chore(deps): align shared ruff pin to 0.16.6 - #3344

_{Comment @coderabbitai help to get the list of available commands.}

MERGE HOLD — closer-owned source rollout. Do not merge or arm auto-merge. This exact head must retain zero active non-outdated review threads, pass required checks, and satisfy the full seven-minute post-push window. After merge, it must enter the ordered Maint 68 canary → Maint 71 evidence → promotion → delivery reconciliation rollout.

@coderabbitai review

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Workflow source detected

PR #3344 now has valid workflow source context (origin=dependabot).

No linked GitHub issue is required for this PR.

MERGE HOLD (closer): exact head ef1e22261dbfd33366a54216b9d20c1ce65ad242 remains held. This source repair may merge only after the seven-minute post-push window, all required checks pass, and GraphQL reports zero active non-outdated review threads; its resulting rollout must then follow Maint 68 canary, Maint 71 evidence, promotion, delivery reconciliation, and Health 83. The newly active CodeRabbit thread is under thread-aware review; no merge or auto-merge is authorized.

Automated Status Summary

Head SHA: fb31cf0
Latest Runs: ⏳ pending — Gate
Required contexts: summary
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Coverage Overview

• Coverage history entries: 1

Coverage Trend

Top Coverage Hotspots (lowest coverage)

Low Coverage Files (<50.0%)

Updated automatically; will refresh on subsequent CI/Docker completions.

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

Thread-specific disposition request for PRRT_kwDOQprj9M6fJPGG: the finding is not valid for this source repair. templates/consumer-repo/.github/workflows/autofix-versions.env is the initial canonical baseline for new consumers; registered consumers receive canonical shared dev-tool pins through Maint 52. The shared-pin repair contract requires the source env, pyproject.toml, lockfile, and both consumer/integration template env files to advance together. Please re-evaluate this exact-head finding against that contract and resolve it if no concrete correctness defect remains. The prior handler run 33829652273 is not relied on because its reusable workflow bound to main (8714fb…), rather than this PR head.

Narrow reviewer-disposition decision

1. Action requested: On exact head ef1e22261dbfd33366a54216b9d20c1ce65ad242, review and either resolve/reject CodeRabbit thread PRRT_kwDOQprj9M6fJPGG or state the concrete policy defect that still requires code. No merge approval is requested by this comment.
2. Observed trigger: The sole active, non-outdated thread asks to keep templates/consumer-repo/.github/workflows/autofix-versions.env at Ruff 0.16.5. The repository contract instead treats consumer copies as repo-owned while the template remains the current seed; templates/README.md also states version pins are propagated by Maint 52. This PR intentionally advances the canonical env, pyproject.toml, lockfile, and both template defaults together to 0.16.6.
3. Affected surface and privilege: Five version-pin files change by one line each. The pin controls Ruff used by CI/autofix. It does not add permissions, dispatch surfaces, application code, production deployment behavior, or credential access; a later generated rollout will update consumers through Maint 68/71 gates.
4. Automation already exhausted: Focused validation passed 52 tests; the exact PR head is clean and GitHub checks are otherwise successful. A complete GraphQL query after the latest reviewer event found exactly this one active thread and no pagination. The thread-aware handler run 33836918285 executed its reusable implementation from default-branch SHA 8714fb96..., ignored templates/, and therefore produced no valid disposition. The thread-specific request at #issuecomment-5534964173 received no clearing disposition. No bounded code change is valid without deliberately splitting the coordinated baseline and reintroducing the inconsistency this repair fixes.
5. Trade-off: Resolving/rejecting the false-positive thread allows the closer to re-run the unchanged-head, seven-minute, required-check, and zero-thread gate. Deferring keeps this PR and stranske/Workflows-Integration-Tests#57 open and leaves the shared Ruff baseline split. If the reviewer identifies a concrete contradictory contract, the PR stays held for a bounded correction.
6. Automatic continuation: After resolution, the closer will re-query exact head/checks/threads, merge only if every gate still passes, then carry the merge through Maint 68 canary, Maint 71 evidence/promotion/delivery, and Health 83. On defer or a new criterion, the hourly closer keeps the PR held and implements or routes that exact criterion; no generated consumer PR will be merged around it.

Review-debt evidence for exact head ef1e222: this is the Workflows-owned shared dev-tool pin set, not a consumer-specific override. The synchronized contract requires the canonical env file, pyproject.toml, requirements.lock, and both consumer/integration template env files to move together; retaining the template at 0.16.5 would make generated consumers internally inconsistent with the canonical Ruff pin. The existing integration/full checks and Gate are passing. This finding is therefore not actionable on this PR; please reject or resolve it if no separate contract defect is identified. Merge remains explicitly held pending zero active threads, exact-head checks, the post-push window, and rollout ordering.

MERGE HOLD — closer-owned source rollout at exact head 6010ee45f1e36f9542edf498365ea8c00b6f0a8e. This repair adds the bare coderabbitai login to the reusable handler defaults and covered allowlist so the active CodeRabbit thread is discoverable. Do not merge or enable auto-merge until this head is unchanged, the seven-minute post-push window has elapsed, required checks pass, complete active non-outdated review threads are zero, fallback review evidence is consumed, and the ordered rollout gate is satisfied.\n\n@codex review

Correction to the preceding MERGE HOLD: the exact current head is 6010ee452a311aef7c218b51cd25f41fddae46c9. All stated hold gates apply to this SHA.

