Maintainability upgrades and fixes

.devcontainer/Dockerfile

@@ -6,4 +6,4 @@ USER root
 RUN apt-get update && export DEBIAN_FRONTEND=noninteractive && \
     apt-get -yq --no-install-recommends install gcc curl libsasl2-dev libldap2-dev libssl-dev python3-dev
 
-USER codespace
+USER codespace

.devcontainer/devcontainer.json

@@ -55,4 +55,4 @@
     "yarn install && `yarn bin gulp production`;",
     "/home/codespace/.local/bin/flask db upgrade;"
   ]
-}
+}

.devcontainer/docker-compose.yaml

@@ -38,4 +38,4 @@ services:
     # (Adding the "ports" property to this file will not forward from a Codespace.)
 
 volumes:
-  postgres-data:
+  postgres-data:

.dockerignore

@@ -1 +1,10 @@
 node_modules/
+.github/
+.mypy_cache/
+.pytest_cache/
+__pycache__/
+*.pyc
+.venv/
+.scannerwork/
+.ruff_cache/
+.devcontainer/

.github/workflows/format-app.yml

@@ -0,0 +1,33 @@
+name: Format App
+
+on:
+    push:
+        branches: [master, develop]
+
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.9'
+
+      - name: Install ruff
+        run: pip install ruff
+
+      - name: Run ruff format
+        run: ruff format packet
+
+      - name: Commit and push changes
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git add .
+          git diff --cached --quiet || git commit -m "Auto-format code with ruff"
+          git push

.github/workflows/python-app.yml

@@ -27,11 +27,11 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-      - name: Lint with pylint
+          python -m pip install uv
+          if [ -f requirements.txt ]; then uv pip install -r requirements.txt --system; fi
+      - name: Lint with ruff and pylint
         run: |
-          pylint packet/routes packet
+          ruff check packet && pylint packet/routes packet
 
   typecheck:
     runs-on: ubuntu-latest
@@ -50,8 +50,8 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          python -m pip install uv
+          if [ -f requirements.txt ]; then uv pip install -r requirements.txt --system; fi
       - name: Typecheck with mypy
         run: |
           # Disabled error codes to discard errors from imports

.github/workflows/sonar.yml

@@ -0,0 +1,30 @@
+name: Push to sonarqube
+
+on:
+  push:
+    branches:
+      - '*'
+  pull_request:
+    branches:
+      - '*'
+
+
+jobs:
+  build:
+    name: Build and analyze
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - uses: SonarSource/sonarqube-scan-action@v6
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+      # If you wish to fail your job when the Quality Gate is red, uncomment the
+      # following lines. This would typically be used to fail a deployment.
+      # - uses: SonarSource/sonarqube-quality-gate-action@v1
+      #   timeout-minutes: 5
+      #   env:
+      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.gitignore

@@ -106,6 +106,9 @@ ENV/
 # vscode
 .vscode
 
+# SonarQube
+.scannerwork
+
 # Configurations
 config.py
 
@@ -132,4 +135,4 @@ packet/static/site.webmanifest
 faviconData.json
 
 # csvs
-*.csv
+*.csv

.pylintrc

@@ -95,4 +95,4 @@ min-public-methods = 2
 max-public-methods = 20
 
 [EXCEPTIONS]
-overgeneral-exceptions = Exception
+overgeneral-exceptions = builtins.Exception

Dockerfile

@@ -3,7 +3,7 @@ FROM docker.io/python:3.9-slim-trixie
 RUN ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime
 RUN apt-get -yq update && \
     apt-get -yq --no-install-recommends install gcc curl libsasl2-dev libldap2-dev libssl-dev gnupg2 git && \
-    apt-get -yq clean all \
+    apt-get -yq clean all && \
     curl -sL https://deb.nodesource.com/setup_20.x | bash - && \
     curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor -o /usr/share/keyrings/yarn-archive-keyring.gpg && \
     echo "deb [signed-by=/usr/share/keyrings/yarn-archive-keyring.gpg] https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list && \
@@ -14,7 +14,7 @@ RUN mkdir /opt/packet
 WORKDIR /opt/packet
 
 COPY requirements.txt /opt/packet/
-RUN pip install -r requirements.txt
+RUN pip install uv && uv pip install -r requirements.txt --system
 
 COPY package.json /opt/packet/
 COPY yarn.lock /opt/packet/
@@ -32,4 +32,9 @@ RUN gulp production && \
 # Set version for apm
 RUN echo "export DD_VERSION=\"$(python3 packet/git.py)\"" >> /tmp/version
 
