| name | scan-check |
| description | Predict the plugins.qgis.org Security & Quality scan locally (flake8 + Bandit), no Docker needed. Use before any upload/release, or after a change, to confirm the plugin still scans with zero findings. |
Run the same checks the plugins.qgis.org scanner runs, locally and fast, and report the counts.
Procedure (from the repo root)
- flake8 in isolated mode — mirrors the scanner exactly (config files are ignored):
python -m flake8 --isolated --max-line-length=120 --ignore=E501 fiberq
- Bandit at ALL severities (the scanner flags LOW too — e.g. B110/B112 try/except/pass|continue — so
-ll is not enough):
python -m bandit -r fiberq -q -c pyproject.toml
- Report: flake8 finding count and total Bandit count (all severities). The gate is 0 / 0.
- If anything fires, list each finding with
file:line and the code, and say whether it should be fixed or (rarely, with a stated reason) silenced with an inline # noqa: <code> / Bandit annotation.
Notes
- "0 findings" today rests partly on intentional inline
# noqas for style codes that are tracked debt — do not strip those as "cleanup".
- This is lint-only. For the full gate including running tests in QGIS, use
green.
