ci: add GitHub Actions workflow - #5
Conversation
Runs lint and the test suite on push and pull request to main, across Python 3.11-3.13 (the range pyproject declares via requires-python). Hardening per GitHub's own recommendations: actions pinned to full commit SHAs, permissions: contents: read, persist-credentials: false, concurrency cancellation, fail-fast: false, timeout-minutes.
|
Warning Review limit reached
Next review available in: 9 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Comment |
Greptile SummaryAdds a hardened GitHub Actions workflow that runs linting and tests across Python 3.11–3.13.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| .github/workflows/ci.yml | Adds the CI matrix and correctly invokes the newly installed lint and test tooling. |
| pyproject.toml | Adds Ruff to development dependencies, defines stable lint rules, and enforces the required coverage floor. |
| CLAUDE.md | Updates repository guidance to reflect the new CI workflow. |
Reviews (3): Last reviewed commit: "ci: enforce the documented coverage floo..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
The first CI run failed on every module, in two ways tracing to one root cause: lint was never actually pinned down. 1. 'ruff: command not found' — ruff is required by the before-commit checklist but was absent from the dev extras, so pip install -e '.[dev]' never provided it. It passed locally only because developer venvs had it installed by hand. 2. Lint failures on a clean checkout — with no [tool.ruff] section the linted rule set is whatever the installed ruff defaults to, and that widens each release, so a green local run and a red CI run could disagree purely by version. Copies the pattern portscanner already used (the only module that passed): pin target-version, state select = [E4, E7, E9, F] explicitly, add ruff>=0.6 to dev. No source change needed — every module passes this rule set as-is.
Review caught two gaps. The guide claimed 'No CI config currently present', now false. And pytest reported coverage without enforcing the 80% minimum CLAUDE.md documents, so a drop below it would still pass — CI would have looked green while the documented bar was breached. Actual coverage is 99%, so the gate has ample headroom.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
What
Adds
.github/workflows/ci.yml— lint + tests on push and PR tomain, across Python 3.11, 3.12 and 3.13.Why
This repository had no CI. Nothing verified that a change compiled, linted, or passed its tests before reaching
main— the recent Dependabot batch onmailvalidatormerged againstchecks=0, where a green "mergeable" only ever meant "no merge conflict".Hardening
Applied per GitHub's published guidance, matching the standard already set by
testing-platform-backend:@v4can be repointed at new codepermissions: contents: readGITHUB_TOKENgrant is far wider than this needspersist-credentials: false.git/configfor later stepsconcurrency+cancel-in-progressfail-fast: falsetimeout-minutesNo workflow interpolates
github.event.*orgithub.head_refinto arun:block, so there is no script-injection surface.Verified locally
ruffclean and the full suite green before opening this PR.