Re-enable ruff BLE (blind-except) rule and fix all violations

.specify/feature.json

@@ -1,3 +1,3 @@
 {
-  "feature_directory": "specs/001-entities-arch-migration"
+  "feature_directory": "specs/002-ruff-ble-reenable"
 }

backend/infrahub/api/auth.py

@@ -60,7 +60,8 @@ async def login_user(
             auth_method=AuthMethod.PASSWORD,
         )
         await service.event.send(event=event)
-    except Exception as ex:
+    # Login event emission is best-effort telemetry; it must never fail a successful login
+    except Exception as ex:  # noqa: BLE001
         log.warning(f"Failed to emit login event for account_id={auth_result.account_id}: {str(ex)}")
     return auth_result.token
 
@@ -113,7 +114,8 @@ async def logout(
                 session_id=session_id,
             )
             await service.event.send(event=event)
-        except Exception as ex:
+        # Logout event emission is best-effort telemetry; it must never fail a successful logout
+        except Exception as ex:  # noqa: BLE001
             log.warning(f"Failed to emit logout event for account_id={user_session.account_id}: {str(ex)}")
 
     delete_response_cookies(response=response)

backend/infrahub/api/oauth2.py

@@ -202,7 +202,8 @@ async def token(
             identity_source=provider_name,
         )
         await service.event.send(event=event)
-    except Exception as ex:
+    # Login event emission is best-effort telemetry; it must never fail a successful OAuth2 login
+    except Exception as ex:  # noqa: BLE001
         log.warning(f"Failed to emit OAuth2 login event for account_id={auth_result.account_id}: {str(ex)}")
 
     return models.UserTokenWithUrl(

backend/infrahub/api/oidc.py

@@ -256,7 +256,8 @@ async def token(
             identity_source=provider_name,
         )
         await service.event.send(event=event)
-    except Exception as ex:
+    # Login event emission is best-effort telemetry; it must never fail a successful OIDC login
+    except Exception as ex:  # noqa: BLE001
         log.warning(f"Failed to emit OIDC login event for account_id={auth_result.account_id}: {str(ex)}")
 
     return models.UserTokenWithUrl(

backend/infrahub/artifacts/tasks.py

@@ -46,7 +46,8 @@ async def create(model: CheckArtifactCreate) -> ValidatorConclusion:
         check_message = "Artifact rendered successfully"
         conclusion = ValidatorConclusion.SUCCESS
 
-    except Exception as exc:
+    # Check boundary: any render failure must be recorded as a failed artifact check, not crash the flow
+    except Exception as exc:  # noqa: BLE001
         artifact.status.value = "Error"
         await artifact.save()
         severity = "critical"

backend/infrahub/auth/auth.py

@@ -539,7 +539,8 @@ async def validate_jwt_access_token(token: str) -> AccountSession:
         session_id = payload["session_id"]
     except jwt.ExpiredSignatureError:
         raise AuthorizationError("Expired Signature") from None
-    except Exception:
+    # Fail closed: any undecodable or malformed token must map to a 401 auth error, never a 500
+    except Exception:  # noqa: BLE001
         raise AuthorizationError("Invalid token") from None
 
     if payload["type"] == "access":
@@ -555,7 +556,8 @@ async def validate_jwt_refresh_token(db: InfrahubDatabase, token: str) -> models
         session_id = payload["session_id"]
     except jwt.ExpiredSignatureError:
         raise AuthorizationError("Expired Signature") from None
-    except Exception:
+    # Fail closed: any undecodable or malformed refresh token must map to a 401, never a 500
+    except Exception:  # noqa: BLE001
         raise AuthorizationError("Invalid token") from None
 
     await validate_active_account(db=db, account_id=str(account_id))
@@ -665,7 +667,8 @@ def safe_get_response_body(response: httpx.Response, raise_error_on_empty_body:
     # Try to parse as JSON first
     try:
         return response.json()
-    except Exception as json_error:
+    # Providers may return non-JSON bodies: fall back to text or fail closed with GatewayError (502)
+    except Exception as json_error:  # noqa: BLE001
         try:
             # Try to get as text
             text_body = response.text
@@ -676,7 +679,8 @@ def safe_get_response_body(response: httpx.Response, raise_error_on_empty_body:
                     status_code=response.status_code,
                 )
                 raise GatewayError(message="Authentication provider returned an empty response") from json_error
-        except Exception:
+        # If the body cannot be read at all, fail closed with GatewayError (502) rather than a 500
+        except Exception:  # noqa: BLE001
             log.error(
                 "Unable to read response body from authentication provider",
                 url=str(response.url),

