ci: add GitHub Actions workflow - #6
Conversation
Runs lint and the test suite on push and pull request to main, across Python 3.11-3.13 (the range pyproject declares via requires-python). Hardening applied per GitHub's own recommendations: - actions pinned to full commit SHAs, not floating tags - permissions: contents: read (the default token grant is far wider) - persist-credentials: false, so no token is left in .git/config - concurrency group cancels superseded runs - fail-fast: false, so one interpreter failing does not mask the rest - timeout-minutes, so a hung job cannot occupy a runner indefinitely
|
Warning Review limit reached
Next review available in: 16 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Comment |
Greptile SummaryThe PR adds a least-privilege GitHub Actions workflow that runs linting and tests across Python 3.11–3.13.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains; the development extra now installs Ruff before the workflow invokes it, resolving the previous finding.
|
| Filename | Overview |
|---|---|
| .github/workflows/ci.yml | Adds a hardened Python CI matrix whose install step now provides Ruff before the lint command runs. |
| pyproject.toml | Adds Ruff to the development dependencies and configures its Python target and selected lint rules. |
Reviews (2): Last reviewed commit: "ci: declare the ruff rule set and provis..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
The first CI run failed on every module, in two ways tracing to one root cause: lint was never actually pinned down. 1. 'ruff: command not found' — ruff is required by the before-commit checklist but was absent from the dev extras, so pip install -e '.[dev]' never provided it. It passed locally only because developer venvs had it installed by hand. 2. Lint failures on a clean checkout — with no [tool.ruff] section the linted rule set is whatever the installed ruff defaults to, and that widens each release, so a green local run and a red CI run could disagree purely by version. Copies the pattern portscanner already used (the only module that passed): pin target-version, state select = [E4, E7, E9, F] explicitly, add ruff>=0.6 to dev. No source change needed — every module passes this rule set as-is.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
What
Adds
.github/workflows/ci.yml— lint + tests on push and PR tomain, across Python 3.11, 3.12 and 3.13.Why
This repository had no CI. Nothing verified that a change compiled, linted, or passed its tests before reaching
main— the recent Dependabot batch onmailvalidatormerged againstchecks=0, where a green "mergeable" only ever meant "no merge conflict".Hardening
Applied per GitHub's published guidance, matching the standard already set by
testing-platform-backend:@v4can be repointed at new codepermissions: contents: readGITHUB_TOKENgrant is far wider than this needspersist-credentials: false.git/configfor later stepsconcurrency+cancel-in-progressfail-fast: falsetimeout-minutesNo workflow interpolates
github.event.*orgithub.head_refinto arun:block, so there is no script-injection surface.Verified locally
ruffclean and the full suite green before opening this PR — CI should be green on merge.