chore: Bump ruff from 0.12.12 to 0.13.0 (#780)

Bumps [ruff](https://github.com/astral-sh/ruff) from 0.12.12 to 0.13.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<h2>Release Notes</h2>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.13.0">blog
post</a> for a migration guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p><strong>Several rules can now add <code>from __future__ import
annotations</code> automatically</strong></p>
<p><code>TC001</code>, <code>TC002</code>, <code>TC003</code>,
<code>RUF013</code>, and <code>UP037</code> now add <code>from
__future__ import annotations</code> as part of their fixes when the
<code>lint.future-annotations</code> setting is enabled. This allows the
rules to move more imports into <code>TYPE_CHECKING</code> blocks
(<code>TC001</code>, <code>TC002</code>, and <code>TC003</code>), use
PEP 604 union syntax on Python versions before 3.10
(<code>RUF013</code>), and unquote more annotations
(<code>UP037</code>).</p>
</li>
<li>
<p><strong>Full module paths are now used to verify first-party
modules</strong></p>
<p>Ruff now checks that the full path to a module exists on disk before
categorizing it as a first-party import. This change makes first-party
import detection more accurate, helping to avoid false positives on
local directories with the same name as a third-party dependency, for
example. See the <a
href="https://docs.astral.sh/ruff/faq/#how-does-ruff-determine-which-of-my-imports-are-first-party-third-party-etc">FAQ
section</a> on import categorization for more details.</p>
</li>
<li>
<p><strong>Deprecated rules must now be selected by exact rule
code</strong></p>
<p>Ruff will no longer activate deprecated rules selected by their group
name or prefix. As noted below, the two remaining deprecated rules were
also removed in this release, so this won't affect any current rules,
but it will still affect any deprecations in the future.</p>
</li>
<li>
<p><strong>The deprecated macOS configuration directory fallback has
been removed</strong></p>
<p>Ruff will no longer look for a user-level configuration file at
<code>~/Library/Application Support/ruff/ruff.toml</code> on macOS. This
feature was deprecated in v0.5 in favor of using the <a
href="https://specifications.freedesktop.org/basedir-spec/latest/">XDG
specification</a> (usually resolving to
<code>~/.config/ruff/ruff.toml</code>), like on Linux. The fallback and
accompanying deprecation warning have now been removed.</p>
</li>
</ul>
<h3>Removed Rules</h3>
<p>The following rules have been removed:</p>
<ul>
<li><a
href="https://docs.astral.sh/ruff/rules/pandas-df-variable-name"><code>pandas-df-variable-name</code></a>
(<code>PD901</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/non-pep604-isinstance"><code>non-pep604-isinstance</code></a>
(<code>UP038</code>)</li>
</ul>
<h3>Stabilization</h3>
<p>The following rules have been stabilized and are no longer in
preview:</p>
<ul>
<li><a
href="https://docs.astral.sh/ruff/rules/airflow-dag-no-schedule-argument"><code>airflow-dag-no-schedule-argument</code></a>
(<code>AIR002</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/airflow3-removal"><code>airflow3-removal</code></a>
(<code>AIR301</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/airflow3-moved-to-provider"><code>airflow3-moved-to-provider</code></a>
(<code>AIR302</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/airflow3-suggested-update"><code>airflow3-suggested-update</code></a>
(<code>AIR311</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/airflow3-suggested-to-move-to-provider"><code>airflow3-suggested-to-move-to-provider</code></a>
(<code>AIR312</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/long-sleep-not-forever"><code>long-sleep-not-forever</code></a>
(<code>ASYNC116</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/f-string-number-format"><code>f-string-number-format</code></a>
(<code>FURB116</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/os-symlink"><code>os-symlink</code></a>
(<code>PTH211</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/generic-not-last-base-class"><code>generic-not-last-base-class</code></a>
(<code>PYI059</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/redundant-none-literal"><code>redundant-none-literal</code></a>
(<code>PYI061</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/pytest-raises-ambiguous-pattern"><code>pytest-raises-ambiguous-pattern</code></a>
(<code>RUF043</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/unused-unpacked-variable"><code>unused-unpacked-variable</code></a>
(<code>RUF059</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/useless-class-metaclass-type"><code>useless-class-metaclass-type</code></a>
(<code>UP050</code>)</li>
</ul>
<p>The following behaviors have been stabilized:</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.13.0</h2>
<p>Check out the <a href="https://astral.sh/blog/ruff-v0.13.0">blog
post</a> for a migration
guide and overview of the changes!</p>
<h3>Breaking changes</h3>
<ul>
<li>
<p><strong>Several rules can now add <code>from __future__ import
annotations</code> automatically</strong></p>