backend/infrahub/cli/upgrade.py

@@ -62,7 +62,8 @@ async def validate_prerequisites(db: InfrahubDatabase) -> bool:
     except DatabaseError as exc:
         console.log(f"{ERROR_BADGE} Database prerequisite check failed: {exc}")
         return False
-    except Exception as exc:
+    # CLI prerequisite boundary: report any failure as an unreachable database and abort cleanly
+    except Exception as exc:  # noqa: BLE001
         console.log(f"{ERROR_BADGE} Database is unreachable: {exc}")
         console.log(
             "  Verify that the database is running and that the connection settings in your configuration file are correct."
@@ -241,7 +242,8 @@ async def _upgrade_check(db: InfrahubDatabase, root_node_graph_version: int) ->
             console.log("  Schema has differences, update required")
         else:
             console.log("  Up to date, nothing to do")
-    except Exception as exc:
+    # Best-effort dry-run report: a failed schema probe is reported inline and the remaining checks still run
+    except Exception as exc:  # noqa: BLE001
         console.log(f"  Unable to check: {exc}")
 
     console.log("\nBranches:")

backend/infrahub/core/migrations/graph/m014_remove_index_attr_value.py

@@ -36,7 +36,8 @@ async def execute(self, migration_input: MigrationInput) -> MigrationResult:
             index_manager = IndexManagerNeo4j(db=db)
             index_manager.init(nodes=[INDEX_TO_DELETE], rels=[])
             await index_manager.drop()
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             result.errors.append(str(exc))
             return result
 

backend/infrahub/core/migrations/graph/m029_duplicates_cleanup.py

@@ -653,7 +653,8 @@ async def execute(self, migration_input: MigrationInput) -> MigrationResult:
             duplicate_relationships_cleanup_query = await DeleteDuplicateRelationships.init(db=db)
             await duplicate_relationships_cleanup_query.execute(db=db)
 
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             migration_result.errors.append(str(exc))
             return migration_result
 

backend/infrahub/core/migrations/graph/m036_drop_attr_value_index.py

@@ -36,7 +36,8 @@ async def execute(self, migration_input: MigrationInput) -> MigrationResult:
             index_manager = IndexManagerNeo4j(db=db)
             index_manager.init(nodes=[INDEX_TO_DELETE], rels=[])
             await index_manager.drop()
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             result.errors.append(str(exc))
             return result
 

backend/infrahub/core/migrations/graph/m043_create_hfid_display_label_in_db.py

@@ -113,7 +113,8 @@ async def execute(self, migration_input: MigrationInput) -> MigrationResult:
                     execution_result = await migration.execute(migration_input=migration_input, branch=default_branch)
                     result.errors.extend(execution_result.errors)
                     progress.update(update_task, advance=1)
-                except Exception as exc:
+                # First failing sub-migration is recorded as a result error and aborts the remaining steps
+                except Exception as exc:  # noqa: BLE001
                     result.errors.append(str(exc))
                     return result
 
@@ -165,7 +166,8 @@ async def execute_against_branch(self, migration_input: MigrationInput, branch:
                     execution_result = await migration.execute(migration_input=migration_input, branch=branch)
                     result.errors.extend(execution_result.errors)
                     progress.update(update_task, advance=1)
-                except Exception as exc:
+                # First failing sub-migration is recorded as a result error and aborts the remaining steps
+                except Exception as exc:  # noqa: BLE001
                     result.errors.append(str(exc))
                     return result
 

backend/infrahub/core/migrations/graph/m044_backfill_hfid_display_label_in_db.py

@@ -379,7 +379,8 @@ async def execute(self, migration_input: MigrationInput) -> MigrationResult:
                         update_task=update_task,
                     )
 
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             return MigrationResult(errors=[str(exc)])
         return MigrationResult()
 
