chore(deps): bump ruff from 0.15.22 to 0.16.1 in /.github - #1953
Merged
Conversation
This was referenced Aug 8, 2026
kyle-sexton
added a commit
that referenced
this pull request
Aug 8, 2026
…#1983) ## Summary `fleet-state.sh` excludes `$HOME` from project context, because that directory is USER scope and reading `$HOME/.claude/settings.json` as the project map duplicates the user map. The exclusion did not hold. It compared the native path `pwd -W` reports against `$HOME` exactly as the environment carried it — one directory, two spellings. An MSYS mount alias has no drive letter for the normalizer to reconcile, so `$HOME=/tmp/x` never equalled the `C:/Users/…/Temp/x` reported for the same place. `PROJECT_ROOT` was then set to `$HOME` and the duplication happened silently. Both sides now go through `pwd -W` before normalization. Normalizing harder could not have fixed it: the two inputs disagreed before the normalizer saw them. ## Changes - `fleet-state.sh`: derive the `$HOME` side of the comparison through `pwd -W` (falling back to `pwd`, then to `$HOME`), with the reasoning recorded at the site. - `fleet-state.test.sh`: record that the existing case is load-bearing only on Git Bash — on a POSIX runner both spellings already agree, so it passes there whether or not the exclusion works. - `claude-ops` **0.27.1 → 0.27.2** with a matching CHANGELOG entry. Closes #1982 ## Why CI never caught it `plugin-gate` runs on `ubuntu-24.04`, where `$HOME` and `pwd` agree, so the case passes regardless. It was found by a local full-suite sweep and split out of #1972, which flagged it as a different root cause from that ticket's two ruff failures. ## Related - #1972 — the sweep that found this; its two remaining failures are ruff-default churn with a separate root cause and are not touched here. - #1856, #1871, #1953 — the ruff pin divergence behind those two, not this one. ## Test plan - [x] Standalone reproduction of the test's exact fixture: `currentProject` was `false`, is now `null` - [x] `fleet-state.test.sh` — 34 cases, 0 failed (was 34 / 1 failed) - [x] `shellcheck -x` on the changed script — clean - [x] `scripts/check-shell-portability.sh` — no unexcused GNU-only constructs - [x] `scripts/check-changelog-parity.sh --check-bump` — PASS - [x] `scripts/validate-plugins.sh` — PASS - [x] `markdownlint-cli2` on the CHANGELOG — 0 issues - [ ] CI green on the pushed head --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
kyle-sexton
added a commit
to melodic-software/standards
that referenced
this pull request
Aug 8, 2026
…ff consumer (#336) Closes #335 ## Summary Registers `ruff` for `melodic-software/claude-code-plugins` — as `locally-owned`, not `managed`. ## What changed relative to the issue #335 proposed adopting the managed component. This lands the other branch of the same decision, deliberately: that repo now owns a `ruff.toml` selecting `E4`, `E7`, `E9`, and `F`, and the manifest records that ownership. The issue's own measurement is the reason. The canonical policy reports **385** findings against that tree; upstream's bare 0.16.0 defaults report **166** (the issue's 130 predates ~2.8k lines of merged work). Adoption is a migration — mostly `S`, `ERA`, `FIX`, `PTH`, `ARG`, `RET`, and the `TID` relative-import ban meeting a codebase never held to them — and blocking that repo's ruff pin bump behind a 385-finding migration is what has kept the pin stale in the first place. What #335 actually argued for is preserved: the rule set stops being an implicit default inherited from whatever upstream shipped that week. An explicit `select` delivers that property at either size, which is why the sequencing note in the issue ("adoption should land before, or together with, raising that repo's CI ruff pin") is satisfied by this shape too. The `locally-owned` entry is what keeps the repo-local file from being a second, unregistered lint policy — the exact objection #335 raises against a repo-local `ruff.toml`. The manifest comment records the migration cost and the removal trigger, so moving to `managed` later restores the canonical payload with no archaeology. ## Verification - `distribution/sync-manifest.sh validate --source-root . --manifest distribution/sync-manifest.yml` → `Manifest valid: 34 components, 8 targets`. - `locally-owned` is never read, changed, or deleted by the synchronizer (`distribution/README.md`, "Ownership model"), so this entry cannot cause the canonical `ruff.toml` to overwrite the repo's own. ## Related - melodic-software/claude-code-plugins#1972 — the two red suites this unblocks. - melodic-software/claude-code-plugins#1953 — the Dependabot ruff 0.16.0 bump that becomes safe once `select` is explicit. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
kyle-sexton
added a commit
that referenced
this pull request
Aug 8, 2026