<p><code>TC001</code>, <code>TC002</code>, <code>TC003</code>,
<code>RUF013</code>, and <code>UP037</code> now add <code>from
__future__ import annotations</code> as part of their fixes when the
<code>lint.future-annotations</code> setting is enabled. This allows the
rules to move
more imports into <code>TYPE_CHECKING</code> blocks (<code>TC001</code>,
<code>TC002</code>, and <code>TC003</code>),
use PEP 604 union syntax on Python versions before 3.10
(<code>RUF013</code>), and
unquote more annotations (<code>UP037</code>).</p>
</li>
<li>
<p><strong>Full module paths are now used to verify first-party
modules</strong></p>
<p>Ruff now checks that the full path to a module exists on disk before
categorizing it as a first-party import. This change makes first-party
import detection more accurate, helping to avoid false positives on
local
directories with the same name as a third-party dependency, for example.
See
the <a
href="https://docs.astral.sh/ruff/faq/#how-does-ruff-determine-which-of-my-imports-are-first-party-third-party-etc">FAQ
section</a> on import categorization for more details.</p>
</li>
<li>
<p><strong>Deprecated rules must now be selected by exact rule
code</strong></p>
<p>Ruff will no longer activate deprecated rules selected by their group
name
or prefix. As noted below, the two remaining deprecated rules were also
removed in this release, so this won't affect any current rules, but it
will
still affect any deprecations in the future.</p>
</li>
<li>
<p><strong>The deprecated macOS configuration directory fallback has
been removed</strong></p>
<p>Ruff will no longer look for a user-level configuration file at
<code>~/Library/Application Support/ruff/ruff.toml</code> on macOS. This
feature was
deprecated in v0.5 in favor of using the <a
href="https://specifications.freedesktop.org/basedir-spec/latest/">XDG
specification</a>
(usually resolving to <code>~/.config/ruff/ruff.toml</code>), like on
Linux. The
fallback and accompanying deprecation warning have now been removed.</p>
</li>
</ul>
<h3>Removed Rules</h3>
<p>The following rules have been removed:</p>
<ul>
<li><a
href="https://docs.astral.sh/ruff/rules/pandas-df-variable-name"><code>pandas-df-variable-name</code></a>
(<code>PD901</code>)</li>
<li><a
href="https://docs.astral.sh/ruff/rules/non-pep604-isinstance"><code>non-pep604-isinstance</code></a>
(<code>UP038</code>)</li>
</ul>
<h3>Stabilization</h3>
<p>The following rules have been stabilized and are no longer in
preview:</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/a1fdd66f10a045a574efb20e422868b21decda40"><code>a1fdd66</code></a>
Bump 0.13.0 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/20336">#20336</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/8770b95509b7a5a3b23061d739e6260303613f55"><code>8770b95</code></a>
[ty] introduce <code>DivergentType</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/20312">#20312</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/65982a1e14a15449ea0ed5cf66b7f9dea6d3e82c"><code>65982a1</code></a>
[ty] Use 'unknown' specialization for upper bound on Self (<a
href="https://redirect.github.com/astral-sh/ruff/issues/20325">#20325</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/57d1f7132dbac82e07f22560dbedba7cff1dadc4"><code>57d1f71</code></a>
[ty] Simplify unions of enum literals and subtypes thereof (<a
href="https://redirect.github.com/astral-sh/ruff/issues/20324">#20324</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/7a75702237e6f0bc605d3d8e9470c4ca9f37c69e"><code>7a75702</code></a>
Ignore deprecated rules unless selected by exact code (<a
href="https://redirect.github.com/astral-sh/ruff/issues/20167">#20167</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/9ca632c84fef6ecb7fc810cacb0df801c7949c70"><code>9ca632c</code></a>
Stabilize adding future import via config option (<a
href="https://redirect.github.com/astral-sh/ruff/issues/20277">#20277</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/64fe7d30a3ac9444eab1ed397c451b6c6e80bc6f"><code>64fe7d3</code></a>
[<code>flake8-errmsg</code>] Stabilize extending
<code>raw-string-in-exception</code> (<code>EM101</code>) to ...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/beeeb8d5c5c8dabea2b11b0b8ed0f3c12dbf22c7"><code>beeeb8d</code></a>
Stabilize the remaining Airflow rules (<a
href="https://redirect.github.com/astral-sh/ruff/issues/20250">#20250</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b6fca52855d01dd40904386f5b8a6d4a17caae11"><code>b6fca52</code></a>
[<code>flake8-bugbear</code>] Stabilize support for non-context-manager
calls in `assert...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ac7f882c78db09700bf6bccefe0e9a27fb1696b9"><code>ac7f882</code></a>
[<code>flake8-commas</code>] Stabilize support for trailing comma checks
in type paramet...</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.12.12...0.13.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ruff&package-manager=pip&previous-version=0.12.12&new-version=0.13.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Eran Kampf <eran@ekampf.com>
Co-authored-by: Eran Kampf <205185+ekampf@users.noreply.github.com>

