style: auto-format code with ruff

Author: open-resource-broker-cicd[bot]

dev-tools/setup/install_dev_tools.py

@@ -413,9 +413,7 @@ def _install_bun_generic(self):
     def _install_actionlint_generic(self):
         """Install actionlint using official download script (curl-to-tempfile, no shell=True)."""
         if self.dry_run:
-            logger.info(
-                "[DRY RUN] Would download actionlint install script and run: bash <script>"
-            )
+            logger.info("[DRY RUN] Would download actionlint install script and run: bash <script>")
             return True
         with tempfile.NamedTemporaryFile(suffix=".bash", delete=False) as tmp:
             tmp_path = tmp.name
@@ -438,7 +436,9 @@ def _install_shellcheck_generic(self):
 
         url = f"https://github.com/koalaman/shellcheck/releases/latest/download/shellcheck-latest.linux.{arch}.tar.xz"
         if self.dry_run:
-            logger.info(f"[DRY RUN] Would download shellcheck from {url} and extract to /usr/local/bin")
+            logger.info(
+                f"[DRY RUN] Would download shellcheck from {url} and extract to /usr/local/bin"
+            )
             return True
         with tempfile.NamedTemporaryFile(suffix=".tar.xz", delete=False) as tmp:
             tmp_path = tmp.name
@@ -466,7 +466,9 @@ def _install_trufflehog_generic(self):
 
         url = f"https://github.com/trufflesecurity/trufflehog/releases/latest/download/trufflehog_linux_{arch}.tar.gz"
         if self.dry_run:
-            logger.info(f"[DRY RUN] Would download trufflehog from {url} and extract to /usr/local/bin")
+            logger.info(
+                f"[DRY RUN] Would download trufflehog from {url} and extract to /usr/local/bin"
+            )
             return True
         with tempfile.NamedTemporaryFile(suffix=".tar.gz", delete=False) as tmp:
             tmp_path = tmp.name
@@ -482,7 +484,13 @@ def _install_act_generic(self):
         with tempfile.NamedTemporaryFile(suffix=".sh", delete=False) as tmp:
             tmp_path = tmp.name
         return self._run_command(
-            ["curl", "-s", "-o", tmp_path, "https://raw.githubusercontent.com/nektos/act/master/install.sh"]
+            [
+                "curl",
+                "-s",
+                "-o",
+                tmp_path,
+                "https://raw.githubusercontent.com/nektos/act/master/install.sh",
+            ]
         ) and self._run_command(["sudo", "bash", tmp_path])
 
     def _install_pip_audit_python(self):

src/orb/providers/aws/auth/cognito_strategy.py

@@ -291,9 +291,7 @@ async def revoke_token(self, token: str) -> bool:
                     return True
                 except ClientError as exc:
                     error_code = exc.response.get("Error", {}).get("Code", "Unknown")
-                    self._logger.error(
-                        "Cognito RevokeToken API call failed (code=%s)", error_code
-                    )
+                    self._logger.error("Cognito RevokeToken API call failed (code=%s)", error_code)
                     return False
             else:
                 # Access tokens (token_use == "access") or unrecognised/malformed tokens:

src/orb/providers/aws/infrastructure/aws_client.py

@@ -21,6 +21,7 @@ def _mask_config_dict(config: dict) -> dict:
             masked[k] = v
     return masked
 
+
 from botocore.config import Config
 from botocore.exceptions import ClientError
 

tests/infrastructure/error/test_http_response_handler.py

@@ -44,7 +44,9 @@ def handler(self):
 
     def test_validation_error_http(self, handler):
         """Test validation error HTTP response returns safe message, keeps field-level details."""
-        exception = ValidationError("Internal field path: user.secret_token", details={"field": "name"})
+        exception = ValidationError(
+            "Internal field path: user.secret_token", details={"field": "name"}
+        )
 
         response = handler.handle_error_for_http(exception)
 
@@ -96,7 +98,9 @@ def test_request_not_found_http(self, handler):
 
     def test_request_validation_http(self, handler):
         """Test request validation error HTTP response returns safe message, keeps field details."""
-        exception = RequestValidationError("Invalid request: count must be <= 500", details={"field": "count"})
+        exception = RequestValidationError(
+            "Invalid request: count must be <= 500", details={"field": "count"}
+        )
 
         response = handler.handle_error_for_http(exception)
 