@@ -511,6 +512,7 @@ async def execute_against_branch(self, migration_input: MigrationInput, branch:
                         at=at,
                     )
 
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             return MigrationResult(errors=[str(exc)])
         return MigrationResult()

backend/infrahub/core/migrations/graph/m045_backfill_hfid_display_label_in_db_profile_template.py

@@ -79,7 +79,8 @@ async def execute(self, migration_input: MigrationInput) -> MigrationResult:
                         update_task=update_task,
                     )
 
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             return MigrationResult(errors=[str(exc)])
         return MigrationResult()
 
@@ -160,6 +161,7 @@ async def execute_against_branch(self, migration_input: MigrationInput, branch:
                         at=at,
                     )
 
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             return MigrationResult(errors=[str(exc)])
         return MigrationResult()

backend/infrahub/core/migrations/graph/m046_fill_agnostic_hfid_display_labels.py

@@ -138,7 +138,8 @@ async def _do_one_schema_all(
     async def execute(self, migration_input: MigrationInput) -> MigrationResult:
         try:
             return await self._do_execute(migration_input=migration_input)
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             return MigrationResult(errors=[str(exc)])
 
     async def _do_execute(self, migration_input: MigrationInput) -> MigrationResult:
@@ -193,7 +194,8 @@ async def _do_execute(self, migration_input: MigrationInput) -> MigrationResult:
                     execution_result = await migration.execute(migration_input=migration_input, branch=global_branch)
                     result.errors.extend(execution_result.errors)
                     progress.update(update_task, advance=1)
-                except Exception as exc:
+                # First failing sub-migration is recorded as a result error and aborts the remaining steps
+                except Exception as exc:  # noqa: BLE001
                     result.errors.append(str(exc))
                     return result
 

backend/infrahub/core/migrations/graph/m047_backfill_or_null_display_label.py

@@ -413,7 +413,8 @@ async def execute(self, migration_input: MigrationInput) -> MigrationResult:
                             update_task=backfill_task,
                         )
 
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             return MigrationResult(errors=[str(exc)])
         return MigrationResult()
 
@@ -462,6 +463,7 @@ async def execute_against_branch(self, migration_input: MigrationInput, branch:
                     at=at,
                 )
 
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             return MigrationResult(errors=[str(exc)])
         return MigrationResult()

backend/infrahub/core/migrations/graph/m059_fix_hfid_display_label_nulls.py

@@ -235,7 +235,8 @@ async def _compute_values_for_batch(
                     value = await self._compute_display_label(db=db, schema=schema, node=node, console=console)
                     if value is not None:
                         dl_values[node_uuid] = value
-                except Exception as exc:
+                # Best-effort per-node recompute: record the failure, skip this node, keep fixing the rest
+                except Exception as exc:  # noqa: BLE001
                     console.print(f"  Skipping display_label for {node_uuid} ({kind}): {exc}")
                     errors.append(f"display_label compute failed for {node_uuid} ({kind}): {exc}")
 
@@ -244,7 +245,8 @@ async def _compute_values_for_batch(
                     value = await self._compute_hfid(db=db, schema=schema, node=node, console=console)
                     if value is not None:
                         hfid_values[node_uuid] = value
-                except Exception as exc:
+                # Best-effort per-node recompute: record the failure, skip this node, keep fixing the rest
+                except Exception as exc:  # noqa: BLE001
                     console.print(f"  Skipping human_friendly_id for {node_uuid} ({kind}): {exc}")
                     errors.append(f"human_friendly_id compute failed for {node_uuid} ({kind}): {exc}")
 
@@ -378,7 +380,8 @@ async def execute(self, migration_input: MigrationInput) -> MigrationResult:
                 else:
                     console.print("No nodes with bad values found on global branch")
 
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             result.errors.append(str(exc))
 
         return result
@@ -417,5 +420,6 @@ async def execute_against_branch(self, migration_input: MigrationInput, branch:
                     progress=progress,
                     progress_task=task,
                 )
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             return MigrationResult(errors=[str(exc)])

backend/infrahub/core/migrations/graph/m062_recompute_permission_display_labels.py

@@ -451,7 +451,8 @@ async def execute(self, migration_input: MigrationInput) -> MigrationResult:
                         update_task=update_task,
                     )
 
