Simplify targets; add Dependabot GHA config; address other review com…

…ments

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -6,18 +6,13 @@ on: [push, pull_request]
 jobs:
   checks:
     runs-on: ubuntu-latest
-    # We use a standard Debian image to mirror a typical developer environment.
-    # This should be updated whenever a new Debian stable version is available.
     container: debian:bullseye
     steps:
       - uses: actions/checkout@v4
       - name: Install dependencies
         run: |
           apt-get update && apt-get install --yes --no-install-recommends make python3-pip
           pip install -r test-requirements.txt
-      - name: Run lint check
+      - name: Run lint checks
         run: |
-          make check-lint
-      - name: Run format check
-        run: |
-          make check-format
+          make lint

Makefile

@@ -1,20 +1,14 @@
 DEFAULT_GOAL: help
 SHELL := /bin/bash
 
-.PHONY: check-lint
-check-lint:
+.PHONY: lint
+lint:
 	@ruff check .
-
-.PHONY: fix-lint
-fix-lint:
-	@ruff check . --fix
-
-.PHONY: check-format
-check-format:
 	@ruff format --check .
 
-.PHONY: fix-format
-fix-format:
+.PHONY: fix
+fix:
+	@ruff check . --fix
 	@ruff format .
 
 .PHONY: securedrop-proxy

pyproject.toml

@@ -42,8 +42,6 @@ ignore = [
     "SIM108",
     # Flags any subprocess use
     "S603",
-    # Ruff formatter makes a best effort, but may result in some lines exceeding 100 characters
-    "E501",
 ]
 
 [tool.ruff.lint.per-file-ignores]

tests/test_reproducible_wheels.py

@@ -22,8 +22,8 @@ def test_wheel_builds_match_version_control(name):
         ]
     )
     build_cmd = (
-        f"./scripts/build-sync-wheels --pkg-dir /tmp/monorepo-{name}/{name} --project securedrop-{name}"
-        " --clobber".split()
+        f"./scripts/build-sync-wheels --pkg-dir /tmp/monorepo-{name}/{name} "
+        "--project securedrop-{name} --clobber".split()
     )
     subprocess.check_call(build_cmd)
     # Check for modified files (won't catch new, untracked files)