timothyswan/ruff repository overview

ruff⁠ is an extremely fast Python linter and formatter written in Rust. It implements rules from flake8, isort, pyupgrade, and many other tools in a single binary, and includes a formatter compatible with Black. Ruff distributes as a Python wheel containing a compiled native binary — no Python runtime overhead at lint time.

This image installs ruff from its manylinux wheel against Python 3.13 RHHI layers. The built image is cosign-signed with a CycloneDX SBOM and SLSA Level 3 provenance attestation attached.

⁠Usage

# Check a Python file or directory
podman run --rm -v "$(pwd):/work:ro,Z" ruff:<version>-rhhi check /work

# Format check (non-destructive)
podman run --rm -v "$(pwd):/work:ro,Z" ruff:<version>-rhhi format --check /work

# JSON output for machine parsing
podman run --rm -v "$(pwd):/work:ro,Z" ruff:<version>-rhhi check --output-format json /work

⁠Supply chain

• Base images: registry.access.redhat.com/hi/python:3.13-builder (build) and hi/python:3.13 (runtime) — Red Hat Hardened
• Binary: compiled Rust binary distributed as a manylinux wheel; hash-pinned
• Tier: 3 (Python wheel packaging a native Rust binary)
• Signed: cosign key-only signature (no Rekor transparency log)
• SBOM: CycloneDX JSON attached as OCI attestation
• Provenance: SLSA Level 3 attached as OCI attestation