style: auto-format code with ruff

Author: open-resource-broker-cicd[bot]

dev-tools/setup/install_dev_tools.py

@@ -534,9 +534,7 @@ def _install_actionlint_generic(self):
         a checksum-verified alternative is available.
         """
         if self.dry_run:
-            logger.info(
-                "[DRY RUN] Would download actionlint install script and run: bash <script>"
-            )
+            logger.info("[DRY RUN] Would download actionlint install script and run: bash <script>")
             return True
         fd, tmp_path = tempfile.mkstemp(suffix=".bash")
         try:
@@ -573,7 +571,9 @@ def _install_shellcheck_generic(self):
 
         url = f"https://github.com/koalaman/shellcheck/releases/latest/download/shellcheck-latest.linux.{arch}.tar.xz"
         if self.dry_run:
-            logger.info(f"[DRY RUN] Would download shellcheck from {url} and extract to /usr/local/bin")
+            logger.info(
+                f"[DRY RUN] Would download shellcheck from {url} and extract to /usr/local/bin"
+            )
             return True
         fd, tmp_path = tempfile.mkstemp(suffix=".tar.xz")
         try:
@@ -616,14 +616,14 @@ def _install_trufflehog_generic(self):
 
         url = f"https://github.com/trufflesecurity/trufflehog/releases/latest/download/trufflehog_linux_{arch}.tar.gz"
         if self.dry_run:
-            logger.info(f"[DRY RUN] Would download trufflehog from {url} and extract to /usr/local/bin")
+            logger.info(
+                f"[DRY RUN] Would download trufflehog from {url} and extract to /usr/local/bin"
+            )
             return True
         fd, tmp_path = tempfile.mkstemp(suffix=".tar.gz")
         try:
             os.close(fd)
-            ok = self._run_command(
-                ["curl", "-L", "-o", tmp_path, url]
-            ) and self._run_command(
+            ok = self._run_command(["curl", "-L", "-o", tmp_path, url]) and self._run_command(
                 ["sudo", "tar", "-xz", "-C", "/usr/local/bin", "-f", tmp_path, "trufflehog"]
             )
         finally:

src/orb/api/routers/machines.py

@@ -315,7 +315,10 @@ async def purge_machine(
         logger.warning("Machine purge failed — not found: %s", exc)
         return JSONResponse(
             status_code=404,
-            content={"success": False, "error": {"code": "NOT_FOUND", "message": "Machine not found."}},
+            content={
+                "success": False,
+                "error": {"code": "NOT_FOUND", "message": "Machine not found."},
+            },
         )
     except NonTerminalStatusError as exc:
         logger.warning("Machine purge rejected — non-terminal status: %s", exc)

src/orb/api/routers/requests.py

@@ -324,7 +324,10 @@ async def purge_request(
         _logger.warning("Request purge failed — not found: %s", exc)
         return JSONResponse(
             status_code=404,
-            content={"success": False, "error": {"code": "NOT_FOUND", "message": "Request not found."}},
+            content={
+                "success": False,
+                "error": {"code": "NOT_FOUND", "message": "Request not found."},
+            },
         )
     except NonTerminalStatusError as exc:
         _logger.warning("Request purge rejected — non-terminal status: %s", exc)

src/orb/providers/aws/auth/iam_strategy.py

@@ -295,9 +295,7 @@ async def _get_caller_identity(self) -> Optional[dict[str, Any]]:
             Caller identity information
         """
         try:
-            response: dict[str, Any] = await asyncio.to_thread(
-                self.sts_client.get_caller_identity
-            )
+            response: dict[str, Any] = await asyncio.to_thread(self.sts_client.get_caller_identity)
             return response
         except Exception as e:
             self._logger.error("Failed to get caller identity: %s", e)

src/orb/providers/aws/infrastructure/aws_client.py

@@ -5,9 +5,7 @@
 
 # Exact-match keys whose values are always sensitive, regardless of surrounding
 # characters.  Also used as suffix patterns ("ends with").
-_SECRET_EXACT_KEYS = frozenset(
-    {"access_key_id", "secret_access_key", "session_token"}
-)
+_SECRET_EXACT_KEYS = frozenset({"access_key_id", "secret_access_key", "session_token"})
 