Author: dependabot[bot]

app/api/tests/test_client_connectors.py

@@ -115,7 +115,7 @@ def test_connector_create_failure(
             ],
         )
         with pytest.raises(
-            GraphQLMutationError, match="connectorCreate mutation failed."
+            GraphQLMutationError, match=r"connectorCreate mutation failed."
         ):
             api_client.connector_create(connector_spec)
 
@@ -284,6 +284,6 @@ def test_connector_delete_raises_if_unknown_error(
             ],
         )
         with pytest.raises(
-            GraphQLMutationError, match="connectorDelete mutation failed."
+            GraphQLMutationError, match=r"connectorDelete mutation failed."
         ):
             api_client.connector_delete("some-id")

app/api/tests/test_client_groups.py

@@ -97,7 +97,7 @@ def test_group_create_failure(self, test_url, api_client, mocked_responses):
                 )
             ],
         )
-        with pytest.raises(GraphQLMutationError, match="groupCreate mutation failed."):
+        with pytest.raises(GraphQLMutationError, match=r"groupCreate mutation failed."):
             api_client.group_create(GroupSpec(name=name))
 
     def test_group_update(self, test_url, api_client, mocked_responses):
@@ -151,7 +151,7 @@ def test_group_update_failure(self, test_url, api_client, mocked_responses):
                 )
             ],
         )
-        with pytest.raises(GraphQLMutationError, match="groupUpdate mutation failed."):
+        with pytest.raises(GraphQLMutationError, match=r"groupUpdate mutation failed."):
             api_client.group_update(GroupSpec(id="test-id", name=name))
 
     def test_group_delete(self, test_url, api_client, mocked_responses):
@@ -225,5 +225,5 @@ def test_group_delete_raises_if_unknown_error(
                 )
             ],
         )
-        with pytest.raises(GraphQLMutationError, match="groupDelete mutation failed."):
+        with pytest.raises(GraphQLMutationError, match=r"groupDelete mutation failed."):
             api_client.group_delete("some-id")

app/api/tests/test_client_resource_access.py

@@ -87,7 +87,7 @@ def test_resource_access_add_failure(self, test_url, api_client, mocked_response
         )
 
         with pytest.raises(
-            GraphQLMutationError, match="resourceAccessAdd mutation failed."
+            GraphQLMutationError, match=r"resourceAccessAdd mutation failed."
         ):
             api_client.resource_access_add(
                 resource_id=resource_id,
@@ -219,7 +219,7 @@ def test_resource_access_remove_raises_if_unknown_error(
         )
 
         with pytest.raises(
-            GraphQLMutationError, match="resourceAccessRemove mutation failed."
+            GraphQLMutationError, match=r"resourceAccessRemove mutation failed."
         ):
             api_client.resource_access_remove(
                 resource_id=resource_id, principal_id=principal_id

app/api/tests/test_client_resources.py

@@ -227,7 +227,7 @@ def test_get_invalid_resource(
                 )
             ],
         )
-        with pytest.raises(ValueError, match="Invalid Resource Type: InvalidResource"):
+        with pytest.raises(ValueError, match=r"Invalid Resource Type: InvalidResource"):
             api_client.get_resource(resource.id)
 