+RUN groupadd -r packet && useradd --no-log-init -r -g packet packet && \
+    chown -R packet:packet /opt/packet
+
+USER packet
+
 CMD ["/bin/bash", "-c", "source /tmp/version && ddtrace-run gunicorn packet:app --bind=0.0.0.0:8080 --access-logfile=- --timeout=600"]

Dockerfile.dev

@@ -3,7 +3,7 @@ FROM docker.io/python:3.9-slim-trixie
 RUN ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime
 RUN apt-get -yq update && \
     apt-get -yq --no-install-recommends install gcc curl libsasl2-dev libldap2-dev libssl-dev gnupg2 git && \
-    apt-get -yq clean all \
+    apt-get -yq clean all && \
     curl -sL https://deb.nodesource.com/setup_20.x | bash - && \
     curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor -o /usr/share/keyrings/yarn-archive-keyring.gpg && \
     echo "deb [signed-by=/usr/share/keyrings/yarn-archive-keyring.gpg] https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list && \
@@ -14,7 +14,7 @@ RUN mkdir /opt/packet
 WORKDIR /opt/packet
 
 COPY requirements.txt /opt/packet/
-RUN pip install -r requirements.txt
+RUN pip install uv && uv pip install -r requirements.txt --system
 
 COPY package.json /opt/packet/
 COPY yarn.lock /opt/packet/
@@ -29,6 +29,11 @@ RUN gulp production && \
     apt-get -yq autoremove && \
     apt-get -yq clean all
 
+RUN groupadd -r packet && useradd --no-log-init -r -g packet packet && \
+    chown -R packet:packet /opt/packet
+
+USER packet
+
 EXPOSE 8000
 
 CMD ["/bin/bash", "-c", "python3 wsgi.py"]

README.md

@@ -1,6 +1,6 @@
 # CSH Web Packet
 
-[![Python 3.9](https://img.shields.io/badge/python-3.9-blue.svg)](https://www.python.org/downloads/release/python-390/)
+[![Python3.9](https://img.shields.io/badge/python-3.9-blue.svg)](https://www.python.org/downloads/release/python39/)
 [![Build Status](https://travis-ci.com/ComputerScienceHouse/packet.svg?branch=develop)](https://travis-ci.com/ComputerScienceHouse/packet)
 
 Packet is used by CSH to facilitate the freshmen packet portion of our introductory member evaluation process. This is 
@@ -58,7 +58,7 @@ reliable method.
 
 Use `pip3 install -r requirements.txt` to install the required python dependencies. A 
 [venv](https://packaging.python.org/tutorials/installing-packages/#creating-virtual-environments) is *highly* 
-recommended. To add new dependencies, add them to `requirements.in` and run `pip-compile requirements.in` to update
+recommended. To add new dependencies add them to `requirements.in` and run `uv pip compile requirements.in -o requirements.txt` to update
 the main file.
 
 If 1 or more of the packages fail to install the likely issue is missing header files for the libraries with native C 
@@ -133,11 +133,12 @@ All DB commands are from the `Flask-Migrate` library and are used to configure D
 docs [here](https://flask-migrate.readthedocs.io/en/latest/) for details. 
 
 ## Code standards
-This project is configured to use Pylint and mypy. Commits will be pylinted and typechecked by GitHub actions and if the
+This project is configured to use ruff, pylint, and mypy. Commits will be ruffed, pylinted, and typechecked by GitHub actions and if the
 score drops your build will fail blocking you from merging. To make your life easier just run it before making a PR.
 
-To run pylint and mypy use these commands:
+To run ruff, pylint, and mypy use these commands:
 ```bash
+ruff check packet
 pylint packet/routes packet
 mypy --disable-error-code import --disable-error-code name-defined --disallow-untyped-defs --exclude routes packet
 ```

config.env.py

@@ -2,73 +2,84 @@
 Default configuration settings and environment variable based configuration logic
     See the readme for more information
 """
+
 from distutils.util import strtobool
 from os import environ, path, getcwd
 
 # Flask config
 DEBUG = False
-IP = environ.get("PACKET_IP", "localhost")
-PORT = environ.get("PACKET_PORT", "8000")
-PROTOCOL = environ.get("PACKET_PROTOCOL", "https://")
-SERVER_NAME = environ.get("PACKET_SERVER_NAME", IP + ":" + PORT)
-SECRET_KEY = environ.get("PACKET_SECRET_KEY", "PLEASE_REPLACE_ME")
+IP = environ.get('PACKET_IP', 'localhost')
+PORT = environ.get('PACKET_PORT', '8000')
+PROTOCOL = environ.get('PACKET_PROTOCOL', 'https://')
+SERVER_NAME = environ.get('PACKET_SERVER_NAME', IP + ':' + PORT)
+SECRET_KEY = environ.get('PACKET_SECRET_KEY', 'PLEASE_REPLACE_ME')
 
