From 8a82bde531107fb0b820f173a524b4c3db136ec6 Mon Sep 17 00:00:00 2001
From: flan <flan@arch.fyi>
Date: Mon, 13 Jul 2026 16:53:59 +0000
Subject: [PATCH] noqa placement: ruff anchors S607 to the args list, not the
 call

---
 patch/alert_source.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/patch/alert_source.py b/patch/alert_source.py
index 56ec4bd..a429ec7 100644
--- a/patch/alert_source.py
+++ b/patch/alert_source.py
@@ -87,8 +87,8 @@ class TrueCloudPatchUpdateAlertSource(ThreadedAlertSource):
         # this file -- nothing user-supplied reaches the command line. The partial
         # `git` path is moot: this runs as root inside middlewared, so anyone who
         # can poison PATH already has root.
-        return subprocess.run(  # noqa: S603, S607
-            ["git", "-C", PATCH_DIR, *args],
+        return subprocess.run(  # noqa: S603
+            ["git", "-C", PATCH_DIR, *args],  # noqa: S607
             capture_output=True, text=True, timeout=_TIMEOUT, check=True,
         ).stdout