build(deps): consolidate account-unification dependency updates and pin ruff rule set - #33
build(deps): consolidate account-unification dependency updates and pin ruff rule set#33seonghobae wants to merge 2 commits into
Conversation
…in ruff rule set Dependabot opened five PRs (#27-#31) bumping account_unification dependencies, but each only edited pyproject.toml (or targeted a transitive package) without regenerating uv.lock, so every one fails `uv sync --locked` on the account-unification-tests gate ("The lockfile at uv.lock needs to be updated"). Apply all five bumps in one lock-consistent change: - fastapi 0.139.0 -> 0.140.13 (pulls starlette 1.3.1) - uvicorn 0.51.0 -> 0.52.0 - ruff 0.15.21 -> 0.16.0 (dev) - annotated-doc 0.0.4 -> 0.0.5 (transitive) - annotated-types 0.7.0 -> 0.8.0 (transitive) ruff 0.16.0 widened its implicit default rule set (adding flake8-bugbear, pyupgrade, flake8-pyi, flake8-blind-except, RUF100, isort), which surfaced 21 lints on code that previously passed. Pin the classic default select (["E4","E7","E9","F"]) so the established lint policy stays explicit and stable across ruff upgrades instead of silently changing on a version bump. Verified in services/account_unification: `uv sync --locked --extra dev`, `ruff check app tests tools` (All checks passed), `interrogate .` (100%), `pytest -q` (52 passed). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AqtiEQFfuYFsS75Aku9tPT
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
📝 WalkthroughWalkthroughHealthcheck이 HTTP(S) 외 URL 스킴을 거부하도록 검증 로직과 테스트가 추가되었습니다. FastAPI, Uvicorn, Ruff 버전과 Ruff lint 규칙 설정도 갱신되었습니다. ChangesHealthcheck URL validation
패키지 및 린트 설정 업데이트
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
Status on this dependency consolidation:
Generated by Claude Code |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
5c7e1dd820d887e862bafa6b187c429c4176db53. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- SAST Semgrep/Semgrep (multi-language SAST): FAILURE (https://github.com/ContextualWisdomLab/keyverse/actions/runs/30455845708/job/90589076334)
- Semgrep (multi-language SAST) check run: failure (https://github.com/ContextualWisdomLab/keyverse/actions/runs/30455845708/job/90589076334)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Test: test_healthcheck.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_healthcheck.py"]
R2 --> V2["targeted test run"]
|
…llib finding The org-central "Semgrep (multi-language SAST)" gate reports a real Medium (WARNING) finding on every keyverse PR, blocking OpenCode approval: python.lang.security.audit.dynamic-urllib-use-detected services/account_unification/app/healthcheck.py:18 — dynamic value passed to urllib.request.urlopen (urllib honours file://, so a caller-controlled URL could read arbitrary files). Mitigate the actual risk by rejecting any non-http(s) scheme before opening the URL (closes the file:// vector), then annotate the audited call with a narrow, documented `# nosemgrep` for that single rule. Add a regression test for the rejected-scheme path. Fixed at base so all open keyverse PRs inherit a clean SAST gate. Verified in services/account_unification: `ruff check app tests tools`, `interrogate .` (100%), `pytest -q`. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AqtiEQFfuYFsS75Aku9tPT
|
Correction to my earlier comment: I mis-read the Fixed at base in Generated by Claude Code |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head3e033462e719dc19d36e70a764d62379bafba056. -
Head SHA:
3e033462e719dc19d36e70a764d62379bafba056 -
Workflow run: 30482870472
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Test: test_healthcheck.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_healthcheck.py"]
R2 --> V2["targeted test run"]
|
Blocker triage for the
Generated by Claude Code |
2 participants
Summary
Dependabot opened five PRs (#27–#31) bumping
services/account_unificationdependencies, but each only editedpyproject.toml(or targeted a transitive package) without regeneratinguv.lock. Every one therefore fails theaccount-unification-testsgate atuv sync --locked:This consolidates all five bumps into one lock-consistent change so the gate passes and the individual PRs can be closed:
fastapistarlette1.3.1)uvicornruffannotated-docannotated-typesWhy the explicit ruff select
ruffhad no[tool.ruff.lint]select, so it used ruff's implicit default. ruff 0.16.0 widened that default (adding flake8-bugbear, pyupgrade, flake8-pyi, flake8-blind-except, RUF100, isort), which surfaced 21 new lints on code that previously passed — e.g.B008on FastAPI's required= Depends(...)parameter-default pattern. Rather than rewrite endpoints or silently adopt a broader lint policy on a version bump, this pins the classic default (["E4","E7","E9","F"]), keeping the established policy explicit and stable across future ruff upgrades. Verified:ruff check app tests tools --select E4,E7,E9,Fwas already clean, so this is behavior-preserving.Verification
Run from
services/account_unification/(mirrors theaccount-unification-testsCI gate):uv sync --locked --extra dev— lockfile consistentuv run ruff check app tests tools— All checks passeduv run interrogate .— PASSED (100%, gate ≥80%)uv run pytest -q— 52 passedNotes
Supersedes #27, #28, #29, #30, #31 (they can be closed once this merges). No source-code behavior change; runtime dependency versions and the pinned lint rule set only.
Generated by Claude Code
Summary by CodeRabbit
버그 수정
개선 사항
테스트