@@ -145,6 +145,7 @@ def main(argv):
         try:
             os.unlink(CONF)
         except FileNotFoundError:
+            # nothing kept already: clearing is done
             pass
         print(json.dumps(status()))
         return 0
 
@@ -20,12 +20,32 @@
 import sys
 
 HERE = os.path.dirname(os.path.abspath(__file__))
+
+
+def _lines(path):
+    with open(path, encoding="utf-8") as f:
+        return f.read().splitlines()
+
+
+def _json(path):
+    with open(path, encoding="utf-8") as f:
+        return json.load(f)
+
+
+def _sha256(path):
+    h = hashlib.sha256()
+    with open(path, "rb") as f:
+        for block in iter(lambda: f.read(1 << 20), b""):
+            h.update(block)
+    return h.hexdigest()
+
+
 REPORTS = os.path.expanduser("~/release-reports")
 
 
 def kinds():
     out = []
-    for line in open(os.path.join(HERE, "hosts.conf")):
+    for line in _lines(os.path.join(HERE, "hosts.conf")):
         line = line.strip()
         if line and not line.startswith("#"):
             out.append(line.split()[0])
@@ -44,20 +64,20 @@ def main(debs):
         d = os.path.join(REPORTS, ver or "?")
         tested = {}
         try:
-            for line in open(os.path.join(d, "debs.sha256")):
+            for line in _lines(os.path.join(d, "debs.sha256")):
                 h, name = line.split()
                 tested[name] = h
         except OSError:
             # no fingerprint list: this version was never checked
             pass
-        h = hashlib.sha256(open(deb, "rb").read()).hexdigest()
+        h = _sha256(deb)
         if tested.get(os.path.basename(deb)) != h:
             # an upstream-versioned package (vkpeak, Mesa...) is tested inside
             # an app release: look for it in any report directory
             found = False
             for other in os.listdir(REPORTS) if os.path.isdir(REPORTS) else []:
                 try:
-                    lines = open(os.path.join(REPORTS, other, "debs.sha256")).read().split("\n")
+                    lines = _lines(os.path.join(REPORTS, other, "debs.sha256"))
                 except OSError:
                     continue
                 if "%s  %s" % (h, os.path.basename(deb)) in lines:
@@ -68,7 +88,7 @@ def main(debs):
                 continue
         for k in kinds():
             try:
-                r = json.load(open(os.path.join(d, "%s.json" % k)))
+                r = _json(os.path.join(d, "%s.json" % k))
             except (OSError, ValueError):
                 problems.append("%s: no %s report in %s" % (os.path.basename(deb), k, d))
                 continue
 
@@ -5,7 +5,7 @@
 import stat
 
 import coverage
-from common import Skip, check, files_of, our_packages, sh
+from common import Skip, check, files_of, our_packages, read_text, sh
 
 
 def shipped_executables():
@@ -42,7 +42,7 @@ def static_check(path):
         return "binary, libraries resolve"
     first = head.split(b"\n", 1)[0]
     if b"python" in first:
-        src = open(path, encoding="utf-8", errors="replace").read()
+        src = read_text(path)
         compile(src, path, "exec")
         return "python compiles"
     if first.startswith(b"#!") and (b"sh" in first):
@@ -87,7 +87,6 @@ def probe(ctx, path, entry):
 
 def run(ctx):
     exes = shipped_executables()
-    check_names = set()
     for pkg, path in exes:
         name = "exec %s" % path
         # Shared libraries carry the exec bit by convention; they are not
@@ -99,7 +98,6 @@ def run(ctx):
         if entry is None:
             ctx.add(name, "fail", "shipped by %s but has no entry in coverage.py: say how it is tested" % pkg)
             continue
-        check_names.add(path)
         ctx.run(name + " [static]", static_check, path)
         if entry[0] in ("run", "unit"):
             ctx.run(name, probe, ctx, path, entry)
 
@@ -19,7 +19,7 @@
 import time
 
 import coverage
-from common import Skip, check, preserved, sh
+from common import Skip, check, preserved, read_json, read_text, sh
 
 HELPER = "/usr/local/bin/skillfish-cc-helper"
 
@@ -57,7 +57,7 @@ def close(self):
 
 def _const(name):
     """A path constant from the installed helper, so the tests follow it."""
-    src = open(HELPER, encoding="utf-8").read()
+    src = read_text(HELPER)
     m = re.search(r'^%s\s*=\s*"([^"]+)"' % name, src, re.M)
     return m.group(1) if m else None
 
@@ -74,7 +74,7 @@ def _bc(ctx):
 
