Merge pull request #7 from eccenca/feature/updateTemplate

update to cmem-plugin-template v9.10.0

Author: seebi

.claude/rules/copier-template.md

@@ -60,6 +60,14 @@ reason above it. Neither escape ruff suggests is available, since keyword-only
 arguments answer `PLR0917` but not `PLR0913`, and folding the arguments into
 one object breaks the one-argument-per-option mapping the framework relies on.
 
+`ARG002` is settled on the same grounds, one argument further in: a method the
+framework calls has the signature the framework declares, so an argument the
+implementation does not need cannot be dropped - a workflow task with no input
+ports never reads `inputs`. Suppress it on the argument, again with the reason
+above it. Renaming it to `_inputs` silences ruff as well, and is wrong here:
+the name belongs to an API the caller may use by keyword, as this project's own
+tests do.
+
 ## Every user visible change gets a changelog entry
 
 `CHANGELOG.md` follows [Keep a Changelog](https://keepachangelog.com/). Add an

.claude/skills/plugin-implementation/SKILL.md

@@ -350,6 +350,33 @@ start failing on it without anything in the task changing. Suppress it on the
 constructor only - it stays a real finding on an ordinary function, which is
 why it is not in the `ignore` list in `pyproject.toml`.
 
+## An argument the task never reads
+
+`ARG002` complains about an unused method argument, and a task declaring
+`FixedNumberOfInputs([])` generates its own entities - so `execute()` never
+reads `inputs`, while `WorkflowPlugin` decides the signature all the same. A
+`TransformPlugin` or a `PluginAction` ignoring an argument the framework
+supplies is the same case.
+
+This is the standing exception the lint rules describe, so it needs no fresh
+decision either. Suppress the code on the argument, with the reason above it:
+
+```python
+def execute(
+    self,
+    # This task has no input ports, so it never reads inputs - but the
+    # signature is the one WorkflowPlugin declares.
+    inputs: Sequence[Entities],  # noqa: ARG002
+    context: ExecutionContext,
+) -> Entities:
+```
+
+Do not rename it to `_inputs` instead. Ruff accepts the underscore and mypy
+permits the rename, but the name is part of the API the caller uses:
+`execute(inputs=(), context=TestExecutionContext())` is a keyword call, which is
+how `tests/test_example.py` and the `plugin-testing` skill invoke a task, and it
+raises `TypeError` against a renamed argument.
+
 ## Parameters that carry secrets
 
 A password, token or API key is typed, never a plain string:

.copier-answers.yml

@@ -1,5 +1,5 @@
 # Changes here will be overwritten by Copier
-_commit: v9.9.0
+_commit: v9.10.0
 _src_path: gh:eccenca/cmem-plugin-template
 author_mail: cmempy-developer@eccenca.com
 author_name: eccenca GmbH

Taskfile.yaml

@@ -164,10 +164,14 @@ tasks:
     deps:
       - prepare
     cmds:
+      # .claude/ is skipped because a git worktree created there is a second
+      # checkout inside the repository, whose lock file is scanned as if it
+      # were this one - on an older branch, with older findings.
       - >
         poetry run trivy fs
         --include-dev-deps
         --scanners vuln
+        --skip-dirs .claude
         --skip-files .poetry/plugins/poetry.lock
         --exit-code 1
         .
@@ -177,7 +181,12 @@ tasks:
     deps:
       - prepare
     cmds:
-      - poetry run deptry .
+      # deptry's default excludes cover a tests directory at the root but not
+      # a nested copy of one, so the worktree described above would be read as
+      # source and its test imports reported.
+      - >
+        poetry run deptry .
+        --extend-exclude '\.claude'
 
   check:ruff:
     desc: Complain about everything else

poetry.lock

@@ -42,7 +42,7 @@ pytest-dotenv = "^0.5.2"
 pytest-html = "^4.2.0"
 pytest-memray = { version = "^1.10.0",  markers = "platform_system != 'Windows'" }
 ruff = "^0.16.2"
-trivy-py-ecc = "^0.73.0.1"
+trivy-py-ecc = "^0.76.0.1"
 
 [build-system]
 requires = ["poetry-core>=1.0.0", "poetry-dynamic-versioning"]