Skip to content

ci: enforce interrogate docstring coverage and restructure CI #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
IceCodeNew merged 4 commits into from
Jul 17, 2026
Merged

ci: enforce interrogate docstring coverage and restructure CI #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
59debf4
ci: merge lint workflow into CI
IceCodeNew Jul 17, 2026
76a0a23
ci: confine pytest to unittest workflow
IceCodeNew Jul 17, 2026
ebb54a5
feat(ci): enforce docstring coverage with interrogate
IceCodeNew Jul 17, 2026
c287a0f
fix: scan for leaks on every commits
IceCodeNew Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 21 additions & 10 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ on:
- ".github/workflows/ci.yml"
- "tests/**"
- "weather_briefing/**"
- "Dockerfile"
- ".dockerignore"
- "prek.toml"
- "pyproject.toml"
- "uv.lock"
Comment on lines 10 to 17

@qodo-code-review qodo-code-review Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

2. Ci checks bypassed by paths 🐞 Bug ⛨ Security

The CI workflow is now the only place running ruff/interrogate/gitleaks, but it only triggers for
pull requests whose changed files match a small allowlist, so PRs changing other files can skip
linting, docstring coverage, and secret scanning entirely.
Agent Prompt 
## Issue description
`.github/workflows/ci.yml` only runs on pull requests that touch a limited set of paths. Since this workflow contains the repo’s `ruff`, `interrogate`, `prek`, and `gitleaks` steps, any PR that doesn’t touch one of the allowlisted paths will bypass these checks.

## Issue Context
This regression matters more now because `lint.yml` was deleted; checks that used to run on all PRs are now gated by `ci.yml`’s allowlist.

## Fix Focus Areas
- .github/workflows/ci.yml[4-18]

### Suggested fix options
- Remove `on.pull_request.paths` from `ci.yml` so the workflow runs on all PRs.
- Or switch to `paths-ignore` to only skip truly irrelevant files.
- Or split security-critical scanning (e.g., gitleaks) into a separate workflow that runs on all PRs/pushes regardless of changed paths.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Expand All @@ -19,28 +21,37 @@ concurrency:
cancel-in-progress: true

jobs:
test:
lint:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
python-version: ["3.11", "3.12", "3.13", "3.14"]
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0
persist-credentials: false
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: ${{ matrix.python-version }}
python-version: "3.x"
check-latest: true
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
version: "0.11.28"
enable-cache: true
- run: uv lock --check
- run: uv sync --frozen
- uses: j178/prek-action@e98a699c41eb69ab013a45817a0406469a748f8d # v2.0.5
- run: uv run --frozen ruff check . && uv run --frozen pytest
- uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: uv run --frozen ruff check .
- run: uv run --frozen interrogate weather_briefing

hadolint:
runs-on: ubuntu-latest
permissions:
pull-requests: read
checks: write
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1.51.0
with:
hadolint_ignore: DL3007 SC2114
reporter: github-check
42 changes: 0 additions & 42 deletions .github/workflows/lint.yml
View file
Open in desktop

This file was deleted.

17 changes: 17 additions & 0 deletions .github/workflows/scan-all-commits.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
name: gitleaks
permissions: {}
on:
push:

jobs:
scan:
name: gitleaks
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0
persist-credentials: false
- uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
7 changes: 7 additions & 0 deletions prek.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,13 @@ hooks = [
{ id = "ty", args = ["--no-default-groups"] },
]

[[repos]]
repo = "https://github.com/econchick/interrogate"
rev = "4894019dc8876092bc9b6d56878798c550fad998" # frozen: 1.7.0
hooks = [
{ id = "interrogate", args = ["weather_briefing"], pass_filenames = false },
]

[[repos]]
repo = "https://github.com/hadolint/hadolint"
rev = "57e1618d78fd469a92c1e584e8c9313024656623" # frozen: v2.14.0
Expand Down
9 changes: 9 additions & 0 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ docker = [
dev = [
"any-llm-sdk[all]>=1.19,<2",
"anyio>=4.11,<5",
"interrogate>=1.7,<2",

@qodo-code-review qodo-code-review Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. interrogate rationale undocumented 📘 Rule violation ⚙ Maintainability

A new third-party dev dependency interrogate was added without a documented rationale explaining
its purpose and where it is used. This violates the dependency-rationale requirement and makes
auditing/maintenance of dependency choices harder.
Agent Prompt 
## Issue description
A new third-party dependency `interrogate` was added, but the repo does not document why it is needed and what feature/module uses it.

## Issue Context
Compliance requires each new dependency to have a documented rationale (purpose + where used). `interrogate` is introduced as a dev dependency and is wired into CI/prek, but there is no rationale recorded alongside the dependency declaration or in a canonical dependency rationale document.

## Fix Focus Areas
- pyproject.toml[28-35]
- docs/notes.md[139-142]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

"pytest>=9,<10",
"pytest-cov>=7,<8",
"ruff>=0.5,<1",
Expand Down Expand Up @@ -78,3 +79,11 @@ convention = "google"

[tool.ruff.lint.per-file-ignores]
"tests/**" = ["D"]

[tool.interrogate]
style = "google"
ignore-semiprivate = true
ignore-private = true
ignore-nested-functions = true
fail-under = 100
exclude = ["tests", "docs", "build", "dist", ".venv"]
27 changes: 27 additions & 0 deletions uv.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.