Enable ruff security, logging and debugging rules (S, T20, LOG, G, DTZ, ERA, TD, FIX, EXE)

[anth-volk]

Fixes #784

Same-Repository Draft PR Check

• This PR is a draft.
• This PR is from a branch in PolicyEngine/policyengine-sim-api, not a personal fork.

Summary

Phase 1 step 1.8, group 6: security, logging and debugging leftovers. Stacked on #783.

• Rules: ruff.toml gains S, T20, LOG, G, DTZ, ERA, TD, FIX and EXE. All 244 findings at the base are fixed or kept with an inline reason, one commit per family. ERA, TD, FIX and EXE had no findings.
• Behaviour changes (all deliberate):
  • Gateway auth misconfiguration log (G201): it now uses logger.exception("Gateway auth misconfigured"). Before, it logged "Gateway auth misconfigured: Gateway auth misconfigured: set GATEWAY_AUTH_ISSUER …", repeating the message; the traceback still ends with the full RuntimeError message. The 503 response is unchanged.
  • Logger name (LOG002): the executor's simulation.py uses getLogger(__name__) instead of getLogger(__file__).
  • Gateway image smoke: its local entrypoint raises RuntimeError with a message instead of failing a bare assert. The smoke script and the integration test only check the exit code.
  • Six f-string log calls become %s arguments with identical text (G004).
• Asserts outside tests (S101):
  • Contract spm.py (4): the asserts couldn't fail, because _require_complete_selection already raises ValueError when either value is missing. It now returns them, so nothing new is raised and Pydantic validators still see ValueError.
  • Executor stage12_qualification.py: the closure captures a non-optional runtime instead of asserting it.
  • Test double in fixtures/: raises AssertionError explicitly, as the repo's other fakes do.
  • authenticated_tests: this is the deployed-service pytest suite (run by simulation-deploy.reusable.yml), which the **/tests/** glob didn't match. It gets the same exemption (ANN, D1, PLR2004, S101), registered as sim.quality.deployed-tests-ruff-exemptions.
  • Nothing in the repo runs Python with -O.
• Prints in commands (T201): command-line scripts and Modal local entrypoints keep their output. Short ones carry an inline reason; update_version_registry.py (22 prints) and .github/scripts/update_policyengine_package.py route output through one helper. No application code had a debug print.
• Subprocess calls (S603, S607): each test module that runs repository scripts now does it through one helper with one reasoned suppression, for example _run_bash in test_modal_scripts.py (32 calls). Executables still come from the child's PATH, since several tests pass their own env.
• Datetimes (DTZ): every value stays naive, matching .py's ParameterValue dates and its own period parsing. The 11 naive test dates go through one _naive_policy_date helper.
• Other security findings: no vulnerability found.
  • Fixed: the GCP metadata probe builds its Request inline, with identical URL, headers and method.
  • Kept with a reason:
    • fake tokens in tests, now module constants;
    • Modal secret and display names;
    • the Modal container's fixed /tmp/policyengine-data paths;
    • image tests that exec repository-owned app source;
    • tests that pickle objects they built;
    • the Hugging Face Hub URL built from HF_ENDPOINT and quoted path parts.
  • S110: each try/except/pass already carried a reasoned BLE001 suppression from group 5, which now lists S110 too.
• Modal images: code changes in the executor image's simulation.py, simulation_runtime.py, stage12_qualification.py and update_version_registry.py, and in the shared contract, observability and fastapi libraries. src/modal/app.py changes only in comments.
• Registry: sim.quality.ruff-lint now lists the nine families. The shared rules tool is synced from the Public API's group 6 (Enable ruff security, logging and debugging rules (S, T20, LOG, G, DTZ, ERA, TD, FIX, EXE) policyengine-api#3915), so it's byte-identical again (tool sha256 1c4bbb2a93f8).

Testing

• All seven projects' test suites pass, with the same counts as the base:

  Project	Passed
  fastapi	14
  contract	145
  observability	30
  stage12	12
  entry	224
  gateway	214
  executor	744

• The gateway golden OpenAPI test passes, and the golden file is unchanged.

• ruff check (0.15.22) is clean repo-wide, and ruff format --check is unchanged.

• The rules guard, the ci-scripts guard and the rules tool unittest pass.

• The integration smoke tests need real Modal, so they were only collected.

• CI/CD: no workflow changed, and no environment variable was added or rewired.

• CI: this PR is above the bottom of its stack, so it runs only CI complete, which fails and says why (step 0.7, Make CI enforcement trustworthy before the rules registry #754). Its full run starts once the PRs below it merge.

🤖 Generated with Claude Code