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             error_msg = str(exc) or f"{type(exc).__name__}: {repr(exc)}"
             return MigrationResult(errors=[error_msg])
 
@@ -470,7 +471,8 @@ async def execute_against_branch(self, migration_input: MigrationInput, branch:
             await self._compute_object_permission_display_labels(
                 db=db, branch=branch, attribute_schema=display_label_attribute_schema, console=console
             )
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             error_msg = str(exc) or f"{type(exc).__name__}: {repr(exc)}"
             return MigrationResult(errors=[error_msg])
 

backend/infrahub/core/migrations/graph/m063_template_number_pool_cleanup.py

@@ -79,7 +79,8 @@ async def _process_templates(
                     )
                     await query.execute(db=db)
 
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             error_msg = str(exc) or f"{type(exc).__name__}: {repr(exc)}"
             return MigrationResult(errors=[error_msg])
 

backend/infrahub/core/migrations/graph/m064_template_ip_pool_relationship_cleanup.py

@@ -95,7 +95,8 @@ async def _process_templates(
                         migration_input=migration_input,
                     )
 
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             error_msg = str(exc) or f"{type(exc).__name__}: {repr(exc)}"
             return MigrationResult(errors=[error_msg])
 

backend/infrahub/core/migrations/graph/m066_consolidate_duplicate_number_pools.py

@@ -79,7 +79,8 @@ async def execute(self, migration_input: MigrationInput) -> MigrationResult:
 
                 await self._update_schema_parameters(db=dbt, pool_id_map=pool_id_map, console=console)
 
-            except Exception as exc:
+            # Failures become MigrationResult errors so the runner reports them instead of crashing
+            except Exception as exc:  # noqa: BLE001
                 error_msg = str(exc) or f"{type(exc).__name__}: {repr(exc)}"
                 return MigrationResult(errors=[error_msg])
 

backend/infrahub/core/migrations/graph/m070_normalize_mac_address_values_to_colon.py

@@ -222,7 +222,8 @@ async def _run(
                     display_label_attribute_schema=display_label_attribute_schema,
                     at=at,
                 )
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             return MigrationResult(errors=[str(exc) or f"{type(exc).__name__}: {repr(exc)}"])
 
         return MigrationResult()

backend/infrahub/core/migrations/graph/m071_recompute_hfid_for_ip_attributes.py

@@ -177,7 +177,8 @@ async def _run(
                     display_label_attribute_schema=display_label_attribute_schema,
                     at=at,
                 )
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             return MigrationResult(errors=[str(exc) or f"{type(exc).__name__}: {repr(exc)}"])
 
         return MigrationResult()

backend/infrahub/core/migrations/graph/m072_index_hfid_values.py

@@ -166,7 +166,8 @@ async def execute(self, migration_input: MigrationInput) -> MigrationResult:
         try:
             await self._normalize_hfid_values(db=db)
             await self._index_hfid_values(db=db)
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             return MigrationResult(errors=[str(exc)])
 
         return MigrationResult()

backend/infrahub/core/migrations/graph/m073_unify_ip_pool_resource_identifier.py

@@ -333,7 +333,8 @@ async def execute(self, migration_input: MigrationInput) -> MigrationResult:
                 await self._bootstrap_core_ip_pool_generic(db=dbt, at=schema_root_at, user_id=user_id)
                 await self._append_inherit_from_for_all_pools(db=dbt)
                 await self._rewrite_resource_relationship_attributes(db=dbt)
-            except Exception as exc:
+            # Failures become MigrationResult errors so the runner reports them instead of crashing
+            except Exception as exc:  # noqa: BLE001
                 error_msg = str(exc) or f"{type(exc).__name__}: {exc!r}"
                 return MigrationResult(errors=[error_msg])
 

backend/infrahub/core/migrations/graph/m074_normalize_indexed_hfid_values.py

@@ -153,7 +153,8 @@ async def execute(self, migration_input: MigrationInput) -> MigrationResult:
         db = migration_input.db
         try:
             await self._normalize_hfid_values(db=db)
-        except Exception as exc:
+        # Migration contract: failures become MigrationResult errors; the runner reports them and halts
+        except Exception as exc:  # noqa: BLE001
             return MigrationResult(errors=[str(exc)])
 
         return MigrationResult()