Chore: resolve aislop findings across codebase

.aislop/config.yml

@@ -0,0 +1,28 @@
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The Linux Foundation
+
+# aislop quality gate configuration.
+#
+# The pre-commit hook and CI both run `aislop ci` against this config.
+# Overly long functions and deeply nested code are refactored in the
+# source tree into focused helpers rather than suppressed.
+#
+# maxFileLoc is raised from the 400 default to 900: this codebase is
+# organised into cohesive single-responsibility modules (SSH discovery
+# and setup, gerrit REST/query, reconciliation, config, etc.) that
+# naturally sit in the 450-900 line range. 900 still flags egregiously
+# oversized modules.
+#
+# Three orchestration god-files remain above this threshold: core.py,
+# cli.py and gerrit_pr_closer.py. Their overly long functions and deep
+# nesting are decomposed here, but a full module/class split is a large,
+# self-contained refactor tracked as dedicated follow-up work; each
+# carries an in-file `aislop-ignore-file complexity/file-too-large` with
+# that rationale so the gate stays green in the meantime.
+version: 1
+
+quality:
+  maxFileLoc: 900
+
+ci:
+  failBelow: 100

.pre-commit-config.yaml

@@ -3,7 +3,11 @@
 # SPDX-FileCopyrightText: 2025 The Linux Foundation
 
 ci:
-  skip: [pytest, gha-workflow-linter]
+  # pre-commit.ci sandbox prevents network calls; aislop runs engines
+  # that can call the network at scan time, so it cannot run there
+  # either. gha-workflow-linter validates action calls over the
+  # network; pytest runs the full suite.
+  skip: [pytest, gha-workflow-linter, aislop]
   autofix_commit_msg: |
     Chore: pre-commit autofixes
 
@@ -125,6 +129,22 @@ repos:
     hooks:
       - id: gha-workflow-linter
 
+  # Catch AI slop developer-side before it reaches a pull request.
+  # Runs the full-repository quality gate, scored against
+  # .aislop/config.yml. A local hook installing the published npm
+  # package: the scanaislop/aislop git repository does not ship the
+  # built dist/, so its bundled pre-commit hook cannot install. Bump
+  # the pinned version here manually when new aislop releases ship.
+  - repo: local
+    hooks:
+      - id: aislop
+        name: aislop
+        entry: aislop ci --human
+        language: node
+        additional_dependencies: ["aislop@0.13.1"]
+        pass_filenames: false
+        always_run: true
+
   - repo: https://github.com/python-jsonschema/check-jsonschema
     rev: 1a4bb160cab6417b3045e1b37b6b72449243e658  # frozen: 0.37.4
     hooks:

sitecustomize.py

@@ -55,6 +55,7 @@ def _debug_enabled() -> bool:
 def _dbg(msg: str) -> None:
     if _debug_enabled():
         try:
+            # aislop-ignore-next-line python-print-debug -- gated debug logger
             print(f"[sitecustomize] {msg}", file=sys.stderr)
         except Exception:
             # Debug logging must never disrupt interpreter startup; if
@@ -90,17 +91,17 @@ def _clean_stale_coverage_files(
     for base in bases:
         try:
             base = base.resolve()
-        except Exception:
+        except Exception as exc:
             # Use as-is if resolution fails
-            pass
+            _dbg(f"Failed to resolve base {base}: {exc}")
         for candidate in _iter_cov_candidates(base):
             try:
                 # Skip the protected target if present in candidates
                 if protected and str(candidate.resolve()) == protected:
                     continue
-            except Exception:
+            except Exception as exc:
                 # If resolve fails, fall through and try to remove
-                pass
+                _dbg(f"Failed to resolve candidate {candidate}: {exc}")
             _remove_path(candidate)
 
 
@@ -110,9 +111,9 @@ def _ensure_unique_coverage_file() -> Path:
     if existing:
         try:
             return Path(existing)
-        except Exception:
+        except Exception as exc:
             # Fall through to create a sane default
-            pass
+            _dbg(f"Invalid COVERAGE_FILE {existing!r}: {exc}")
     unique = (
         Path(tempfile.gettempdir())
         / f".coverage.pytest.{os.getpid()}.{uuid.uuid4().hex}"