Security & Formatter Gates
Relevant source files
The following files were used as context for generating this wiki page:
Security and Formatter Gates within the FLEXT infrastructure are specialized quality enforcement components designed to ensure code safety, stylistic consistency, and documentation quality. These gates wrap industry-standard tools like Bandit, Ruff, and MarkdownLint into a unified execution framework. They provide automated checking and, where supported, automated fixing of violations across the workspace.
The system operates by defining specific "Gate" classes that inherit from a base FlextInfraGate structure. Each gate identifies issues in source files, categorizes them by severity, and generates reports in formats such as Markdown and SARIF 2.1.0 for integration into CI/CD pipelines.
Sources: src/flext_infra/gates/markdown.py, src/flext_infra/_models/check.py:179-195, src/flext_infra/_constants/check.py:35-50
Core Architecture and Data Flow
The architecture follows a provider pattern where each gate class encapsulates the logic for a specific tool. The lifecycle of a gate execution involves collecting relevant files, building a CLI command for the underlying tool, and parsing the output into a standardized Issue model.
Execution Workflow
The diagram shows the standard progression from file discovery to final reporting used by all security and formatting gates.
Sources: src/flext_infra/gates/markdown.py:38-84, src/flext_infra/gates/bandit.py:35-65
Standardized Issue Model
Every gate translates tool-specific output into a canonical Issue model to ensure consistent reporting.
| Field | Type | Description |
|---|---|---|
file | str | Relative path to the source file. |
line | int | Line number of the violation. |
column | int | Column number of the violation. |
code | str | Rule or error code (e.g., "B101", "MD001"). |
message | str | Human-readable description of the issue. |
severity | str | Level of the issue (error, warning, note). |
Sources: src/flext_infra/_models/check.py:157-177
Security Gates
The Security Gates focus on identifying vulnerabilities and ensuring adherence to safety standards.
Bandit Security Gate
The FlextInfraBanditGate utilizes the Bandit tool to find common security issues in Python code. It processes JSON output from Bandit to generate its findings.
- Gate ID:
security - Tool: Bandit (https://bandit.readthedocs.io/)
- Configuration: Uses
pyproject.tomlor workspace-root settings. It explicitly ignorestestsdirectories to avoid false positives on test code.
Sources: src/flext_infra/gates/bandit.py:16-25, src/flext_infra/_constants/check.py:46
Ruff Lint Gate
The FlextInfraRuffLintGate provides high-performance linting. It is capable of checking for a wide array of stylistic and programming errors.
- Gate ID:
lint - Fix Capability: Supports automated fixes using the
--fixflag. - Reporting: Captures issues including rule codes and specific line/column locations.
Sources: src/flext_infra/gates/ruff_lint.py:15-25, src/flext_infra/_constants/check.py:36
Formatter and Quality Gates
These gates ensure that the codebase remains uniform and that documentation follows established standards.
Ruff Format Gate
The FlextInfraRuffFormatGate enforces Python code formatting standards. Unlike the lint gate, it focuses on the structural layout of the code.
- Gate ID:
format - Tool: Ruff Formatter
- Mechanism: Primarily used to verify if files are formatted correctly and can apply formatting automatically.
Sources: src/flext_infra/gates/ruff_format.py:15-25, src/flext_infra/_constants/check.py:37
Markdown Quality Gate
The FlextInfraMarkdownGate ensures that documentation files (.md) adhere to quality standards using markdownlint.
- Gate ID:
markdown - File Collection: Recursively collects all
.mdfiles in a project, excluding directories specified inCHECK_EXCLUDED_DIRS. - Configuration Resolution:
- Searches for
.markdownlint.jsonin the workspace root. - Falls back to a local
.markdownlint.jsonin the project directory.
- Searches for
The sequence shows how configuration is resolved before the external linter is invoked.
Sources: src/flext_infra/gates/markdown.py:31-72
Tool Integration Summary
The following table summarizes the external tools integrated into the gate system:
| Gate ID | Tool Name | Tool URL | Source Implementation |
|---|---|---|---|
security | Bandit | https://bandit.readthedocs.io/ | bandit.py |
lint | Ruff Linter | https://docs.astral.sh/ruff/ | ruff_lint.py |
format | Ruff Formatter | https://docs.astral.sh/ruff/formatter/ | ruff_format.py |
markdown | MarkdownLint | https://github.com/DavidAnson/markdownlint | markdown.py |
Sources: src/flext_infra/_constants/check.py:35-50
Implementation Detail: Command Building
Gates implement _build_check_command and _build_fix_command to interface with CLI tools. For example, the Markdown gate uses a specific regex to parse the standard error and output of the linter:
# src/flext_infra/gates/markdown.py:75-92
def _parse_check_output(
self,
result: m.Cli.CommandOutput,
project_dir: Path,
ctx: m.Infra.GateContext,
) -> tuple[bool, t.SequenceOf[m.Infra.Issue]]:
issues: t.MutableSequenceOf[m.Infra.Issue] = []
for line in (result.stdout + "\n" + result.stderr).splitlines():
match = c.Infra.MARKDOWN_RE.match(line.strip())
if not match:
continue
issues.append(
m.Infra.Issue(
file=match.group("file"),
line=int(match.group("line")),
column=int(match.group("col") or 1),
code=match.group("code"),
message=match.group("msg"),
),
)
return result.exit_code == 0, issues
Sources: src/flext_infra/gates/markdown.py:75-92
Summary
Security & Formatter Gates provide the primary defensive layer for code quality in FLEXT projects. By wrapping tools like Bandit and Ruff, the system centralizes enforcement logic while allowing project-specific configurations. The output is normalized into ProjectResult and GateExecution models, enabling automated workspace-wide reporting and safety checks.
Sources: src/flext_infra/_models/check.py:205-230, src/flext_infra/gates/base_gate.py