwith no application code fixes:STATIC_ANALYSIS.mdtriages bandit, ruff, mypy, ruff-format, and shellcheck output into P1–P4 priorities (3 actionable security items, 9 ruff bug-class hits, 75 mypy errors, plus style/shell noise), andreports/static-analysis/stores the verbatim tool runs plussummary.txt..gitattributesmarks those report files as-whitespaceso preserved column alignment survives git checks.pyproject.tomlgains shared[tool.ruff],[tool.mypy], and[tool.bandit]settings aligned with the flake’s report-onlynix build .#analysistargets.The diff also includes the Nix flake stack (depends on #13): dev shell,
cmaxpackage, OCI image, and report-only analysers;README.mddocuments the Nix quickstart. After #13 lands, the review-only slice is the triage doc, captured reports, gitattributes, and pyproject analyzer config.Reviewed by Cursor Bugbot for commit d946ce2. Bugbot is set up for automated code reviews on this repo. Configure here.