     def test_get_resource_with_invalid_b64_id_raises(
@@ -300,7 +300,7 @@ def test_resource_create_failure(
             ],
         )
         with pytest.raises(
-            GraphQLMutationError, match="resourceCreate mutation failed."
+            GraphQLMutationError, match=r"resourceCreate mutation failed."
         ):
             api_client.resource_create(
                 resource_type=ResourceType.NETWORK,
@@ -602,6 +602,6 @@ def test_resource_delete_raises_if_unknown_error(
             ],
         )
         with pytest.raises(
-            GraphQLMutationError, match="resourceDelete mutation failed."
+            GraphQLMutationError, match=r"resourceDelete mutation failed."
         ):
             api_client.resource_delete("some-id")

app/handlers/tests/test_handlers_connector.py

@@ -339,7 +339,7 @@ class TestTwingateConnectorDelete:
     def test_twingate_connector_delete_deletes_connector(
         self, get_connector_and_crd, kopf_handler_runner, mock_api_client
     ):
-        connector, crd = get_connector_and_crd(
+        _connector, crd = get_connector_and_crd(
             status={"twingate_connector_create": {"success": True}}, with_id=True
         )
         kopf_handler_runner(twingate_connector_delete, crd, MagicMock())
@@ -348,14 +348,14 @@ def test_twingate_connector_delete_deletes_connector(
     def test_twingate_connector_delete_without_status_does_nothing(
         self, get_connector_and_crd, kopf_handler_runner, mock_api_client
     ):
-        connector, crd = get_connector_and_crd()
+        _connector, crd = get_connector_and_crd()
         kopf_handler_runner(twingate_connector_delete, crd, MagicMock())
         mock_api_client.connector_delete.assert_not_called()
 
     def test_twingate_connector_pod_reconciler_raises_if_ran_before_create(
         self, get_connector_and_crd, kopf_handler_runner, mock_api_client
     ):
-        connector, crd = get_connector_and_crd()
+        _connector, crd = get_connector_and_crd()
         with pytest.raises(kopf.TemporaryError):
             kopf_handler_runner(twingate_connector_pod_reconciler, crd, MagicMock())
 
@@ -368,7 +368,7 @@ def test_deployment_create(
         k8s_core_client_mock,
         k8s_apps_client_mock,
     ):
-        connector, crd = get_connector_and_crd(
+        _connector, crd = get_connector_and_crd(
             status={"twingate_connector_create": {"success": True}}, with_id=True
         )
 
@@ -385,7 +385,7 @@ def test_deployment_update_if_drift(
         k8s_core_client_mock,
         k8s_apps_client_mock,
     ):
-        connector, crd = get_connector_and_crd(
+        _connector, crd = get_connector_and_crd(
             status={"twingate_connector_create": {"success": True}}, with_id=True
         )
 
@@ -400,7 +400,7 @@ def test_deployment_no_update_if_no_drift(
         k8s_core_client_mock,
         k8s_apps_client_mock,
     ):
-        connector, crd = get_connector_and_crd(
+        _connector, crd = get_connector_and_crd(
             status={"twingate_connector_create": {"success": True}}, with_id=True
         )
 
@@ -433,7 +433,7 @@ def test_no_annotation(
         k8s_apps_client_mock,
         mock_get_image,
     ):
-        connector, crd = get_connector_and_crd(
+        _connector, crd = get_connector_and_crd(
             spec_overrides=dict(image_policy=ConnectorImagePolicy()),
             status={"twingate_connector_create": {"success": True}},
             with_id=True,
@@ -455,7 +455,7 @@ def test_past_due_annotation(
         k8s_apps_client_mock,
         mock_get_image,
     ):
-        connector, crd = get_connector_and_crd(
+        _connector, crd = get_connector_and_crd(
             spec_overrides=dict(image_policy=ConnectorImagePolicy()),
             status={"twingate_connector_create": {"success": True}},
             annotations={ANNOTATION_NEXT_VERSION_CHECK: "2000-01-01T00:00:00Z"},
@@ -479,7 +479,7 @@ def test_not_past_due_annotation(
         mock_get_image,
     ):
         now = pendulum.now("UTC").start_of("minute")
-        connector, crd = get_connector_and_crd(
+        _connector, crd = get_connector_and_crd(
             spec_overrides=dict(image_policy=ConnectorImagePolicy()),
             status={"twingate_connector_create": {"success": True}},
             annotations={ANNOTATION_NEXT_VERSION_CHECK: str(now.add(minutes=1))},
@@ -507,7 +507,7 @@ def test_creates_deployment_if_doesnt_exist(
         mock_get_image,
     ):
         now = pendulum.now("UTC").start_of("minute")
-        connector, crd = get_connector_and_crd(
+        _connector, crd = get_connector_and_crd(
             spec_overrides=dict(image_policy=ConnectorImagePolicy()),
             status={"twingate_connector_create": {"success": True}},
             annotations={ANNOTATION_NEXT_VERSION_CHECK: str(now.add(minutes=1))},

