From 5be1d275ca3772301885bf330baad5a69cca24a5 Mon Sep 17 00:00:00 2001
From: Jonas Bardino <bardino@science.ku.dk>
Date: Tue, 21 Apr 2026 16:34:28 +0200
Subject: [PATCH 1/2] Add pylint and ruff linter in the make lint-python target
 and point make lint to the renamed style-check-python and lint-python
 targets.

---
 Makefile               | 10 ++++++++--
 local-requirements.txt |  2 ++
 pyproject.toml         | 31 +++++++++++++++++++++++++++++++
 3 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 10f780d45..a0668d8b0 100644
--- a/Makefile
+++ b/Makefile
@@ -52,14 +52,20 @@ ifneq ($(MIG_ENV),'local')
 	@echo "unavailable outside local development environment"
 	@exit 1
 endif
+	@make style-check-python
 	@make lint-python
 
 # NOTE: black and isort use pyproject.toml to temporarily exclude a few paths
-.PHONY: lint-python
-lint-python:
+.PHONY: style-check-python
+style-check-python:
 	@$(LOCAL_PYTHON_BIN) -m black $(LINT_ENFORCE_DIRS) --check
 	@$(LOCAL_PYTHON_BIN) -m isort $(LINT_ENFORCE_DIRS) --check-only
 
+.PHONY: lint-python
+lint-python:
+	@$(LOCAL_PYTHON_BIN) -m pylint $(LINT_ENFORCE_DIRS) --errors-only
+	@$(LOCAL_PYTHON_BIN) -m ruff check $(LINT_ENFORCE_DIRS)
+
 .PHONY: clean
 clean:
 	@rm -f ./envhelp/py3.imageid
diff --git a/local-requirements.txt b/local-requirements.txt
index bb47a7c80..109de84da 100644
--- a/local-requirements.txt
+++ b/local-requirements.txt
@@ -5,6 +5,8 @@
 autopep8;python_version >= "3"
 black
 isort
+pylint
+ruff
 # We need paramiko for the ssh unit tests
 # NOTE: paramiko-3.0.0 dropped python2 and python3.6 support
 paramiko;python_version >= "3.7"
diff --git a/pyproject.toml b/pyproject.toml
index aea2e4b57..87608c0cd 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -34,3 +34,34 @@ skip = [
     "sbin/grid_sftp.py",
     "sbin/grid_webdavs.py"
 ]
+
+[tool.pylint]
+max-line-length = 80
+ignore-pattern = '''
+      tests/data/
+    | tests/fixture/
+'''
+# NOTE: the following paths must be kept in sync with black extend-exclude
+ignore-paths = [
+    "bin/checkconf.py",
+    "bin/createresource.py",
+    "bin/notifypassword.py",
+    "sbin/grid_ftps.py",
+    "sbin/grid_openid.py",
+    "sbin/grid_sftp.py",
+    "sbin/grid_webdavs.py"
+]
+
+[tool.ruff]
+line-length = 80
+exclude = [".git/", "tests/data/", "tests/fixture/"]
+# NOTE: the following regex matches must be kept in sync with isort skip
+extend-exclude = [
+    "bin/checkconf.py",
+    "bin/createresource.py",
+    "bin/notifypassword.py",
+    "sbin/grid_ftps.py",
+    "sbin/grid_openid.py",
+    "sbin/grid_sftp.py",
+    "sbin/grid_webdavs.py"
+]

From b3522a94129165e2ff949e7419a0a3b2da9c5e03 Mon Sep 17 00:00:00 2001
From: Jonas Bardino <bardino@science.ku.dk>
Date: Tue, 21 Apr 2026 16:46:24 +0200
Subject: [PATCH 2/2] Comment only changes to clarify the state of the
 temporary named excludes in linting targets and their eventual removal once
 we have addressed the code scan issues they currently trigger.

---
 Makefile       |  1 +
 pyproject.toml | 11 ++++++-----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/Makefile b/Makefile
index a0668d8b0..b5691320e 100644
--- a/Makefile
+++ b/Makefile
@@ -61,6 +61,7 @@ style-check-python:
 	@$(LOCAL_PYTHON_BIN) -m black $(LINT_ENFORCE_DIRS) --check
 	@$(LOCAL_PYTHON_BIN) -m isort $(LINT_ENFORCE_DIRS) --check-only
 
+# NOTE: pylint and ruff use pyproject.toml to temporarily exclude a few paths
 .PHONY: lint-python
 lint-python:
 	@$(LOCAL_PYTHON_BIN) -m pylint $(LINT_ENFORCE_DIRS) --errors-only
diff --git a/pyproject.toml b/pyproject.toml
index 87608c0cd..e0cc2c57c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,7 +1,8 @@
 # Project wide settings including tooling.
 
 # Linting tools
-# TODO: fix CodeQL errors in symlinked files and disable extend-exclude+skip
+
+# TODO: fix CodeQL errors and disable temporary named files with NOTEs below
 
 [tool.black]
 line-length = 80
@@ -9,7 +10,7 @@ exclude = '''
       tests/data/
     | tests/fixture/
 '''
-# NOTE: the following regex matches must be kept in sync with isort skip
+# NOTE: the following temporay excludes must be kept in sync between tools
 extend-exclude = '''
       bin/checkconf.py
     | bin/createresource.py
@@ -24,7 +25,7 @@ extend-exclude = '''
 profile = "black"
 line_length = 80
 skip_glob = [".git/*", "tests/data/*", "tests/fixture/*"]
-# NOTE: the following paths must be kept in sync with black extend-exclude
+# NOTE: the following temporay excludes must be kept in sync between tools
 skip = [
     "bin/checkconf.py",
     "bin/createresource.py",
@@ -41,7 +42,7 @@ ignore-pattern = '''
       tests/data/
     | tests/fixture/
 '''
-# NOTE: the following paths must be kept in sync with black extend-exclude
+# NOTE: the following temporay excludes must be kept in sync between tools
 ignore-paths = [
     "bin/checkconf.py",
     "bin/createresource.py",
@@ -55,7 +56,7 @@ ignore-paths = [
 [tool.ruff]
 line-length = 80
 exclude = [".git/", "tests/data/", "tests/fixture/"]
-# NOTE: the following regex matches must be kept in sync with isort skip
+# NOTE: the following temporay excludes must be kept in sync between tools
 extend-exclude = [
     "bin/checkconf.py",
     "bin/createresource.py",