chore(ci): green-light Lint & Security Audit on main - #42
Merged
Conversation
Pure-mechanical 154-file format pass. No functional changes. Unblocks the Lint and Format CI job which has been failing on main since the codebase drifted from the formatter's expected output. Verified by running test_swarm_command, test_workflow, test_swarm_autocommit, test_swarm_ghpr_integration, test_gh_pr_flow, test_per_task_auditor_pairing - 87 tests pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`uv lock --upgrade` resolved 36 of 37 pip-audit findings by pulling in patched versions of aiohttp, authlib, cryptography, fastmcp, idna, litellm, lxml, mako, pygments, pyjwt, pytest, python-dotenv, python-multipart, requests, urllib3, etc. One vulnerability remains: CVE-2025-69872 in diskcache 5.6.3. No upstream fix exists yet. Transitive dep via `dspy → gepa → diskcache`. Added `--ignore-vuln CVE-2025-69872` to the CI security job with a comment explaining when to drop it. Verified 819 tests pass on the upgraded lock (1 pre-existing redis-import failure unrelated). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two pre-existing test failures surfaced once we ran the full suite without local --ignore flags: 1. tests/test_filesystem_scope.py grabbed `.fn` off `fs.read_file` for direct invocation. FastMCP 3.x (bumped via uv lock --upgrade) stopped wrapping `@tool()` results in FunctionTool; the decorator now returns the raw async function. Drop the `.fn` indirection. 2. tests/test_runtime_builder.py::test_build_redis_requires_connection imported the `redis` package unconditionally, but redis is an optional dep for the T2 backend and is not in the dev env. Switch to `pytest.importorskip` so it skips cleanly when redis is missing. Local full suite: 860 passed, 92 skipped, 0 failed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The pytest.importorskip-then-assign-attribute pattern triggered N806 (variable in function body must be lowercase). Restore the original `from ... import ... as ...` so the alias keeps PascalCase and ruff stays happy, with importorskip used purely as the gate. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Green-lights CI on main. Three issues, two real fixes here, one is already non-blocking.
Lint & Format (was failing)
uv run ruff format .— 154 mechanical reformats. No functional changes.Security Audit (was failing — 37 vulnerabilities)
uv lock --upgradepulled patched versions of aiohttp, authlib, cryptography, fastmcp, idna, litellm, lxml, mako, pygments, pyjwt, pytest, python-dotenv, python-multipart, requests, urllib3, etc. That resolved 36 of 37.dspy → gepa → diskcache. Added--ignore-vuln CVE-2025-69872to the CI job with a comment explaining when to drop the ignore.Type Check (6h runs)
continue-on-error: trueand excludesevals/+ worktrees, so it doesn't actually block CI. The 6-hour runs are noisy but harmless. Out of scope for this PR.Test plan
uv run ruff check .passesuv run ruff format --check .passesuv run pip-audit --ignore-vuln CVE-2025-69872passes locallyredispackage not in dev deps)🤖 Generated with Claude Code