ci: replace custom noqa markers with guard ignores (#39679)

scripts/ast_grep_guard.py

@@ -245,13 +245,13 @@ def extract_meta_variables(raw_match: dict[str, Any]) -> dict[str, str]:
     return result
 
 
-def has_reasoned_noqa(source_line: str, rule_id: str) -> bool:
-    pattern = re.compile(rf"# noqa: {re.escape(rule_id)}(?:\s+(?P<reason>\S.*))?\s*$")
+def has_reasoned_guard_ignore(source_line: str, rule_id: str) -> bool:
+    pattern = re.compile(rf"# guard-ignore: {re.escape(rule_id)} -- (?P<reason>\S.*)\s*$")
     match = pattern.search(source_line)
     if not match:
         return False
     reason = match.group("reason")
-    return reason is not None and bool(reason.strip())
+    return bool(reason.strip())
 
 
 def collect_hunk_violations(

scripts/check_no_new_controller_sqlalchemy.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 import re
 from pathlib import Path
 
-from ast_grep_guard import Match, has_reasoned_noqa, rule_path, run_guard
+from ast_grep_guard import Match, has_reasoned_guard_ignore, rule_path, run_guard
 
 
 RULE_ID = "no-new-controller-sqlalchemy"
@@ -40,7 +40,7 @@ def is_flask_session_get(match: Match) -> bool:
 
 
 def is_suppressed(match: Match) -> bool:
-    return has_reasoned_noqa(match.source_line, RULE_ID)
+    return has_reasoned_guard_ignore(match.source_line, RULE_ID)
 
 
 def is_reportable_match(match: Match) -> bool:

scripts/check_no_new_getattr.py

@@ -3,7 +3,7 @@
 
 from __future__ import annotations
 
-from ast_grep_guard import Match, has_reasoned_noqa, is_python_source_path, rule_path, run_guard
+from ast_grep_guard import Match, has_reasoned_guard_ignore, is_python_source_path, rule_path, run_guard
 
 
 RULE_ID = "no-new-getattr"
@@ -12,7 +12,7 @@ VIOLATION_MESSAGE = "no-new-getattr net-new getattr() in added code"
 
 
 def is_reportable_match(match: Match) -> bool:
-    return not has_reasoned_noqa(match.source_line, RULE_ID)
+    return not has_reasoned_guard_ignore(match.source_line, RULE_ID)
 
 
 def main() -> int:

scripts/lint_controller_sqlalchemy.py

@@ -44,7 +44,7 @@ def parse_args() -> argparse.Namespace:
         help="Files or directories to scan. Defaults to api/controllers.",
     )
     parser.add_argument("--include-allowed", action="store_true", help="Print allowed flush()/commit() findings.")
-    parser.add_argument("--include-suppressed", action="store_true", help="Print reasoned noqa suppressions.")
+    parser.add_argument("--include-suppressed", action="store_true", help="Print reasoned guard suppressions.")
     parser.add_argument("--summary-only", action="store_true", help="Print counts without per-finding details.")
     parser.add_argument("--json", action="store_true", help="Emit machine-readable JSON.")
     parser.add_argument(