Enforce ruff lint / format in CI + pre-commit, clear the baseline, fix CodeQL findings

[lelia]

Ruff already ran in CI, but as a job inside the Unit Tests workflow, so it inherited that workflow's paths: filter and never saw .hooks/, benchmarks/ or tests/e2e/. This moves it to its own unconditional Lint workflow, adds a pre-commit hook, bounds function complexity, and clears every resulting violation so the baseline is clean rather than suppressed.

Enforcement

• Lint workflow, unconditional on every PR. Not path-filtered: a filtered workflow reports "not run" rather than "passed", which blocks any PR that doesn't touch the filtered paths once it is a required check.
• Pre-commit hook running ruff from the project environment rather than the astral-sh/ruff-pre-commit mirror. Dependabot has no pre-commit ecosystem, so a mirror would drift from the pinned ruff==0.16.5 and fail in the worst way — clean locally, red on the PR.
• make lint mirrors CI exactly.
• Complexity bounded at C901 12 and PLR0913 8. The 18 functions currently over the limit carry an explicit # noqa rather than a blanket per-file ignore, and RUF100 fails the build once a suppression goes stale, so the backlog can only shrink.

Behavior changes

These are fixes, not style:

• Package.created_at truncated timestamps. str.strip(" (Coordinated Universal Time)") treats its argument as a set of characters rather than a suffix, so a timestamp beginning Tue lost its leading T. Now uses removesuffix.
• Notifications could hang a pipeline indefinitely. Slack, Teams, Jira, generic webhook and GitLab commit-status requests were sent with no timeout, and requests blocks forever by default. All now use an explicit 30s timeout.
• Manifest links used the wrong host for some organizations. The source-control type was partly inferred by searching the Socket report URL for "github", "gitlab" or "bitbucket". That URL is always a Socket dashboard link, so the only part that could match was the org slug — an org whose slug contained one of those words got manifest links pointing at a repository host it may not use. The type now comes from --scm alone. get_manifest_file_url had no test coverage; it does now, including regression guards for the org-slug cases.
• Two guards did nothing under python -O, which strips assert. One is now an explicit check that raises; the other was redundant and removed.
• A debug message was written to stdout, which also carries machine-readable output such as SARIF. Now logged at debug.
• config.py logged through the root logger, so its warnings ignored the CLI's configured level and format.

Log redaction

Adds socketsecurity/redaction.py and routes debug logging through it, so configuration values and integration URLs are masked in log output rather than written verbatim.

Masking is by field-name pattern, so fields added later are covered by default — a test asserts that by iterating CliConfig's fields. to_dict() is unchanged and still returns real values; to_redacted_dict() is the logging view, because a serialiser that silently dropped values would be its own bug.

Prompted by a CodeQL alert on output.py, which is a false positive on the reported call (it selects named fields).

Open decision: 6 × actions/cache-poisoning

Not fixed, because there is nothing to fix — no actions/cache step and no cache: input exists anywhere in this repository, so there is no cache to poison. The hazard is real but latent, and I've documented the invariant that keeps it safe in pr-preview.yml at the point someone would violate it. Dismissing these six is a security-posture call, so I left it to you; I'd dismiss as "won't fix / no cache in use".

Rule decisions

TRY400/TRY401, E501, W291/W293, N815/N818, SIM108, PERF401, S603 and S607 sit in ignore with a one-line reason each in pyproject.toml rather than being merely unselected, so the decision survives a future family-wide selection instead of silently reverting.

Two are worth calling out because they are not preference:

• W291/W293 — the trailing double-spaces in the PR-comment markup are Markdown hard line breaks. Stripping them collapses the ❗️ Caution banner into the body text. Whitespace inside a string is content.
• N815/N818 — those names are bound directly to Socket API JSON keys on both read and write, and the exception names are part of the public import surface. Renaming either is a breaking change to a documented contract, not a rename. Happy to do it as its own PR with deprecation aliases if you want the convention.

Formatting, and the move to 2.8.1

ruff format is enforced from this PR onward. The formatting pass shares a commit with the lint fixes because they touch the same lines and cannot be cleanly separated after the fact, so .git-blame-ignore-revs is added with instructions but no SHA — blame-ignoring this commit would also hide the real fixes above.

main shipped 2.8.0 (#325, #331) while this branch was open, so the release is now 2.8.1. Conflicts were resolved keeping main's shipped behaviour together with this branch's formatting and fixes — #331's Slack middle → medium normalization, #325's scan diagnostics, and the sys.exit → raise that routes API failures to the configured infrastructure exit code.

ruff check and ruff format --check are both clean. 584 passed, 2 skipped.

Ref: CE-451

---

Note

Medium Risk
Touches CI required checks, broad lint/format churn, and several CLI/runtime paths (HTTP notifications, config exit/logging, package timestamps) that affect customer pipelines.

Overview
Release 2.7.2 ships alongside a full Ruff enforcement story: linting moves out of the path-filtered Unit Tests workflow into a dedicated, unconditional Lint workflow (ruff check + ruff format --check), with matching pre-commit hooks and make lint / make hooks targets. pyproject.toml expands the rule set (bugbear, bandit, complexity C901/PLR0913, RUF100, etc.), documents intentional ignores, and clears the baseline across the repo.

Runtime fixes (not just style): Package.created_at now uses removesuffix instead of strip so timestamps are not mangled; outbound Slack/Teams/Jira/webhook/GitLab calls get a 30s requests timeout so CI cannot hang forever; config.py logs via the socketcli logger and sys.exit; duplicate SBOM packages log at debug instead of stdout; and guards that relied on assert are replaced or removed so python -O still behaves correctly.

Docs (CONTRIBUTING.md, CHANGELOG.md) and .git-blame-ignore-revs (placeholder for future format-only SHAs) support the new workflow.

^{Reviewed by Cursor Bugbot for commit ea36905. Configure here.}