 # Substring fragments that indicate a sensitive key when found anywhere in the
 # lowercased field name.  Deliberately excludes bare "key" to avoid hiding
@@ -50,10 +48,7 @@ def _mask_config_dict(config: dict) -> dict:
             # even when the parent key itself is not sensitive.
             masked[k] = _mask_config_dict(v)
         elif isinstance(v, list):
-            masked[k] = [
-                _mask_config_dict(item) if isinstance(item, dict) else item
-                for item in v
-            ]
+            masked[k] = [_mask_config_dict(item) if isinstance(item, dict) else item for item in v]
         elif _is_sensitive_key(k):
             masked[k] = "***"
         else:

tests/infrastructure/error/test_http_response_handler.py

@@ -295,6 +295,7 @@ def test_duplicate_error_does_not_leak_raw_message(self, handler):
         assert response.message == "A duplicate resource already exists"
         assert "m-secret-prod-123" not in response.message
         assert "m-secret-prod-123" not in str(response.details)
+
     # --- Regression tests ---
 
     def test_not_found_message_does_not_contain_entity_id(self, handler):
@@ -374,4 +375,3 @@ def test_unexpected_error_is_logged(self, handler):
 
         # Server-side log must have been called
         assert len(logged) >= 1, "Expected at least one logger.error call for unexpected errors"
-

tests/infrastructure/error/test_responses.py

@@ -81,7 +81,10 @@ def test_configuration_error_details_are_empty(self):
         """Regression (H3): ConfigurationError details must be empty on the response."""
         exception = ConfigurationError(
             "bad config",
-            details={"original_error": "key=db_password value=s3cr3t", "filename": "/etc/orb/config.yaml"},
+            details={
+                "original_error": "key=db_password value=s3cr3t",
+                "filename": "/etc/orb/config.yaml",
+            },
         )
 
         response = InfrastructureErrorResponse.from_exception(exception)

tests/providers/aws/unit/test_cognito_strategy.py

@@ -80,9 +80,7 @@ def _make_fake_jwt_token(token_use: str = "access", exp_offset: int = 3600) -> s
         "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_EXAMPLE",
         "aud": "abc123",
     }
-    payload = (
-        base64.urlsafe_b64encode(json.dumps(payload_data).encode()).rstrip(b"=").decode()
-    )
+    payload = base64.urlsafe_b64encode(json.dumps(payload_data).encode()).rstrip(b"=").decode()
     sig = "fakesignatureAABBCC"
     return f"{header}.{payload}.{sig}"
 

tests/unit/api/test_admin_router.py

@@ -740,7 +740,9 @@ class TestReloadConfigNoInfoLeak:
     """Broad Exception during config reload must not expose internal text in the
     500 response body, but must be visible in the server ERROR log."""
 
-    def _make_failing_container(self, config_port, machine_repo, request_repo, template_repo, secret):
+    def _make_failing_container(
+        self, config_port, machine_repo, request_repo, template_repo, secret
+    ):
         """Return a DI container whose ConfigurationManager.reload() raises with *secret*."""
         from orb.domain.base import UnitOfWorkFactory
         from orb.domain.base.ports.configuration_port import ConfigurationPort

tests/unit/api/test_config_router.py

@@ -387,12 +387,10 @@ def _make_save_app(self):
 
         # Satisfy the destructive-admin guard embedded in save_config.
         config_port_for_guard = MagicMock()
-        config_port_for_guard.get_configuration_value.side_effect = (
-            lambda key, default=None: {
-                "allow_destructive_admin": True,
-                "environment": "development",
-            }.get(key, default)
-        )
+        config_port_for_guard.get_configuration_value.side_effect = lambda key, default=None: {
+            "allow_destructive_admin": True,
+            "environment": "development",
+        }.get(key, default)
         server_config = MagicMock()
         server_config.auth.enabled = True
 
@@ -427,9 +425,10 @@ def test_value_error_text_not_in_response_body(self, config_app, caplog):
         server_config = MagicMock()
         server_config.auth.enabled = True
 
-        with patch("orb.api.dependencies.get_di_container", return_value=MagicMock(
-            **{"get.return_value": port}
-        )):
+        with patch(
+            "orb.api.dependencies.get_di_container",
+            return_value=MagicMock(**{"get.return_value": port}),
+        ):
             with patch("orb.api.dependencies.get_server_config", return_value=server_config):
                 with caplog.at_level(logging.WARNING, logger="orb.api.routers.config"):
                     client = TestClient(config_app, raise_server_exceptions=False)
@@ -470,9 +469,10 @@ def test_no_config_path_error_code_unchanged(self, config_app):
         server_config = MagicMock()
         server_config.auth.enabled = True
 
-        with patch("orb.api.dependencies.get_di_container", return_value=MagicMock(
-            **{"get.return_value": port}
-        )):
+        with patch(
+            "orb.api.dependencies.get_di_container",
+            return_value=MagicMock(**{"get.return_value": port}),
+        ):
             with patch("orb.api.dependencies.get_server_config", return_value=server_config):
                 client = TestClient(config_app, raise_server_exceptions=False)
                 r = client.post("/config/save", json={})