Repository navigation
fix(pre-commit): drop missing bandit baseline from hook args - #299
Open
avneetbansal-aws wants to merge 1 commit into
Open
avneetbansal-aws wants to merge 1 commit into
avneetbansal-aws wants to merge 1 commit into
Conversation
The bandit hook passed --baseline .bandit-baseline.json, but no such file exists in the repo, so bandit exited with code 2 on every run. CI already runs bandit without a baseline (mise run security:bandit), so the hook now matches CI. Fixes awslabs#219 Verification (run in this worktree on upstream/main fbefb37 + this change): pre-commit run bandit --all-files (pre-commit 4.3.0, bandit 1.9.3) -> bandit...Passed. No new findings surfaced, so nothing else changed. Eligibility gate for awslabs#219 re-checked before commit: open, unassigned, no linked or open PR touching .pre-commit-config.yaml. Signed-off-by: avneetbansal-aws <284363899+avneetbansal-aws@users.noreply.github.com>
avneetbansal-aws
requested review from
a team,
arnewouters,
krokoko and
laithalsaadoon
November 6, 2026 16:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

This removes the
--baseline .bandit-baseline.jsonargument from the bandit hook in.pre-commit-config.yaml. The baseline file was never committed, so the local hook exited with code 2 on every run, which is the failure reported in #219. CI already runs bandit throughmise run security:banditwithout a baseline and passes, so dropping the argument makes the local hook behave the same way as CI. A generated baseline was the other option in the issue, but it would freeze today's findings in a large JSON file and leave the hook and CI checking different things.The change is a single deleted line. The CODEOWNERS and
.semgrepignoreentries for.bandit-baseline.jsonare harmless and were left alone to keep the diff small. It is one of the pre-commit failures tracked under #213, alongside the work in #280 and #281.Running
pre-commit run bandit --all-fileson top of current upstream main (fbefb37) now reports Passed with bandit 1.9.3, so removing the baseline did not surface any new findings that would need handling separately. The fullmise run buildwas not run, since the diff only touches the bandit hook arguments.Fixes #219
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.