mirror of
https://github.com/wiltodelta/remove-ai-watermarks.git
synced 2026-08-06 22:18:36 +02:00
30 lines
1.5 KiB
Bash
Executable File
30 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
uv sync --all-extras
|
|
# uv-outdated / uv-secure run via uvx (isolated env), NOT `uv run`: resolving them
|
|
# inside the project env crashes and, with set -e, aborts the whole gate before
|
|
# ruff/pyright/tests (see CLAUDE.md "Test and lint").
|
|
uvx uv-outdated
|
|
# uv-secure prints its verdict but can then crash in an internal teardown with a
|
|
# NON-ZERO exit -- observed as "annotated-doc raised exception" and later "anyio raised
|
|
# exception"; both are bugs in uv-secure's OWN uvx env, not a project vulnerability. With
|
|
# set -e that teardown crash aborts the whole gate before ruff/pyright/tests. So gate on
|
|
# the VERDICT, not the exit code: capture the output, accept the run when uv-secure
|
|
# reported all-safe (even if it then crashed), but still FAIL on a real finding (no
|
|
# all-safe line) so a genuine CVE is never masked, and fail loud if it never got a
|
|
# verdict at all (so a broken run is never silently skipped).
|
|
secure_out="$(uvx uv-secure uv.lock 2>&1)" || true
|
|
printf '%s\n' "$secure_out"
|
|
if ! grep -qE "No vulnerabilities or maintenance issues detected|All dependencies appear safe" <<<"$secure_out"; then
|
|
echo "maintain.sh: uv-secure reported a finding or failed before its verdict -- triage before committing." >&2
|
|
exit 1
|
|
fi
|
|
uv run ruff check --fix
|
|
uv run ruff format
|
|
# Scoped to src/: a full-project pyright run OOM-crashes node on this ML-heavy
|
|
# repo (see CLAUDE.md "Test and lint"); src/ is the authoritative strict gate.
|
|
uv run pyright src/
|
|
uv run pytest -n auto
|