 # Logging config
-LOG_LEVEL = environ.get("PACKET_LOG_LEVEL", "INFO")
+LOG_LEVEL = environ.get('PACKET_LOG_LEVEL', 'INFO')
 
 # OpenID Connect SSO config
-REALM = environ.get("PACKET_REALM", "csh")
+REALM = environ.get('PACKET_REALM', 'csh')
 
-OIDC_ISSUER = environ.get("PACKET_OIDC_ISSUER", "https://sso.csh.rit.edu/auth/realms/csh")
-OIDC_CLIENT_ID = environ.get("PACKET_OIDC_CLIENT_ID", "packet")
-OIDC_CLIENT_SECRET = environ.get("PACKET_OIDC_CLIENT_SECRET", "PLEASE_REPLACE_ME")
+OIDC_ISSUER = environ.get('PACKET_OIDC_ISSUER', 'https://sso.csh.rit.edu/auth/realms/csh')
+OIDC_CLIENT_ID = environ.get('PACKET_OIDC_CLIENT_ID', 'packet')
+OIDC_CLIENT_SECRET = environ.get('PACKET_OIDC_CLIENT_SECRET', 'PLEASE_REPLACE_ME')
 
 # SQLAlchemy config
-SQLALCHEMY_DATABASE_URI = environ.get("PACKET_DATABASE_URI", "postgresql://postgres:mysecretpassword@localhost:5432/postgres")
+SQLALCHEMY_DATABASE_URI = environ.get(
+    'PACKET_DATABASE_URI',
+    'postgresql://postgres:mysecretpassword@localhost:5432/postgres',
+)
 SQLALCHEMY_TRACK_MODIFICATIONS = False
 
 # LDAP config
-LDAP_BIND_DN = environ.get("PACKET_LDAP_BIND_DN", None)
-LDAP_BIND_PASS = environ.get("PACKET_LDAP_BIND_PASS", None)
+LDAP_BIND_DN = environ.get('PACKET_LDAP_BIND_DN', None)
+LDAP_BIND_PASS = environ.get('PACKET_LDAP_BIND_PASS', None)
 LDAP_MOCK_MEMBERS = [
-        {'uid':'evals', 'groups': ['eboard', 'eboard-evaluations', 'active']},
-        {'uid':'imps-3da', 'groups': ['eboard', 'eboard-imps', '3da', 'active']},
-        {
-            'uid':'rtp-cm-webs-onfloor',
-            'groups': ['active-rtp', 'rtp', 'constitutional_maintainers', 'webmaster', 'active', 'onfloor'],
-            'room_number': 1024
-        },
-        {'uid':'misc-rtp', 'groups': ['rtp']},
-        {'uid':'onfloor', 'groups': ['active', 'onfloor'], 'room_number': 1024},
-        {'uid':'active-offfloor', 'groups': ['active']},
-        {'uid':'alum', 'groups': ['member']},
-    ]
+    {'uid': 'evals', 'groups': ['eboard', 'eboard-evaluations', 'active']},
+    {'uid': 'imps-3da', 'groups': ['eboard', 'eboard-imps', '3da', 'active']},
+    {
+        'uid': 'rtp-cm-webs-onfloor',
+        'groups': [
+            'active-rtp',
+            'rtp',
+            'constitutional_maintainers',
+            'webmaster',
+            'active',
+            'onfloor',
+        ],
+        'room_number': 1024,
+    },
+    {'uid': 'misc-rtp', 'groups': ['rtp']},
+    {'uid': 'onfloor', 'groups': ['active', 'onfloor'], 'room_number': 1024},
+    {'uid': 'active-offfloor', 'groups': ['active']},
+    {'uid': 'alum', 'groups': ['member']},
+]
 
 # Mail Config
-MAIL_PROD = strtobool(environ.get("PACKET_MAIL_PROD", "False"))
-MAIL_SERVER = environ.get("PACKET_MAIL_SERVER", "thoth.csh.rit.edu")
-MAIL_USERNAME = environ.get("PACKET_MAIL_USERNAME", "[email protected]")
-MAIL_PASSWORD = environ.get("PACKET_MAIL_PASSWORD", None)
-MAIL_USE_TLS = strtobool(environ.get("PACKET_MAIL_TLS", "True"))
+MAIL_PROD = strtobool(environ.get('PACKET_MAIL_PROD', 'False'))
+MAIL_SERVER = environ.get('PACKET_MAIL_SERVER', 'thoth.csh.rit.edu')
+MAIL_USERNAME = environ.get('PACKET_MAIL_USERNAME', '[email protected]')
+MAIL_PASSWORD = environ.get('PACKET_MAIL_PASSWORD', None)
+MAIL_USE_TLS = strtobool(environ.get('PACKET_MAIL_TLS', 'True'))
 
