ci: add GitHub Actions workflow - #2
Conversation
Runs lint and the test suite on push and pull request to main, across Python 3.11-3.13 (the range pyproject declares via requires-python). Hardening per GitHub's own recommendations: actions pinned to full commit SHAs, permissions: contents: read, persist-credentials: false, concurrency cancellation, fail-fast: false, timeout-minutes. Also adds `.github/dependabot.yml`, which this repo lacked entirely — pip plus **github-actions**. The actions ecosystem matters here specifically: pinning to SHAs is only safe if something bumps them, otherwise the pins silently rot.
|
Warning Review limit reached
Next review available in: 15 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Comment |
Greptile SummaryAdds GitHub Actions CI and Dependabot automation for the repository.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| .github/workflows/ci.yml | Adds a hardened CI matrix that installs development dependencies, lints application and test code, and runs the test suite. |
| .github/dependabot.yml | Enables daily dependency updates for Python packages and pinned GitHub Actions. |
| pyproject.toml | Adds explicit Ruff configuration targeting Python 3.11 with a stable selected rule set. |
Reviews (3): Last reviewed commit: "ci: lint tests/ as well, per the repo's ..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
The first CI run failed on every module, in two ways tracing to one root cause: lint was never actually pinned down. 1. 'ruff: command not found' — ruff is required by the before-commit checklist but was absent from the dev extras, so pip install -e '.[dev]' never provided it. It passed locally only because developer venvs had it installed by hand. 2. Lint failures on a clean checkout — with no [tool.ruff] section the linted rule set is whatever the installed ruff defaults to, and that widens each release, so a green local run and a red CI run could disagree purely by version. Copies the pattern portscanner already used (the only module that passed): pin target-version, state select = [E4, E7, E9, F] explicitly, add ruff>=0.6 to dev. No source change needed — every module passes this rule set as-is.
The lint step covered only fileanalyzer/, while this repo's documented lint standard includes tests/ — violations in test code bypassed the new gate. Verified clean over both paths.
1 participant
What
Adds
.github/workflows/ci.yml— lint + tests on push and PR tomain, across Python 3.11, 3.12 and 3.13.Why
This repository had no CI. Nothing verified that a change compiled, linted, or passed its tests before reaching
main— the recent Dependabot batch onmailvalidatormerged againstchecks=0, where a green "mergeable" only ever meant "no merge conflict".Hardening
Applied per GitHub's published guidance, matching the standard already set by
testing-platform-backend:@v4can be repointed at new codepermissions: contents: readGITHUB_TOKENgrant is far wider than this needspersist-credentials: false.git/configfor later stepsconcurrency+cancel-in-progressfail-fast: falsetimeout-minutesNo workflow interpolates
github.event.*orgithub.head_refinto arun:block, so there is no script-injection surface.Verified locally
ruffclean and the full suite green before opening this PR.Also adds
.github/dependabot.yml, which this repo lacked entirely — pip plus github-actions. The actions ecosystem matters here specifically: pinning to SHAs is only safe if something bumps them, otherwise the pins silently rot.