chore: remove redundant linters, fix coverage output, update roadmap by jonpspri · Pull Request #3716 · IBM/mcp-context-forge

jonpspri · 2026-03-18T03:22:18Z

Summary

Remove importchecker and unimport from Makefile, pyproject.toml, and CI lint workflow — redundant with ruff/flake8 F401 rule
Change make coverage pytest flag from -rA to -rfE to suppress log capture noise from passing tests
Mark 33 closed issues in docs/docs/architecture/roadmap.md (⏳ → ✅)
Fix pr-review skill to select exactly one recommendation instead of listing all three
Align e2e test JWT secret default with docker-compose.yml
Add --admin flag to register_fast_test JWT token generation
Update lock files (uv.lock, package-lock.json)

Closes #1290

Test plan

make lint passes without importchecker/unimport references
make coverage no longer dumps captured logs for passing tests
CI lint workflow runs without the removed unimport step
E2e tests use correct JWT secret matching docker-compose default

github-actions · 2026-03-18T03:23:15Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
❌ 1 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 24 package(s) with unknown licenses.
⚠️ 2 packages with OpenSSF Scorecard issues.

View full job summary

Copilot

Pull request overview

This PR updates developer tooling and dependency metadata across the Python and Node.js parts of the repo, plus marks a number of roadmap items as completed.

Changes:

Update Python dev dependencies (e.g., bump Black; remove importchecker/unimport; add mcp-cli/tornado) and align lint targets accordingly.
Update the Node.js lockfile with newer transitive dependencies (including the Vite/Vitest ecosystem changes).
Update documentation roadmap status entries and adjust an internal PR review skill template.

Reviewed changes

Copilot reviewed 6 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`pyproject.toml`	Updates Python dev dependency set (adds `mcp-cli`/`tornado`, removes `importchecker`/`unimport`, bumps Black) and related fawltydeps ignore list.
`mcp-servers/python/qr_code_server/pyproject.toml`	Bumps Black version for the QR code server dev extras.
`Makefile`	Removes `importchecker`/`unimport` targets and drops them from lint target lists; tweaks pytest report flags for coverage targets.
`.github/workflows/lint.yml`	Removes `unimport` from the Python lint matrix.
`package-lock.json`	Large dependency lock update; also changes top-level lock `name`.
`docs/docs/architecture/roadmap.md`	Marks many roadmap items as completed (⏳ → ✅).
`.claude/skills/pr-review/SKILL.md`	Updates the “Recommendation” section format in the PR review skill template.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…update roadmap - Remove importchecker and unimport from Makefile, pyproject.toml, and CI workflow (redundant with ruff/flake8 F401 rule) - Change `make coverage` pytest flag from -rA to -rfE to suppress log capture noise from passing tests - Mark 33 closed issues in roadmap.md (⏳ → ✅) - Fix pr-review skill to select exactly one recommendation - Align e2e test JWT secret default with docker-compose.yml - Add --admin flag to register_fast_test JWT token generation - Update lock files Closes #1290 Signed-off-by: Jonathan Springer <jps@s390x.com>

…update roadmap (#3716) - Remove importchecker and unimport from Makefile, pyproject.toml, and CI workflow (redundant with ruff/flake8 F401 rule) - Change `make coverage` pytest flag from -rA to -rfE to suppress log capture noise from passing tests - Mark 33 closed issues in roadmap.md (⏳ → ✅) - Fix pr-review skill to select exactly one recommendation - Align e2e test JWT secret default with docker-compose.yml - Add --admin flag to register_fast_test JWT token generation - Update lock files Closes #1290 Signed-off-by: Jonathan Springer <jps@s390x.com>

.env.example still used the old short `my-test-key` while docker-compose.yml and the E2E test helpers were updated to `my-test-key-but-now-longer-than-32-bytes` in #3716. Users who copied .env.example to .env got a secret mismatch that caused `make test-mcp-cli` to hang. See #3889 for the remaining files that need the same update. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