@@ -121,7 +125,9 @@ def test_machine_not_found_http(self, handler):
 
     def test_machine_validation_http(self, handler):
         """Test machine validation error HTTP response returns safe message, keeps field details."""
-        exception = MachineValidationError("Invalid machine: internal type code 0x3F", details={"field": "type"})
+        exception = MachineValidationError(
+            "Invalid machine: internal type code 0x3F", details={"field": "type"}
+        )
 
         response = handler.handle_error_for_http(exception)
 
@@ -147,7 +153,8 @@ def test_template_not_found_http(self, handler):
     def test_template_validation_http(self, handler):
         """Test template validation error HTTP response returns safe message, keeps field details."""
         exception = TemplateValidationError(
-            "Invalid template: internal path /etc/templates/secret.yaml", details={"field": "config"}
+            "Invalid template: internal path /etc/templates/secret.yaml",
+            details={"field": "config"},
         )
 
         response = handler.handle_error_for_http(exception)
@@ -161,7 +168,9 @@ def test_template_validation_http(self, handler):
 
     def test_infrastructure_error_http(self, handler):
         """Test infrastructure error HTTP response does not leak original_error to client."""
-        exception = InfrastructureError("Database connection failed: host=internal-db.corp port=5432")
+        exception = InfrastructureError(
+            "Database connection failed: host=internal-db.corp port=5432"
+        )
 
         response = handler.handle_error_for_http(exception)
 
@@ -174,7 +183,9 @@ def test_infrastructure_error_http(self, handler):
 
     def test_configuration_error_http(self, handler):
         """Test configuration error HTTP response does not leak original_error to client."""
-        exception = ConfigurationError("Invalid config: secret_key=abc123 at path /etc/orb/config.yaml")
+        exception = ConfigurationError(
+            "Invalid config: secret_key=abc123 at path /etc/orb/config.yaml"
+        )
 
         response = handler.handle_error_for_http(exception)
 
@@ -255,7 +266,9 @@ def test_infrastructure_error_does_not_leak_secret_to_client_but_logs_it(self, h
         original_logger = handler._logger
 
         mock_logger = MagicMock()
-        mock_logger.error.side_effect = lambda *args, **kwargs: log_calls.append(("error", args, kwargs))
+        mock_logger.error.side_effect = lambda *args, **kwargs: log_calls.append(
+            ("error", args, kwargs)
+        )
         handler._logger = mock_logger
 
         try:
@@ -275,9 +288,7 @@ def test_infrastructure_error_does_not_leak_secret_to_client_but_logs_it(self, h
 
     def test_duplicate_error_does_not_leak_raw_message(self, handler):
         """DuplicateError returns a generic safe message; raw detail stays out of response."""
-        exception = DuplicateError(
-            "Duplicate key: machine_id=m-secret-prod-123 in table machines"
-        )
+        exception = DuplicateError("Duplicate key: machine_id=m-secret-prod-123 in table machines")
 
         response = handler.handle_error_for_http(exception)
 

tests/providers/aws/unit/test_iam_strategy.py

@@ -129,8 +129,7 @@ def _make_simulate_response(*entries: tuple[str, str]) -> dict:
     """
     return {
         "EvaluationResults": [
-            {"EvalActionName": action, "EvalDecision": decision}
-            for action, decision in entries
+            {"EvalActionName": action, "EvalDecision": decision} for action, decision in entries
         ]
     }
 
@@ -196,7 +195,11 @@ async def test_iam_check_permissions_mixed_decisions():
     """_check_permissions returns only the allowed subset from a mixed response."""
     strategy = _make_strategy(assume_permissions=False)
     strategy._assume_permissions = False
-    strategy.required_actions = ["ec2:DescribeInstances", "ec2:RunInstances", "ec2:TerminateInstances"]
+    strategy.required_actions = [
+        "ec2:DescribeInstances",
+        "ec2:RunInstances",
+        "ec2:TerminateInstances",
+    ]
 
     strategy.iam_client.simulate_principal_policy.return_value = _make_simulate_response(
         ("ec2:DescribeInstances", "allowed"),