app/handlers/tests/test_handlers_resource_access.py

@@ -34,7 +34,7 @@ def test_id_invalid_spec(self):
         access_crd.principal_external_ref = None
         access_crd.get_group_ref_object.return_value = None
         with pytest.raises(
-            ValueError, match="Missing principal_id or principal_external_ref"
+            ValueError, match=r"Missing principal_id or principal_external_ref"
         ):
             get_principal_id(access_crd, None, MagicMock())
 
@@ -94,7 +94,7 @@ def test_from_external_ref_returns_none(self, mock_api_client):
         mock_api_client.get_service_account_id.return_value = None
 
         with pytest.raises(
-            ValueError, match="Principal serviceAccount sa-name not found"
+            ValueError, match=r"Principal serviceAccount sa-name not found"
         ):
             get_principal_id(access_crd, None, mock_api_client)
 
@@ -106,7 +106,7 @@ def test_from_external_ref_invalid_type_returns_none(self, mock_api_client):
         access_crd.principal_external_ref.type = "invalid"
         access_crd.principal_external_ref.name = "sa-name"
 
-        with pytest.raises(ValueError, match="Unknown principal type: invalid"):
+        with pytest.raises(ValueError, match=r"Unknown principal type: invalid"):
             get_principal_id(access_crd, None, mock_api_client)
 
     def test_from_external_ref_uses_created_status_principal_id(self):

app/handlers/tests/test_handlers_services.py

@@ -229,7 +229,7 @@ def test_kubernetes_resource_type_annotation_without_tls_secret_annotation(
 
         with pytest.raises(
             kopf.PermanentError,
-            match="resource.twingate.com/tlsSecret annotation is not provided",
+            match=r"resource.twingate.com/tlsSecret annotation is not provided",
         ):
             service_to_twingate_resource(
                 example_cluster_ip_gateway_service_body, "default"
@@ -242,7 +242,7 @@ def test_kubernetes_resource_type_annotation_without_k8s_secret_object(
 
         with pytest.raises(
             kopf.PermanentError,
-            match="Kubernetes Secret object: gateway-tls is missing.",
+            match=r"Kubernetes Secret object: gateway-tls is missing.",
         ):
             service_to_twingate_resource(
                 example_cluster_ip_gateway_service_body, "default"
@@ -259,7 +259,7 @@ def test_kubernetes_resource_type_annotation_with_invalid_secret_type(
 
         with pytest.raises(
             kopf.PermanentError,
-            match="Kubernetes Secret object: gateway-tls type is invalid.",
+            match=r"Kubernetes Secret object: gateway-tls type is invalid.",
         ):
             service_to_twingate_resource(
                 example_cluster_ip_gateway_service_body, "default"
@@ -276,7 +276,7 @@ def test_kubernetes_resource_type_annotation_without_ca_cert(
 
         with pytest.raises(
             kopf.PermanentError,
-            match="Kubernetes Secret object: gateway-tls is missing ca.crt.",
+            match=r"Kubernetes Secret object: gateway-tls is missing ca.crt.",
         ):
             service_to_twingate_resource(
                 example_cluster_ip_gateway_service_body, "default"
@@ -295,7 +295,7 @@ def test_kubernetes_resource_type_annotation_with_invalid_ca_cert(
 