MERGE HOLD (refreshed for exact head 3b01466f0747d761305a153b1e5accdcb35efb2f): this closer owns merge authority. Do not merge or arm auto-merge until this exact head has completed the seven-minute post-push window, all required checks pass, active non-outdated review threads are zero, and the required rollout order is satisfied. Current active thread IDs: PRRT_kwDOQprj9M6fJPGG, PRRT_kwDOQprj9M6fg8IJ.

🤖 Bot Comment Handler

• Agent: codex
• Bot comments to address: 1
• Exact PR head: 3b01466
• Controller part: 1 of 1

The agent is reassigned only after every controller part is durable on the PR.
Each entry links to the authoritative review thread containing its full context.

Active thread controller

• PRRT_kwDOQprj9M6fg8IJ — .github/workflows/reusable-bot-comment-handler.yml:41
  • chore(deps): align shared ruff pin to 0.16.6 #3344 (comment)
  • Acceptance criterion: Document the added bare CodeRabbit default When operators use the documented author list to construct a nonempty bot_authors override, docs/bot-comment-handler.md still lists only coderabbitai[bot]. Since resolveBotAuthors() replaces rather than exte...

Required outcome

1. Inspect every listed active thread on the exact head.
2. Implement and validate any still-valid criterion; do not make no-op edits.
3. Reply with exact-head evidence and request a thread-specific reviewer disposition.
4. Never self-resolve reviewer threads.
5. Do not report completion while any listed thread remains active; a generic top-level review is insufficient.

@coderabbitai Thread-specific disposition requested for exact head 3b01466f0747d761305a153b1e5accdcb35efb2f: PRRT_kwDOQprj9M6fg8IJ is addressed by the documentation update in this head and focused test coverage passed. PRRT_kwDOQprj9M6fJPGG conflicts with the shared-dev-tool ownership contract: the template pin is intentionally Workflows-owned and must stay aligned with the canonical Ruff update. Please either mark each finding resolved/outdated or provide a concrete remaining acceptance criterion for this exact head. Merge remains held pending zero active non-outdated threads, required checks, and the post-push window.

#!/bin/bash
set -euo pipefail

repo="stranske/Workflows"
pr_number="3344"
head="3b01466f0747d761305a153b1e5accdcb35efb2f"

echo "== PR metadata and changed files =="
gh pr view "$pr_number" --repo "$repo" --json headRefOid,commits,files \
  --jq '{headRefOid, commits: [.commits[] | {oid: .oid, messageHeadline: .messageHeadline}], files: [.files[] | {path, additions, deletions}]}'

echo
echo "== Requested review threads =="
gh api graphql \
  -F owner="stranske" -F name="Workflows" -F number="$pr_number" \
  -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) {
        nodes {
          id
          isResolved
          isOutdated
          path
          line
          originalLine
          comments(first: 20) {
            nodes {
              id
              author { login }
              body
              createdAt
              url
              commit { oid }
            }
          }
        }
      }
    }
  }
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
  | select(.id == "PRRT_kwDOQprj9M6fg8IJ" or .id == "PRRT_kwDOQprj9M6fJPGG")'

echo
echo "== Exact-head change summary =="
git diff --stat "${head}^" "$head"
git diff -- "$(
  printf '%s\n' \
    '.github/workflows/autofix-versions.env' \
    'pyproject.toml' \
    'templates/consumer-repo/.github/workflows/autofix-versions.env' \
    'templates/integration-repo/.github/workflows/autofix-versions.env' \
    '.github/scripts/bot-comment-handler.js' \
    '.github/workflows/reusable-bot-comment-handler.yml' \
    'tests/workflows/test_bot_comment_handler.py' \
    '.github/scripts/__tests__/bot-comment-handler.test.js'
)"

echo
echo "== Template contract documentation =="
fd -a '^README\.md$' templates -x sh -c 'echo "== $1 =="; rg -n -i -C 3 "Maint 52|version pin|Ruff|canonical|propagat" "$1" || true' sh {}

#!/bin/bash
set -euo pipefail

head="3b01466f0747d761305a153b1e5accdcb35efb2f"

echo "== Documentation change on exact head =="
git show --format= --unified=20 "$head" -- docs/bot-comment-handler.md

echo
echo "== Regression-test change on exact head =="
git show --format= --unified=20 "$head" -- tests/workflows/test_bot_comment_handler.py

echo
echo "== Resolve the CodeRabbit-owned invalid template-pin finding =="
gh api graphql \
  -F threadId="PRRT_kwDOQprj9M6fJPGG" \
  -f query='
mutation($threadId: ID!) {
  resolveReviewThread(input: {threadId: $threadId}) {
    thread { id isResolved isOutdated path }
  }
}'

@stranske PRRT_kwDOQprj9M6fJPGG is resolved. The template version pin must align with the shared pin set under the documented Maint 52 contract.

PRRT_kwDOQprj9M6fg8IJ is addressed on this head. docs/bot-comment-handler.md now documents both CodeRabbit identities. The focused test keeps the workflow_dispatch and workflow_call bot_authors defaults aligned.

PRRT_kwDOQprj9M6fg8IJ was authored by chatgpt-codex-connector. I cannot resolve a thread from that reviewer. That reviewer or a repository maintainer must resolve it after confirming the documented change.

You are interacting with an AI system.

Runner dispatch state for codex on PR #3344. Do not edit.