 # ---- coverage of the command list --------------------------------------------
 def t_command_coverage(ctx):
-    src = open(HELPER, encoding="utf-8").read()
+    src = read_text(HELPER)
     cmds = sorted(set(re.findall(r'^\s+if c == "([a-z0-9-]+)":', src, re.M)))
     check(cmds, "no commands found in %s" % HELPER)
     missing = [c for c in cmds if c not in coverage.CC_COMMANDS]
@@ -119,17 +119,17 @@ def t_cores(ctx, h):
 def t_smt(ctx, h):
     _bc(ctx)
     p = "/sys/devices/system/cpu/smt/control"
-    if not os.path.exists(p) or open(p).read().strip() != "on":
+    if not os.path.exists(p) or read_text(p).strip() != "on":
         raise Skip("SMT not on or not controllable")
     n0 = _nproc()
     try:
         _ok(h("cpu-smt", on=False), "cpu-smt off")
-        check(open(p).read().strip() == "off", "smt/control is not off")
+        check(read_text(p).strip() == "off", "smt/control is not off")
         n1 = _nproc()
         check(n1 == n0 // 2, "SMT off: %d threads, expected %d" % (n1, n0 // 2))
     finally:
         _ok(h("cpu-smt", on=True), "cpu-smt on")
-    check(open(p).read().strip() == "on", "smt/control did not come back on")
+    check(read_text(p).strip() == "on", "smt/control did not come back on")
     check(_nproc() == n0, "threads after SMT back on: %d, expected %d" % (_nproc(), n0))
     return "SMT off and on: %d, %d, %d threads" % (n0, n1, _nproc())
 
@@ -168,7 +168,7 @@ def t_gov_set(ctx, h):
     g = _gov(ctx, h)
     conf = g["conf"]
     with preserved(_gov_conf_file()):
-        r = _ok(h("gov-set", conf=conf, timeout=90), "gov-set")
+        _ok(h("gov-set", conf=conf, timeout=90), "gov-set")
         g2 = _ok(h("gov-get"), "gov-get")
         check(g2["conf"].get("curva") == conf.get("curva") and g2["conf"].get("freq_max") == conf.get("freq_max"),
               "the curve read back differs from the one written")
@@ -364,8 +364,9 @@ def _govs():
     out = {}
     for p in glob.glob("/sys/devices/system/cpu/cpu*/cpufreq/scaling_governor"):
         try:
-            out[p] = open(p).read().strip()
+            out[p] = read_text(p).strip()
         except OSError:
+            # this CPU went offline between the glob and the read: skip it
             pass
     return out
 
@@ -400,7 +401,7 @@ def t_cpu_gov(ctx, h):
                 finally:
                     _ok(h("cpu-cores-set", cores=[{"core": c["core"], "online": True}]), "core on")
                 time.sleep(2)   # the udev rule runs asynchronously
-                back = {open("/sys/devices/system/cpu/cpu%d/cpufreq/scaling_governor" % x["cpu"]).read().strip()
+                back = {read_text("/sys/devices/system/cpu/cpu%d/cpufreq/scaling_governor" % x["cpu"]).strip()
                         for x in c["cpus"]}
                 check(back == {other}, "core %d came back on %s, not %s: the udev rule did not apply it"
                       % (c["core"], sorted(back), other))
@@ -468,11 +469,11 @@ def t_fan(ctx, h, azione, path):
     helper: accepted, and nothing the user set comes back different."""
     if not os.path.exists(path):
         raise Skip("%s does not exist here" % path)
-    before = json.load(open(path))
+    before = read_json(path)
     fand_on = sh("systemctl is-active skillfish-fand.service", 10)[1].strip() == "active"
     with preserved(path):
         _ok(h("ventola", azione=azione, dati=before, timeout=240), "ventola %s" % azione)
-        after = json.load(open(path))
+        after = read_json(path)
         diff = _same_where_both(before, after)
         check(not diff, "values changed on the way through the helper:\n" + "\n".join(diff[:20]))
     # the daemon read the rewritten file: give it the original bytes back
 
@@ -1,10 +1,9 @@
 """The installed system as a whole: packages, dpkg and apt, systemd units,
 AppStream cards and menu entries."""
-import glob
 import os
 import re
 
-from common import Skip, check, files_of, our_packages, sh
+from common import Skip, check, files_of, our_packages, read_text, sh
 
 # Packages that carry an upstream version rather than ours (YY.MM.N).
 UPSTREAM_VERSIONED = ("skillfish-vkpeak", "skillfish-mesa-gfx1013", "skillfish-vaapi-encoder",
@@ -116,7 +115,7 @@ def t_desktop_entries(ctx):
         for f in files_of(p):
             if f.endswith(".desktop") and os.path.isfile(f):
                 n += 1
-                for line in open(f, encoding="utf-8", errors="replace"):
+                for line in read_text(f).splitlines():
                     if line.startswith(("Exec=", "TryExec=")):
                         prog = line.split("=", 1)[1].strip().split()[0] if line.split("=", 1)[1].strip() else ""
                         prog = prog.strip('"')
 
@@ -1,5 +1,6 @@
 """Small shared pieces of the release check."""
 import contextlib
+import json
 import os
 import subprocess
 
@@ -29,6 +30,17 @@ def check(cond, msg):
         raise AssertionError(msg)
 
 
+def read_text(path):
+    """A whole file, closed at once (CodeQL py/file-not-closed)."""
+    with open(path, encoding="utf-8", errors="replace") as f:
+        return f.read()
+
+
+def read_json(path):
+    with open(path, encoding="utf-8") as f:
+        return json.load(f)
+
+
 def our_packages():
     """Installed packages that are ours: skillfish-*, skillfishos-*."""
     rc, out, _ = sh("dpkg-query -W -f='${db:Status-Abbrev} ${Package} ${Version}\\n'", 30)