'/tmp/opc-certs' is a spec'd, overridable-via-env default (already noqa'd for ruff's S108); bandit needs its own '# nosec B108' since it runs as a separate CI step and doesn't read ruff's noqa comments.
'/tmp/opc-certs' is a spec'd, overridable-via-env default (already noqa'd for ruff's S108); bandit needs its own '# nosec B108' since it runs as a separate CI step and doesn't read ruff's noqa comments.