…update roadmap (#3716) - Remove importchecker and unimport from Makefile, pyproject.toml, and CI workflow (redundant with ruff/flake8 F401 rule) - Change `make coverage` pytest flag from -rA to -rfE to suppress log capture noise from passing tests - Mark 33 closed issues in roadmap.md (⏳ → ✅) - Fix pr-review skill to select exactly one recommendation - Align e2e test JWT secret default with docker-compose.yml - Add --admin flag to register_fast_test JWT token generation - Update lock files Closes #1290 Signed-off-by: Jonathan Springer <jps@s390x.com>

PR #3716 updated docker-compose.yml and mcp_test_helpers.py to use `my-test-key-but-now-longer-than-32-bytes` (meeting the 32-byte minimum for HS256 per RFC 7518 §3.2) but missed ~70 other files that still hardcoded the old `my-test-key`. This caused test failures (make test-mcp-cli hangs, load tests fail auth) when .env is derived from .env.example. Updated: - All docker-compose variant files (debug, embedded, performance, verbose) - All E2E and load test defaults - All scripts and smoketests - Helm chart values, schema, and docs - Makefile targets - All documentation examples - Added long key to validate_env.py weak_jwt list Not changed (intentionally): - mcpgateway/config.py:286 — Python config default (source of truth for standalone `make dev`) - mcpgateway/config.py:888 — already lists both keys in weak_secrets - mcpgateway/config.py:1088, main.py:1955,2040 — guards checking for the default value - tests/unit/test_main_helpers_extra.py:55 — test that mocks the default Closes #3889 Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

.env.example still used the old short `my-test-key` while docker-compose.yml and the E2E test helpers were updated to `my-test-key-but-now-longer-than-32-bytes` in #3716. Users who copied .env.example to .env got a secret mismatch that caused `make test-mcp-cli` to hang. See #3889 for the remaining files that need the same update. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

PR #3716 updated docker-compose.yml and mcp_test_helpers.py to use `my-test-key-but-now-longer-than-32-bytes` (meeting the 32-byte minimum for HS256 per RFC 7518 §3.2) but missed ~70 other files that still hardcoded the old `my-test-key`. This caused test failures (make test-mcp-cli hangs, load tests fail auth) when .env is derived from .env.example. Updated: - All docker-compose variant files (debug, embedded, performance, verbose) - All E2E and load test defaults - All scripts and smoketests - Helm chart values, schema, and docs - Makefile targets - All documentation examples - Added long key to validate_env.py weak_jwt list Not changed (intentionally): - mcpgateway/config.py:286 — Python config default (source of truth for standalone `make dev`) - mcpgateway/config.py:888 — already lists both keys in weak_secrets - mcpgateway/config.py:1088, main.py:1955,2040 — guards checking for the default value - tests/unit/test_main_helpers_extra.py:55 — test that mocks the default Closes #3889 Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix(validation): remove single pipe from forbidden description patterns Remove single pipe character ("|") from the default TOOL_DESCRIPTION_FORBIDDEN_PATTERNS list. The pipe is a valid character in LogQL (|=, |~), PromQL, regex patterns, and Markdown tables. The dangerous shell OR operator "||" remains blocked. Also aligns ToolUpdate.validate_description with ToolCreate by using the configurable settings.tool_description_forbidden_patterns instead of a hardcoded list, ensuring consistent behavior