Add per-file ignores and update tags - #13

src/safelint/core/engine.py (2)

189-205: Docstring is now stale — check_file also applies per_file_ignores, and suppressed now counts both sources.

The docstring still describes only inline # nosafe suppression and says suppressed reflects only those filtered out "by an inline # nosafe directive". That's no longer accurate: lines 235–236 add a second filtering pass, and both contribute to LintResult.suppressed. The fail_fast description is also now about after_pfi rather than only the # nosafe remainder.

📝 Suggested docstring update

-        Violations on lines that carry a ``# nosafe`` comment (optionally
-        followed by a comma-separated list of codes / rule names) are filtered
-        out and counted in :attr:`LintResult.suppressed` instead of appearing
-        in :attr:`LintResult.violations`.
-
-        When ``fail_fast`` is enabled the loop stops after the first rule that
-        produces at least one unsuppressed (active) violation, i.e. a violation
-        that is not filtered out by an inline ``# nosafe`` directive.
+        Violations are filtered in two passes and counted in
+        :attr:`LintResult.suppressed` instead of appearing in
+        :attr:`LintResult.violations`:
+
+        1. Inline ``# nosafe`` comments on the violation's line (optionally
+           followed by a comma-separated list of codes / rule names).
+        2. Rule codes / names listed under any ``per_file_ignores`` glob
+           pattern that matches *filepath*.
+
+        When ``fail_fast`` is enabled the loop stops after the first rule
+        that produces at least one violation surviving both filters.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/safelint/core/engine.py` around lines 189 - 205, Update the check_file
docstring to reflect that suppression comes from both inline "# nosafe"
directives and per_file_ignores: state that violations filtered by either
mechanism are counted in LintResult.suppressed, and clarify that when fail_fast
is enabled the loop stops after the first rule that produces at least one
unsuppressed violation after applying per_file_ignores (i.e., after the second
filtering pass). Mention the names per_file_ignores and LintResult.suppressed in
the text so readers can locate the relevant behavior.

---

170-171: Consider validating and warning on unknown entries in per_file_ignores, and splitting the comprehension for readability.

Two small points on this initializer:

1. Consistency with ignore. Lines 141–146 above emit a _log.warning(...) when the global ignore list contains entries that match neither a known rule name nor a known code (typo / stale rule). The same class of bug silently no-ops here — a misspelled "SAFE1O1" in per_file_ignores never fires. Reusing the existing known_names / known_codes_upper sets for per-file entries would catch these cleanly.
2. Robustness. If a user writes per_file_ignores = ["SAFE101"] (list instead of mapping) or "tests/**" = "SAFE101" (bare string instead of list), the current code will raise AttributeError / TypeError from deep inside the engine constructor rather than a friendly config error. A type-check on raw_pfi / entries would fail fast with a clear message.
3. Nit. The single comprehension packs three responsibilities into one line; wrapping it makes the (pattern, names, codes_upper) shape obvious.

♻️ Proposed refactor

-        raw_pfi: dict[str, list[str]] = config.get("per_file_ignores", {})
-        self.per_file_ignores: list[tuple[str, frozenset[str], frozenset[str]]] = [(pattern, frozenset(entries), frozenset(e.upper() for e in entries)) for pattern, entries in raw_pfi.items()]
+        raw_pfi: dict[str, list[str]] = config.get("per_file_ignores", {}) or {}
+        if not isinstance(raw_pfi, dict):
+            _log.warning("per_file_ignores must be a mapping of glob → list; got %r — ignoring", type(raw_pfi).__name__)
+            raw_pfi = {}
+        self.per_file_ignores: list[tuple[str, frozenset[str], frozenset[str]]] = []
+        for pattern, entries in raw_pfi.items():
+            entries = list(entries or [])
+            unknown_pfi = frozenset(
+                e for e in entries if e not in known_names and e.upper() not in known_codes_upper
+            )
+            if unknown_pfi:
+                _log.warning(
+                    "Unknown entries in per_file_ignores[%r]: %s",
+                    pattern,
+                    ", ".join(sorted(unknown_pfi)),
+                )
+            self.per_file_ignores.append(
+                (pattern, frozenset(entries), frozenset(e.upper() for e in entries)),
+            )

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/safelint/core/engine.py` around lines 170 - 171, Validate and normalize
per-file ignores by first checking that raw_pfi is a mapping and each entries
value is an iterable of strings, then iterate (not in a single comprehension)
over raw_pfi and for each pattern build (pattern, frozenset(names),
frozenset(codes_upper)) but also check each entry against the existing
known_names and known_codes_upper sets and call _log.warning when an entry
matches neither (similar to the global ignore logic); on type mismatches raise a
clear ValueError/TypeError mentioning invalid per_file_ignores so callers get a
friendly config error instead of an AttributeError deep in the constructor, and
assign the validated list to self.per_file_ignores.

CONFIGURATION.md (1)

184-221: New section reads clearly — one follow-up on glob semantics.

The comparison table at lines 212–218 is a particularly helpful addition. Two small suggestions:

• Consider explicitly stating which glob dialect per_file_ignores (and exclude_paths) use. Today the engine delegates to pathlib.PurePath.match, whose ** semantics differ from glob/shell and only gained recursive support in Python 3.13 — see the separate comment on src/safelint/core/engine.py. Once that is addressed (or if you pin to full_match()), a one-line note like "Patterns follow shell-glob semantics; ** matches any number of path segments" will save users trial-and-error.
• Minor nit: the YAML example (lines 196–206) omits migrations/**'s "src/legacy/**" counterpart shown in the TOML block. Not important, but symmetry helps copy-paste parity.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@CONFIGURATION.md` around lines 184 - 221, Update the CONFIGURATION.md
per_file_ignores section to (1) add a one-line note explaining the glob dialect
used by per_file_ignores and exclude_paths — state that patterns currently
follow Python's pathlib.PurePath.match (shell-glob-like) semantics where "**"
matches any number of path segments (or indicate intent to switch to a
full_match behavior once src/safelint/core/engine.py is changed), and (2) make
the YAML example mirror the TOML example by adding the missing "src/legacy/**"
entry under per_file_ignores so the two examples are symmetric; reference the
per_file_ignores and exclude_paths terminology and pathlib.PurePath.match when
editing the text.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes