chore: sync workflow templates - #5645
Conversation
Automated sync from stranske/Workflows Template hash: 0ab0029407c1 Changes synced from sync-manifest.yml
stranske
added
sync
GitHub Actions
Failure
📝 WalkthroughWalkthroughIntroduces a staged shared design-system consisting of CSS token variables ( ChangesDesign-System Staging Layer
Workflow Action SHA Repin
Estimated code review effort🎯 2 (Simple) | ⏱️ ~15 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8339c3635e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| st.markdown( | ||
| f"<div class='ds-empty'><div style='font-size:22px;opacity:.6'>{icon}</div>" | ||
| f"<div class='t'>{title}</div><div class='d'>{desc}</div></div>", | ||
| unsafe_allow_html=True, |
There was a problem hiding this comment.
When callers pass values derived from data, filenames, or user input into title, desc, or icon, these strings are interpolated directly into a block rendered with unsafe_allow_html=True, so embedded HTML/CSS can be rendered and can break or spoof the surrounding UI. Escape the dynamic fields before concatenating the fixed wrapper markup; the same treatment is needed for the notice helper's dynamic text.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@design-system/ds_streamlit.py`:
- Around line 33-44: The color constants defined in ds_streamlit.py (lines
33-44) such as _INK, _ACCENT, _NEG, _WARN, _POS, and others are hardcoded
duplicates of the theme-air palette from tokens.css, creating a maintenance
burden and risk of divergence. As a short-term measure, add a section to the
project's README.md documenting this as a known limitation, explicitly noting
that the Python color constants must be manually kept in sync with tokens.css
when design tokens are updated, and mention that this will be addressed in the
future through automated generation or a shared tokens source.
In `@design-system/PRESENTATION_PATTERNS.md`:
- Around line 77-86: The P4 pattern specification in PRESENTATION_PATTERNS.md
references a diagnostics_expander() function that does not exist in
ds_streamlit.py. Currently, only the dev_note() function is implemented, which
logs to Python's logger but does not render UI elements. You need to either add
the missing diagnostics_expander() function to ds_streamlit.py as a helper that
wraps st.expander() to display a collapsible diagnostics panel in the Streamlit
UI, or update the spec documentation to clarify that dev_note() only handles
logging and that applications must implement their own expander pattern
separately. Ensure consistency between the documented API and the actual
implementation to avoid confusion for teams using the design kit.
In `@design-system/tokens.css`:
- Line 29: The --font-body custom property on line 29 and another font stack on
line 74 contain unquoted font names with mixed casing (BlinkMacSystemFont,
Roboto, Helvetica, Arial, Georgia) which violates stylelint's value-keyword-case
rule. Fix this by quoting all the font names that have mixed casing, for example
converting BlinkMacSystemFont to "BlinkMacSystemFont", Roboto to "Roboto",
Helvetica to "Helvetica", Arial to "Arial", and Georgia to "Georgia". This
ensures the font names are properly quoted to avoid parsing ambiguity and
complies with stylelint expectations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c97c7564-8c5f-4cff-a6ee-9e3292942f93
📒 Files selected for processing (6)
.github/workflows/agents-guard.ymldesign-system/PRESENTATION_PATTERNS.mddesign-system/README.mddesign-system/components.cssdesign-system/ds_streamlit.pydesign-system/tokens.css
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
stranske/Workflows(auto-detected)stranske/Template(auto-detected)
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: Python CI / typecheck-mypy
- GitHub Check: Python CI / lint-ruff
- GitHub Check: claude-review
🧰 Additional context used
📓 Path-based instructions (5)
{pyproject.toml,.github/workflows/**/*.{yml,yaml}}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Check both
pyproject.toml([tool.coverage.report] fail_under) AND workflow files forcoverage-minsettings - these must match or the lower one wins
Files:
.github/workflows/agents-guard.yml
.github/workflows/**/*.{yml,yaml}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
For
startup_failureGitHub Actions workflow errors with zero jobs, check for common causes: Invalid YAML syntax, top-levelpermissions:block onworkflow_callreusable workflows (conflicts with caller permissions), invalid permission scopes, or circular workflow references
Files:
.github/workflows/agents-guard.yml
.github/workflows/*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Reference reusable workflows in
.github/workflows/*.ymlfiles with@mainunless intentionally pinning to an exact commit SHA for a controlled reason
Files:
.github/workflows/agents-guard.yml
{.github/workflows/agents-*.yml,.github/workflows/autofix.yml,.github/codex/**/*}
📄 CodeRabbit inference engine (CLAUDE.md)
Synced workflows (
agents-*.yml,autofix.yml), prompts in.github/codex/, and synced scripts/docs should be fixed instranske/Workflowssource, not locally in the consumer repo
Files:
.github/workflows/agents-guard.yml
**/*.py
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
For Manager-Database repository: Use Prefect 2.x - import schedules from
prefect.client.schemas.schedules
Files:
design-system/ds_streamlit.py
🪛 markdownlint-cli2 (0.22.1)
design-system/PRESENTATION_PATTERNS.md
[warning] 16-16: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 22-22: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 30-30: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 39-39: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 46-46: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 54-54: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 77-77: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
[warning] 88-88: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
🪛 Stylelint (17.13.0)
design-system/tokens.css
[error] 29-29: Expected "BlinkMacSystemFont" to be "blinkmacsystemfont" (value-keyword-case)
(value-keyword-case)
[error] 29-29: Expected "Roboto" to be "roboto" (value-keyword-case)
(value-keyword-case)
[error] 29-29: Expected "Helvetica" to be "helvetica" (value-keyword-case)
(value-keyword-case)
[error] 29-29: Expected "Arial" to be "arial" (value-keyword-case)
(value-keyword-case)
[error] 74-74: Expected "Georgia" to be "georgia" (value-keyword-case)
(value-keyword-case)
🔇 Additional comments (3)
.github/workflows/agents-guard.yml (1)
114-114: LGTM!Also applies to: 183-183
design-system/components.css (1)
1-96: LGTM!design-system/ds_streamlit.py (1)
54-75: 🩺 Stability & Availability | ⚡ Quick winVerify Streamlit version pinning and CSS injection approach.
The
inject_theme()function injects inline CSS viast.markdown(..., unsafe_allow_html=True). This approach is correct for Streamlit, but:
- Verify that Streamlit 1.58.0 (from library_context) is the declared runtime in the consumer repo's
pyproject.tomlor equivalent.- Confirm that the CSS class names (
.ds-badge,.ds-notice,.ds-empty,.block-container) will not conflict with Streamlit's internal styles.If the consumer repo declares a different Streamlit version, this may need version-specific adjustments.
| # Ink & Air (theme-air) palette — keep in sync with tokens.css .theme-air. | ||
| _INK = "#0a0a0a" | ||
| _MUTED = "#737373" | ||
| _ACCENT = "#4f46e5" | ||
| _BORDER = "#ececec" | ||
| _NEG = "#dc2626" | ||
| _NEG_WEAK = "#fef2f2" | ||
| _WARN = "#b45309" | ||
| _WARN_WEAK = "#fffbeb" | ||
| _INFO_WEAK = "#f4f3ff" | ||
| _POS = "#047857" | ||
| _POS_WEAK = "#ecfdf5" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Hardcoded color constants duplicate tokens.css values; breaks single-source-of-truth model.
Lines 34–44 define color constants (_INK, _ACCENT, _NEG, _WARN, _POS, etc.) that mirror the theme-air palette in tokens.css. The inline comment "keep in sync with tokens.css .theme-air" acknowledges the maintenance burden, but there's no automated enforcement.
If a designer updates a token in tokens.css, the Python constants become stale and the Streamlit UI will diverge from the web UI (theme-paper, components.css). This breaks the design-system's single-source-of-truth guarantee.
Options to fix:
- Preferred: Generate Python constants from
tokens.cssat build time (e.g., via a script that parses CSS variables and emits a_gen_colors.py). - Interim: Move color definitions to a shared
tokens.jsonfile; import both CSS and Python from it. - Minimal: Add a pre-commit hook or CI check that validates the constants match the CSS source.
For now, document this as a known limitation in README.md so maintainers are aware.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@design-system/ds_streamlit.py` around lines 33 - 44, The color constants
defined in ds_streamlit.py (lines 33-44) such as _INK, _ACCENT, _NEG, _WARN,
_POS, and others are hardcoded duplicates of the theme-air palette from
tokens.css, creating a maintenance burden and risk of divergence. As a
short-term measure, add a section to the project's README.md documenting this as
a known limitation, explicitly noting that the Python color constants must be
manually kept in sync with tokens.css when design tokens are updated, and
mention that this will be addressed in the future through automated generation
or a shared tokens source.
| ## Streamlit design kit (most of the fleet is Streamlit) | ||
| The CSS components above cover the web apps (Pension-Data, trip-planner, LMS). The four Streamlit | ||
| Tier-A apps need a Streamlit-native equivalent — ship a shared `ds_streamlit.py` alongside the CSS: | ||
| - `inject_theme()` — applies the `theme-air` palette (P1); pairs with `.streamlit/config.toml`. | ||
| - `empty_state(title, desc, cta_label=None, on_click=None)` (P2) | ||
| - `notice(kind, title, body, action=None)` and `error(message, remediation=None)` + `translate_error(exc)` (P3) | ||
| - `dev_note(msg)` → logging; `diagnostics_expander()` (P4) | ||
| - `availability_badge(label)` (P5) | ||
| - `humanize_id(raw, mapping)` (P6) | ||
| Graduate this kit + the CSS into `Workflows/templates/consumer-repo/design-system/` so maint-68 syncs it fleet-wide. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
P4 spec references diagnostics_expander() function not in ds_streamlit.py.
Line 83 states: "Streamlit: ds_streamlit.dev_note(msg) → logging (not st.warning/st.write); diagnostics behind st.expander("Diagnostics")."
However, ds_streamlit.py only implements dev_note() (line 153), which logs to Python's logger. There is no diagnostics_expander() function to render a collapsible diagnostics panel in the Streamlit UI.
Either:
- Add the function to
ds_streamlit.py: a helper that wrapsst.expander()and logs/displays diagnostic info. - Update the spec to clarify that apps must implement their own expander pattern (dev_note just logs, doesn't render).
The P4 pattern will be incomplete until this is resolved.
Would you like me to generate the missing diagnostics_expander() function for ds_streamlit.py?
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)
[warning] 77-77: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@design-system/PRESENTATION_PATTERNS.md` around lines 77 - 86, The P4 pattern
specification in PRESENTATION_PATTERNS.md references a diagnostics_expander()
function that does not exist in ds_streamlit.py. Currently, only the dev_note()
function is implemented, which logs to Python's logger but does not render UI
elements. You need to either add the missing diagnostics_expander() function to
ds_streamlit.py as a helper that wraps st.expander() to display a collapsible
diagnostics panel in the Streamlit UI, or update the spec documentation to
clarify that dev_note() only handles logging and that applications must
implement their own expander pattern separately. Ensure consistency between the
documented API and the actual implementation to avoid confusion for teams using
the design kit.
| --radius: 10px; --radius-sm: 8px; --btn-radius: 8px; --input-radius: 8px; | ||
|
|
||
| /* ---- type ---- */ | ||
| --font-body: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Font names must be lowercase per stylelint's value-keyword-case rule.
Lines 29 and 74 use unquoted font names (BlinkMacSystemFont, Roboto, Helvetica, Arial, Georgia) with mixed casing. Stylelint expects them to be lowercase. This will cause lint failures in CI.
Fix: either quote the font names (e.g., "Roboto", "Georgia") or convert them to lowercase. System font names in font-stacks should typically be quoted to avoid parsing ambiguity anyway.
🔤 Proposed fix: quote font names
- --font-body: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
- --font-heading: var(--font-body);
+ --font-body: -apple-system, "BlinkMacSystemFont", "Segoe UI", "Roboto", "Helvetica", "Arial", sans-serif;
+ --font-heading: var(--font-body);And for theme-paper:
- --font-heading: Georgia, "Times New Roman", serif;
+ --font-heading: "Georgia", "Times New Roman", serif;Also applies to: 74-74
🧰 Tools
🪛 Stylelint (17.13.0)
[error] 29-29: Expected "BlinkMacSystemFont" to be "blinkmacsystemfont" (value-keyword-case)
(value-keyword-case)
[error] 29-29: Expected "Roboto" to be "roboto" (value-keyword-case)
(value-keyword-case)
[error] 29-29: Expected "Helvetica" to be "helvetica" (value-keyword-case)
(value-keyword-case)
[error] 29-29: Expected "Arial" to be "arial" (value-keyword-case)
(value-keyword-case)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@design-system/tokens.css` at line 29, The --font-body custom property on line
29 and another font stack on line 74 contain unquoted font names with mixed
casing (BlinkMacSystemFont, Roboto, Helvetica, Arial, Georgia) which violates
stylelint's value-keyword-case rule. Fix this by quoting all the font names that
have mixed casing, for example converting BlinkMacSystemFont to
"BlinkMacSystemFont", Roboto to "Roboto", Helvetica to "Helvetica", Arial to
"Arial", and Georgia to "Georgia". This ensures the font names are properly
quoted to avoid parsing ambiguity and complies with stylelint expectations.
Source: Linters/SAST tools
1 participant
Sync Summary
Files Updated
Files Skipped
Review Checklist
Source: stranske/Workflows
Source SHA:
64a8012fcf61ffb010aed2c2f3e0e97f8766826cTemplate hash:
0ab0029407c1Sync branch:
sync/workflows-0ab0029407c1Consumer repo:
stranske/Trend_Model_ProjectManifest:
.github/sync-manifest.ymlSummary by CodeRabbit
New Features
Documentation
Chores