when the pattern list is customized via environment variables. Closes #3811 Signed-off-by: NAYANA.R <nayana.r7813@gmail.com> Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(env): align .env.example JWT secret with docker-compose default .env.example still used the old short `my-test-key` while docker-compose.yml and the E2E test helpers were updated to `my-test-key-but-now-longer-than-32-bytes` in #3716. Users who copied .env.example to .env got a secret mismatch that caused `make test-mcp-cli` to hang. See #3889 for the remaining files that need the same update. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * chore: apply linter and formatter fixes Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(env): align all JWT secret defaults with docker-compose (#3889) PR #3716 updated docker-compose.yml and mcp_test_helpers.py to use `my-test-key-but-now-longer-than-32-bytes` (meeting the 32-byte minimum for HS256 per RFC 7518 §3.2) but missed ~70 other files that still hardcoded the old `my-test-key`. This caused test failures (make test-mcp-cli hangs, load tests fail auth) when .env is derived from .env.example. Updated: - All docker-compose variant files (debug, embedded, performance, verbose) - All E2E and load test defaults - All scripts and smoketests - Helm chart values, schema, and docs - Makefile targets - All documentation examples - Added long key to validate_env.py weak_jwt list Not changed (intentionally): - mcpgateway/config.py:286 — Python config default (source of truth for standalone `make dev`) - mcpgateway/config.py:888 — already lists both keys in weak_secrets - mcpgateway/config.py:1088, main.py:1955,2040 — guards checking for the default value - tests/unit/test_main_helpers_extra.py:55 — test that mocks the default Closes #3889 Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(security): detect both JWT default secrets in guard paths The secure_secrets flag and critical-issues check only matched the short `my-test-key` default. Users running with the docker-compose default `my-test-key-but-now-longer-than-32-bytes` would bypass the security warning and the `secure_secrets: false` status flag. - config.py get_security_status(): `!=` → `not in (short, long)` - main.py validate_security_configuration(): same - main.py security recommendations log: same - validate_env.py already had both (updated in prior commit) - config.py:888 weak_secrets already had both Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * chore: update .secrets.baseline line numbers after reformatting Pre-commit detect-secrets hook requires line numbers to match. The linter/formatter commit shifted lines in db_util.py. All entries remain is_secret=false (confirmed false positives). Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * chore: allowlist test JWT secrets for detect-secrets hook The longer JWT default triggers IBM detect-secrets "Secret Keyword" detection on 7 lines that are all test/dev defaults. Added `pragma: allowlist secret` inline comments. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * chore: update .secrets.baseline after allowlist pragmas Pre-commit detect-secrets hook removed entries that are now covered by inline `pragma: allowlist secret` comments, and adjusted line numbers. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * baseline Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> --------- Signed-off-by: NAYANA.R <nayana.r7813@gmail.com> Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> Co-authored-by: Mihai Criveti <crivetimihai@gmail.com>