 # OneSignal Config
-ONESIGNAL_USER_AUTH_KEY = environ.get("PACKET_ONESIGNAL_USER_AUTH_KEY", None)
-ONESIGNAL_CSH_APP_AUTH_KEY = environ.get("PACKET_ONESIGNAL_CSH_APP_AUTH_KEY", None)
-ONESIGNAL_CSH_APP_ID = environ.get("PACKET_ONESIGNAL_CSH_APP_ID", "6eff123a-0852-4027-804e-723044756f00")
-ONESIGNAL_INTRO_APP_AUTH_KEY = environ.get("PACKET_ONESIGNAL_INTRO_APP_AUTH_KEY", None)
-ONESIGNAL_INTRO_APP_ID = environ.get("PACKET_ONESIGNAL_INTRO_APP_ID", "6eff123a-0852-4027-804e-723044756f00")
+ONESIGNAL_USER_AUTH_KEY = environ.get('PACKET_ONESIGNAL_USER_AUTH_KEY', None)
+ONESIGNAL_CSH_APP_AUTH_KEY = environ.get('PACKET_ONESIGNAL_CSH_APP_AUTH_KEY', None)
+ONESIGNAL_CSH_APP_ID = environ.get('PACKET_ONESIGNAL_CSH_APP_ID', '6eff123a-0852-4027-804e-723044756f00')
+ONESIGNAL_INTRO_APP_AUTH_KEY = environ.get('PACKET_ONESIGNAL_INTRO_APP_AUTH_KEY', None)
+ONESIGNAL_INTRO_APP_ID = environ.get('PACKET_ONESIGNAL_INTRO_APP_ID', '6eff123a-0852-4027-804e-723044756f00')
 
 # Sentry Config
-SENTRY_DSN = environ.get("PACKET_SENTRY_DSN", "")
+SENTRY_DSN = environ.get('PACKET_SENTRY_DSN', '')
 
 # Slack URL for pushing to #general
-SLACK_WEBHOOK_URL = environ.get("PACKET_SLACK_URL", None)
+SLACK_WEBHOOK_URL = environ.get('PACKET_SLACK_URL', None)
 
 # Packet Config
-PACKET_UPPER = environ.get("PACKET_UPPER", "packet.csh.rit.edu")
-PACKET_INTRO = environ.get("PACKET_INTRO", "freshmen-packet.csh.rit.edu")
+PACKET_UPPER = environ.get('PACKET_UPPER', 'packet.csh.rit.edu')
+PACKET_INTRO = environ.get('PACKET_INTRO', 'freshmen-packet.csh.rit.edu')
 
 # RUM
-RUM_APP_ID = environ.get("PACKET_RUM_APP_ID", "")
-RUM_CLIENT_TOKEN = environ.get("PACKET_RUM_CLIENT_TOKEN","")
-DD_ENV = environ.get("DD_ENV", "local-dev")
+RUM_APP_ID = environ.get('PACKET_RUM_APP_ID', '')
+RUM_CLIENT_TOKEN = environ.get('PACKET_RUM_CLIENT_TOKEN', '')
+DD_ENV = environ.get('DD_ENV', 'local-dev')

gulpfile.js/index.js

@@ -20,4 +20,4 @@ requireDir('./tasks', {recurse: true});
 // Default task
 gulp.task('default', gulp.parallel('css', 'js'));
 gulp.task('production', gulp.parallel('css', 'js', 'generate-favicon'));
-gulp.task('lint', gulp.parallel('pylint'));
+gulp.task('lint', gulp.parallel('ruff', 'pylint'));

gulpfile.js/tasks/pylint.js

@@ -9,4 +9,4 @@ let pylintTask = (cb) => {
     });
 };
 
-gulp.task('pylint', pylintTask);
+gulp.task('pylint', pylintTask);

gulpfile.js/tasks/ruff.js

@@ -0,0 +1,12 @@
+const gulp = require('gulp');
+const exec = require('child_process').exec;
+
+let ruffTask = (cb) => {
+    exec('ruff check packet', function (err, stdout, stderr) {
+        console.log(stdout);
+        console.log(stderr);
+        cb(err);
+    });
+};
+
+gulp.task('ruff', ruffTask);