         with pytest.raises(
             kopf.PermanentError,
-            match="Kubernetes Secret object: gateway-tls ca.crt is invalid.",
+            match=r"Kubernetes Secret object: gateway-tls ca.crt is invalid.",
         ):
             service_to_twingate_resource(
                 example_cluster_ip_gateway_service_body, "default"
@@ -383,7 +383,7 @@ def test_kubernetes_resource_when_load_balancer_ip_is_not_ready(
             ),
             pytest.raises(
                 kopf.TemporaryError,
-                match="Kubernetes Service: kubernetes-gateway LoadBalancer is not ready.",
+                match=r"Kubernetes Service: kubernetes-gateway LoadBalancer is not ready.",
             ),
         ):
             service_to_twingate_resource(

app/tests/test_crds_connector.py

@@ -109,15 +109,15 @@ def test_deserialization_imagepolicy_fails_on_invalid_version_specifier(
     sample_connector_object_imagepolicy,
 ):
     sample_connector_object_imagepolicy["spec"]["imagePolicy"]["version"] = "invalid"
-    with pytest.raises(ValueError, match="Invalid version specifier"):
+    with pytest.raises(ValueError, match=r"Invalid version specifier"):
         TwingateConnectorCRD(**sample_connector_object_imagepolicy)
 
 
 def test_deserialization_fails_on_invalid_schedule(sample_connector_object_imagepolicy):
     sample_connector_object_imagepolicy["spec"]["imagePolicy"]["schedule"] = (
         "100 2 * * *"
     )
-    with pytest.raises(ValueError, match="Invalid schedule value"):
+    with pytest.raises(ValueError, match=r"Invalid schedule value"):
         TwingateConnectorCRD(**sample_connector_object_imagepolicy)
 
 
@@ -163,7 +163,7 @@ def test_spec_get_image_w_imagepolicy_raises_if_no_match(
             "app.version_policy_providers.DockerhubVersionPolicyProvider.get_all_tags",
             return_value=["1.0.0", "latest"],
         ),
-        pytest.raises(ValueError, match="Could not find valid tag for"),
+        pytest.raises(ValueError, match=r"Could not find valid tag for"),
     ):
         crd.spec.get_image()
 

app/tests/test_crds_resource.py

@@ -192,7 +192,7 @@ def test_deserialization(sample_network_resource_object):
 
 
 def test_is_browser_shortcut_enabled_disallowed_on_wildcard_resource():
-    with pytest.raises(ValueError, match="isBrowserShortcutEnabled"):
+    with pytest.raises(ValueError, match=r"isBrowserShortcutEnabled"):
         TwingateResourceCRD(
             apiVersion="twingate.com/v1",
             kind="TwingateResource",
@@ -206,7 +206,7 @@ def test_is_browser_shortcut_enabled_disallowed_on_wildcard_resource():
 
 
 def test_resourceprotocols_validation():
-    with pytest.raises(ValueError, match="ports can't be set"):
+    with pytest.raises(ValueError, match=r"ports can't be set"):
         TwingateResourceCRD(
             apiVersion="twingate.com/v1",
             kind="TwingateResource",
@@ -222,7 +222,9 @@ def test_resourceprotocols_validation():
 
 
 def test_resourceprotocol_ports_validation():
-    with pytest.raises(ValueError, match="Input should be less than or equal to 65535"):
+    with pytest.raises(
+        ValueError, match=r"Input should be less than or equal to 65535"
+    ):
         TwingateResourceCRD(
             apiVersion="twingate.com/v1",
             kind="TwingateResource",
@@ -239,7 +241,7 @@ def test_resourceprotocol_ports_validation():
             },
         )
 
-    with pytest.raises(ValueError, match="Input should be greater than or equal to 1"):
+    with pytest.raises(ValueError, match=r"Input should be greater than or equal to 1"):
         TwingateResourceCRD(
             apiVersion="twingate.com/v1",
             kind="TwingateResource",
@@ -254,7 +256,7 @@ def test_resourceprotocol_ports_validation():
         )
 
     with pytest.raises(
-        ValueError, match="Start port value must be less or equal to end port value"
+        ValueError, match=r"Start port value must be less or equal to end port value"
     ):
         TwingateResourceCRD(
             apiVersion="twingate.com/v1",

app/tests/test_crds_resourceaccess.py

@@ -369,7 +369,7 @@ def test_deserialization_with_no_target_ref_fails_validation():
             "resourceRef": {"name": "foo", "namespace": "default"},
         },
     }
-    with pytest.raises(ValueError, match="Missing principal"):
+    with pytest.raises(ValueError, match=r"Missing principal"):
         TwingateResourceAccessCRD(**data)