…update roadmap (#3716) - Remove importchecker and unimport from Makefile, pyproject.toml, and CI workflow (redundant with ruff/flake8 F401 rule) - Change `make coverage` pytest flag from -rA to -rfE to suppress log capture noise from passing tests - Mark 33 closed issues in roadmap.md (⏳ → ✅) - Fix pr-review skill to select exactly one recommendation - Align e2e test JWT secret default with docker-compose.yml - Add --admin flag to register_fast_test JWT token generation - Update lock files Closes #1290 Signed-off-by: Jonathan Springer <jps@s390x.com>

* fix(validation): remove single pipe from forbidden description patterns Remove single pipe character ("|") from the default TOOL_DESCRIPTION_FORBIDDEN_PATTERNS list. The pipe is a valid character in LogQL (|=, |~), PromQL, regex patterns, and Markdown tables. The dangerous shell OR operator "||" remains blocked. Also aligns ToolUpdate.validate_description with ToolCreate by using the configurable settings.tool_description_forbidden_patterns instead of a hardcoded list, ensuring consistent behavior when the pattern list is customized via environment variables. Closes #3811 Signed-off-by: NAYANA.R <nayana.r7813@gmail.com> Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(env): align .env.example JWT secret with docker-compose default .env.example still used the old short `my-test-key` while docker-compose.yml and the E2E test helpers were updated to `my-test-key-but-now-longer-than-32-bytes` in #3716. Users who copied .env.example to .env got a secret mismatch that caused `make test-mcp-cli` to hang. See #3889 for the remaining files that need the same update. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * chore: apply linter and formatter fixes Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(env): align all JWT secret defaults with docker-compose (#3889) PR #3716 updated docker-compose.yml and mcp_test_helpers.py to use `my-test-key-but-now-longer-than-32-bytes` (meeting the 32-byte minimum for HS256 per RFC 7518 §3.2) but missed ~70 other files that still hardcoded the old `my-test-key`. This caused test failures (make test-mcp-cli hangs, load tests fail auth) when .env is derived from .env.example. Updated: - All docker-compose variant files (debug, embedded, performance, verbose) - All E2E and load test defaults - All scripts and smoketests - Helm chart values, schema, and docs - Makefile targets - All documentation examples - Added long key to validate_env.py weak_jwt list Not changed (intentionally): - mcpgateway/config.py:286 — Python config default (source of truth for standalone `make dev`) - mcpgateway/config.py:888 — already lists both keys in weak_secrets - mcpgateway/config.py:1088, main.py:1955,2040 — guards checking for the default value - tests/unit/test_main_helpers_extra.py:55 — test that mocks the default Closes #3889 Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(security): detect both JWT default secrets in guard paths The secure_secrets flag and critical-issues check only matched the short `my-test-key` default. Users running with the docker-compose default `my-test-key-but-now-longer-than-32-bytes` would bypass the security warning and the `secure_secrets: false` status flag. - config.py get_security_status(): `!=` → `not in (short, long)` - main.py validate_security_configuration(): same - main.py security recommendations log: same - validate_env.py already had both (updated in prior commit) - config.py:888 weak_secrets already had both Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * chore: update .secrets.baseline line numbers after reformatting Pre-commit detect-secrets hook requires line numbers to match. The linter/formatter commit shifted lines in db_util.py. All entries remain is_secret=false (confirmed false positives). Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * chore: allowlist test JWT secrets for detect-secrets hook The longer JWT default triggers IBM detect-secrets "Secret Keyword" detection on 7 lines that are all test/dev defaults. Added `pragma: allowlist secret` inline comments. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * chore: update .secrets.baseline after allowlist pragmas Pre-commit detect-secrets hook removed entries that are now covered by inline `pragma: allowlist secret` comments, and adjusted line numbers. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * baseline Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> --------- Signed-off-by: NAYANA.R <nayana.r7813@gmail.com> Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> Co-authored-by: Mihai Criveti <crivetimihai@gmail.com>

…update roadmap (IBM#3716) - Remove importchecker and unimport from Makefile, pyproject.toml, and CI workflow (redundant with ruff/flake8 F401 rule) - Change `make coverage` pytest flag from -rA to -rfE to suppress log capture noise from passing tests - Mark 33 closed issues in roadmap.md (⏳ → ✅) - Fix pr-review skill to select exactly one recommendation - Align e2e test JWT secret default with docker-compose.yml - Add --admin flag to register_fast_test JWT token generation - Update lock files Closes IBM#1290 Signed-off-by: Jonathan Springer <jps@s390x.com>

