From 98b41629e70fca046065ce1e169e29da8a5b7284 Mon Sep 17 00:00:00 2001 From: Dennis Thiessen Date: Fri, 7 Aug 2026 19:28:26 +0200 Subject: [PATCH] ci: lint the whole repo, and pin the rule set so it stays deterministic Widens the lint step from `ruff check app/` to `ruff check .`, since tests/ and scripts/ had drifted to 11 findings while unchecked (fixed in 1c6ccce). Widening alone would have been unsafe, and the check turned up something worse than the drift: CI installs ruff unpinned, the repo had no [tool.ruff] config, and ruff's default rule set is not stable across releases. Local 0.15.4 reports 0 findings in app/; 0.16.2 -- what `pip install ruff` resolves to today -- reports 376. 168 of those are B008 flagging FastAPI's `Depends()` in a signature default, which is the framework's documented idiom, not a defect. So the lint job would have failed the deploy pipeline on untouched code at the next push, independent of this change. Pinning the ruff version would freeze the bug in place. Pinning the *rule set* is the actual fix: select = ["E4", "E7", "E9", "F"] in pyproject.toml, the set the tree was already clean under, now enforced repo-wide. The ruff version can float freely without changing what CI enforces. Verified both scopes against both versions with caches disabled: `ruff check .` passes under 0.15.4 and 0.16.2. Confirmed the pin actually binds rather than passing by luck -- a probe file using `Depends()` in a default is clean under the committed config and reports B008 + I001 under `--isolated` 0.16.2 defaults. Full suite still 852 passed, 1 skipped. Adding rules is welcome; do it in pyproject.toml with the fixes in the same commit. Co-Authored-By: Claude Opus 5 --- .gitea/workflows/deploy.yml | 5 ++++- pyproject.toml | 18 ++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 349f80c..5ba7ef0 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -38,7 +38,10 @@ jobs: python-version: "3.12" cache: "pip" - run: pip install ruff - - run: ruff check app/ + # Whole repo, not just app/: tests/ and scripts/ drifted to 11 findings + # while unchecked. Rules are pinned in pyproject.toml, so the unpinned + # ruff above cannot change what this enforces. + - run: ruff check . test: needs: lint diff --git a/pyproject.toml b/pyproject.toml index 65930ef..e118f6c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -40,3 +40,21 @@ include = ["app*"] [tool.pytest.ini_options] asyncio_mode = "auto" testpaths = ["tests"] + +[tool.ruff] +target-version = "py312" + +[tool.ruff.lint] +# Pinned explicitly rather than inherited. CI installs ruff unpinned, and the +# default rule set is not stable across releases: 0.16 broadened it so far that +# `ruff check app/` went from 0 findings to 376 -- 168 of them B008 flagging +# FastAPI's `Depends()` in a signature default, which is the framework's +# documented idiom and not a defect. An unpinned linter with drifting defaults +# fails the deploy pipeline on code nobody touched, so the rule set is the thing +# to pin; the ruff version can then float freely. +# +# E4 imports, E7 statements, E9 syntax/IO errors, F pyflakes. This is the set the +# tree was already clean under, now applied repo-wide instead of to app/ alone. +# Adding rules is welcome -- do it here, deliberately, with the fixes in the same +# commit. +select = ["E4", "E7", "E9", "F"]