ci: add GitHub Actions workflow - #23
Conversation
Runs lint and tests on push and PR to main across Python 3.11-3.13. Checkout sets submodules: true because vendor/chainvalidator and vendor/quantumvalidator are submodules that pyproject resolves as file:./vendor/... — a default checkout leaves them empty and the editable install fails. Hardening: SHA-pinned actions, contents: read, persist-credentials: false, concurrency cancellation, fail-fast: false, timeout-minutes.
|
Warning Review limit reached
Next review available in: 16 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Comment |
Greptile SummaryThe PR adds a read-only GitHub Actions workflow that initializes the required submodules and runs linting and tests across Python 3.11–3.13.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| .github/workflows/ci.yml | Adds a least-privilege CI matrix that initializes local-path submodule dependencies before linting and testing. |
| pyproject.toml | Provisions Ruff through development extras and explicitly stabilizes the configured lint target and rule set. |
| CLAUDE.md | Replaces the obsolete no-CI statement with an accurate description of the new workflow. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
A[Push or pull request to main] --> B[Checkout repository and submodules]
B --> C[Set up matrix Python version]
C --> D[Install project and dev extras]
D --> E[Ruff check]
E --> F[Pytest suite]
Reviews (3): Last reviewed commit: "docs: correct the major-version count an..." | Re-trigger Greptile
The first CI run failed on every module, in two ways tracing to one root cause: lint was never actually pinned down. 1. 'ruff: command not found' — ruff is required by the before-commit checklist but was absent from the dev extras, so pip install -e '.[dev]' never provided it. It passed locally only because developer venvs had it installed by hand. 2. Lint failures on a clean checkout — with no [tool.ruff] section the linted rule set is whatever the installed ruff defaults to, and that widens each release, so a green local run and a red CI run could disagree purely by version. Copies the pattern portscanner already used (the only module that passed): pin target-version, state select = [E4, E7, E9, F] explicitly, add ruff>=0.6 to dev. No source change needed — every module passes this rule set as-is.
The changelog said seven of the ten bumps cross a major boundary; the correct count is six. Also drops the now-false 'No CI config currently present' line from CLAUDE.md.
1 participant
What
Adds
.github/workflows/ci.yml— lint + tests on push and PR tomain, across Python 3.11-3.13.The submodule detail
vendor/chainvalidatorandvendor/quantumvalidatorare git submodules (mode160000), andpyproject.tomlresolves them aschainvalidator @ file:./vendor/chainvalidator. A default checkout leaves those directories empty, sopip install -e ".[dev]"would fail on an unresolvable local path. The checkout step therefore setssubmodules: true. A generic workflow copied from a sibling repo breaks here.Why
This repository had no CI — which is exactly how ten Dependabot PRs merged last week against
checks=0. Two of those floors (aiohttp>=3.14.3,pyopenssl>=26.4.0) ended up higher than any version that had been tested, because Dependabot rebased onto newer releases mid-merge. CI would have caught that automatically.Hardening
Actions pinned to full commit SHAs;
permissions: contents: read;persist-credentials: false; concurrency cancellation;fail-fast: false;timeout-minutes. Nogithub.event.*interpolation, so no script-injection surface.Verified locally
777 tests passing, ruff clean, on the dependency floors currently on
main.