* fix(validation): remove single pipe from forbidden description patterns Remove single pipe character ("|") from the default TOOL_DESCRIPTION_FORBIDDEN_PATTERNS list. The pipe is a valid character in LogQL (|=, |~), PromQL, regex patterns, and Markdown tables. The dangerous shell OR operator "||" remains blocked. Also aligns ToolUpdate.validate_description with ToolCreate by using the configurable settings.tool_description_forbidden_patterns instead of a hardcoded list, ensuring consistent behavior when the pattern list is customized via environment variables. Closes IBM#3811 Signed-off-by: NAYANA.R <nayana.r7813@gmail.com> Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(env): align .env.example JWT secret with docker-compose default .env.example still used the old short `my-test-key` while docker-compose.yml and the E2E test helpers were updated to `my-test-key-but-now-longer-than-32-bytes` in IBM#3716. Users who copied .env.example to .env got a secret mismatch that caused `make test-mcp-cli` to hang. See IBM#3889 for the remaining files that need the same update. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * chore: apply linter and formatter fixes Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(env): align all JWT secret defaults with docker-compose (IBM#3889) PR IBM#3716 updated docker-compose.yml and mcp_test_helpers.py to use `my-test-key-but-now-longer-than-32-bytes` (meeting the 32-byte minimum for HS256 per RFC 7518 §3.2) but missed ~70 other files that still hardcoded the old `my-test-key`. This caused test failures (make test-mcp-cli hangs, load tests fail auth) when .env is derived from .env.example. Updated: - All docker-compose variant files (debug, embedded, performance, verbose) - All E2E and load test defaults - All scripts and smoketests - Helm chart values, schema, and docs - Makefile targets - All documentation examples - Added long key to validate_env.py weak_jwt list Not changed (intentionally): - mcpgateway/config.py:286 — Python config default (source of truth for standalone `make dev`) - mcpgateway/config.py:888 — already lists both keys in weak_secrets - mcpgateway/config.py:1088, main.py:1955,2040 — guards checking for the default value - tests/unit/test_main_helpers_extra.py:55 — test that mocks the default Closes IBM#3889 Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(security): detect both JWT default secrets in guard paths The secure_secrets flag and critical-issues check only matched the short `my-test-key` default. Users running with the docker-compose default `my-test-key-but-now-longer-than-32-bytes` would bypass the security warning and the `secure_secrets: false` status flag. - config.py get_security_status(): `!=` → `not in (short, long)` - main.py validate_security_configuration(): same - main.py security recommendations log: same - validate_env.py already had both (updated in prior commit) - config.py:888 weak_secrets already had both Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * chore: update .secrets.baseline line numbers after reformatting Pre-commit detect-secrets hook requires line numbers to match. The linter/formatter commit shifted lines in db_util.py. All entries remain is_secret=false (confirmed false positives). Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * chore: allowlist test JWT secrets for detect-secrets hook The longer JWT default triggers IBM detect-secrets "Secret Keyword" detection on 7 lines that are all test/dev defaults. Added `pragma: allowlist secret` inline comments. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * chore: update .secrets.baseline after allowlist pragmas Pre-commit detect-secrets hook removed entries that are now covered by inline `pragma: allowlist secret` comments, and adjusted line numbers. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * baseline Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> --------- Signed-off-by: NAYANA.R <nayana.r7813@gmail.com> Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> Co-authored-by: Mihai Criveti <crivetimihai@gmail.com>

jonpspri requested a review from crivetimihai as a code owner March 18, 2026 03:22

Copilot AI review requested due to automatic review settings March 18, 2026 03:22

Copilot started reviewing on behalf of jonpspri March 18, 2026 03:23 View session

Copilot AI reviewed Mar 18, 2026

View reviewed changes

Comment thread Makefile

Comment thread pyproject.toml

crivetimihai added chore Linting, formatting, dependency hygiene, or project maintenance chores SHOULD P2: Important but not vital; high-value items that are not crucial for the immediate release devops DevOps activities (containers, automation, deployment, makefiles, etc) labels Mar 20, 2026

crivetimihai added this to the Release 1.1.0 milestone Mar 20, 2026

jonpspri force-pushed the jps-housekeeping-03-17 branch 4 times, most recently from 097983b to 3e64fa2 Compare March 26, 2026 21:45

jonpspri requested review from kevalmahajan and madhav165 as code owners March 26, 2026 21:45

jonpspri force-pushed the jps-housekeeping-03-17 branch from 3e64fa2 to 74c3971 Compare March 26, 2026 21:50

jonpspri force-pushed the jps-housekeeping-03-17 branch from 74c3971 to b4505f1 Compare March 26, 2026 21:55

jonpspri self-assigned this Mar 26, 2026

jonpspri merged commit 1bdd661 into main Mar 26, 2026
29 checks passed

jonpspri deleted the jps-housekeeping-03-17 branch March 26, 2026 22:09

crivetimihai mentioned this pull request Mar 27, 2026

[BUG]: JWT secret default mismatch after #3716 — E2E tests, docker-compose variants, and scripts still use old key #3889

Closed

crivetimihai mentioned this pull request Mar 27, 2026

fix/3811-pipe-validation-issue #3814

Merged

4 tasks

Navigation Menu

Uh oh!

chore: remove redundant linters, fix coverage output, update roadmap - #3716

chore: remove redundant linters, fix coverage output, update roadmap#3716
jonpspri merged 1 commit into
mainfrom
jps-housekeeping-03-17

jonpspri commented Mar 18, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Mar 18, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

jonpspri commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

github-actions Bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jonpspri commented Mar 18, 2026 •

edited

Loading

github-actions Bot commented Mar 18, 2026 •

edited

Loading