ci: add GitHub Actions workflow for lint, type-check, and tests#6
Open
dinakars777 wants to merge 2 commits intosyrin-labs:mainfrom
Open
ci: add GitHub Actions workflow for lint, type-check, and tests#6dinakars777 wants to merge 2 commits intosyrin-labs:mainfrom
dinakars777 wants to merge 2 commits intosyrin-labs:mainfrom
Conversation
Adds a CI pipeline that runs on every PR and push to main: - Ruff lint + format check - Mypy strict type checking - Pytest across Python 3.11, 3.12, 3.13 with coverage - Build validation (sdist + wheel + twine check) Concurrency control cancels stale runs on the same branch. The build job gates on all checks passing before validating the package artifact.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdded a GitHub Actions CI workflow that runs on pushes and pull requests to Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
25-27: Avoid floating tool installs in CI steps.
pip install ruff/mypy/build/twinewithout pinned versions makes runs non-reproducible and prone to sudden breakage. Prefer pinned versions (or a dedicated CI constraints file) and install viapython -m pip.Suggested stabilization pattern
- - name: Install ruff - run: pip install ruff + - name: Install ruff + run: python -m pip install "ruff==<pinned-version>" ... - - name: Install dependencies - run: | - pip install -e ".[dev]" - pip install mypy + - name: Install dependencies + run: | + python -m pip install -e ".[dev]" + python -m pip install "mypy==<pinned-version>" ... - - name: Install build tools - run: pip install build twine + - name: Install build tools + run: python -m pip install "build==<pinned-version>" "twine==<pinned-version>"Also applies to: 45-49, 87-88
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci.yml around lines 25 - 27, The CI step that runs "pip install ruff" uses an unpinned floating install and should be changed to use reproducible installs: replace "pip install ruff" with "python -m pip install ruff==<pin>" (or reference a constraints file / requirements-ci.txt) and pin versions for the other similar install steps that install mypy/build/twine; ensure all pip invocations use "python -m pip" and either explicit == pins or a single constraints file to stabilize the workflow.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/ci.yml:
- Line 13: The workflow is missing explicit least-privilege permissions; update
the CI workflow YAML to add a top-level permissions block (after the on:
section) and set permissions: contents: read so the job uses only repository
contents read access; ensure the block is placed at the top level of the file
(not under jobs:) and formatted as a sibling to jobs and on so the workflow
receives the restricted permissions.
- Around line 29-32: The CI currently runs the Ruff commands only on "src/" and
"tests/"; update the two steps that invoke "ruff check" and "ruff format
--check" so they include "examples/" as well (i.e., run "ruff check src/ tests/
examples/" and "ruff format --check src/ tests/ examples/") so the workflow's
use of ruff matches the project's pyproject.toml source list.
- Around line 19-23: Replace mutable action tags with full commit SHAs for all
GitHub Actions usages to improve supply-chain security: change uses:
actions/checkout@v4 and uses: actions/setup-python@v5 (and any other occurrences
of actions/*@<major>) to their pinned commit SHAs and add a trailing comment
with the human-readable tag (e.g.,
actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v4 and
actions/setup-python@61a6322f88fd7d61794de7596e2081cba2d92cc4 # v5); ensure you
update every action reference (actions/checkout, actions/setup-python, etc.)
consistently across the workflow file.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 25-27: The CI step that runs "pip install ruff" uses an unpinned
floating install and should be changed to use reproducible installs: replace
"pip install ruff" with "python -m pip install ruff==<pin>" (or reference a
constraints file / requirements-ci.txt) and pin versions for the other similar
install steps that install mypy/build/twine; ensure all pip invocations use
"python -m pip" and either explicit == pins or a single constraints file to
stabilize the workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
- Pin actions/checkout and actions/setup-python to full commit SHAs for supply-chain security (all 8 references) - Add top-level permissions: contents: read for least-privilege - Include examples/ in ruff check and format scope to match pyproject.toml src config - Pin all tool versions (ruff==0.15.9, mypy==1.20.0, build==1.4.2, twine==6.2.0) for reproducible CI runs - Use python -m pip consistently across all install steps
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a CI pipeline (
ci.yml) that runs on every PR and push tomain. The repo currently only has apublish.ymlfor PyPI releases — there are no automated checks on PRs today.What this adds
ruff check+ruff format --checkonsrc/andtests/mypyin strict mode againstsrc/syrin/pytestacross Python 3.11, 3.12, 3.13 with coverage reportpython -m build+twine checkto validate the package artifactDesign decisions
fail-fast: false: All Python versions run to completion so we catch version-specific failures in a single runtests/unit/to avoid requiring API keys or external services in CISummary by CodeRabbit