…k the repo (#1991) Closes #1972 ## Summary The repo had no ruff configuration, so every ruff invocation in it linted against whatever upstream's default selection happened to be that release. Ruff 0.16.0 moved that default from 59 rules to 413 and removed eighteen `E`/`F` rules from it — *"E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722"* ([0.16.0 release notes](https://github.com/astral-sh/ruff/releases/tag/0.16.0)). That single change is behind both failures in #1972: the expansion brought the `TRY` category into the default set, and the removals took `E712` out of it. ## Fix - **`ruff.toml`** selects `E4`, `E7`, `E9`, and `F` — the pre-0.16 default set. The rule set is now a decision recorded in the repo rather than one inherited from upstream. It is deliberately a floor: raise it toward the managed policy with `extend-select` as each category is cleared. Registered as `locally-owned` for this repo in melodic-software/standards#336 (merged), which is what keeps it from being a second unregistered lint policy. - **Eval fixtures are excluded.** An audit skill's fixture holds the defect its eval asserts on, so linting it fails by construction. The comment records that exclusion governs *traversal*: Ruff's settings reference states *"Typically, Ruff will lint any paths passed in directly, even if they would typically be excluded"*, and that `force-exclude` *"will cause Ruff to respect these exclusions unequivocally"*. Every invocation here passes directories; the ruff-format hook passes a file explicitly and already sets `--force-exclude`. Verified both ways against the fixture path. - **`ruff-format.test.sh` case 4e selects `E712` in its fixture** instead of relying on it being a default rule. A case asserting on one rule's fix safety must name that rule; this is version-agnostic rather than re-pinned. - **Drops an unused `import stat`** in `python3_alias_probe.py` — a real `F401` the pinned set surfaces (line 90 calls `path.stat()`, the method, not the module). ## The TRY004 decision, recorded #1972 asked for this on its merits rather than by config, so both halves: - **On merits: the rule does not fit these sites.** All six raise on a decoded payload or a persisted state file failing an `isinstance` guard — `babysit_gh.py:603,699,728` on a GraphQL response, `babysit_lease.py:114`, `manage_feedback_ledger.py:176`, and `refresh_pr_branch.py:112` on state files this code wrote itself. None is a caller passing the wrong type to a function. That distinction is the whole argument, so it is worth being explicit that it is a judgment rather than something upstream states. TRY004's own rationale is "the Python documentation states that `TypeError` should be raised upon encountering an inappropriate type"; the Python docs' operative sentence is *"Passing arguments of the wrong type … should result in a `TypeError`"*, which is a caller-contract rule, and they define `RuntimeError` as "an error is detected that doesn't fall in any of the other categories." The broader opening sentence ("an operation or function is applied to an object of inappropriate type") could be read to cover these; the reading taken here is that data-integrity validation of a payload is not argument passing. Anything catching `RuntimeError` at these sites would change behavior if they were retyped. No `noqa` is needed; the sites stand as written. - **Separately: `TRY` is not in the selected set**, so they are not findings today regardless. Recorded so a future `extend-select = ["TRY"]` knows the category was examined and rejected on merits, not merely left unselected. ## What the prefix selection does not buy Review raised that `E4`/`E7`/`E9`/`F` are prefixes, so a later release adding a rule inside one of those categories enables it here automatically — the original wording of this PR overstated the invariant, and the file now says so at the selection. That exposure is real and is closed by version parity rather than by config. The pin in `.github/requirements-ci.txt` is held equal to the fleet inventory (melodic-software/dotfiles `.chezmoidata/uv-tools.yaml`), so a newly-added rule cannot reach CI before a developer or the reverse; melodic-software/dotfiles#416 adds the check that keeps those two equal, and #1953 is the bump that makes them equal today. Enumerating the exact pre-0.16 codes was the alternative. It trades a reviewable statement of intent for a list no reader can evaluate, freezes the policy against genuinely useful new correctness rules inside `F`, and still needs the version pin to be trustworthy — so it buys the appearance of the invariant rather than the invariant. ## Verification - `ruff check --no-cache --statistics plugins/ scripts/` → **0 findings** (166 under bare 0.16.0 defaults before this change). - `bash plugins/ruff-format/hooks/ruff-format.test.sh` → `PASS=52 FAIL=0` (was `PASS=51 FAIL=1`). - `bash plugins/source-control/skills/babysit-prs/scripts/engine.test.sh` → exit 0; `Ran 597 tests ... OK`, ruff section clean (83 findings under bare 0.16.0 defaults before this change). - `bash scripts/run-plugin-tests.sh` → complete sweep of all 170 suites, exit 0, `All plugin tests passed or were skipped.` Those two are also the only suites that invoke ruff at all (`grep -rl 'ruff check\|ruff format' --include=*.sh` finds `plugins/ruff-format/hooks/ruff-format.sh` and `engine.test.sh`), so no other suite could be affected by a lint config. - The ruff-format fixtures build their own repos under `mktemp -d`, which resolves outside the worktree, so they do not inherit this config — case 4e's pass is real evidence about the fixture's own `select`, not about this file. - Local ruff is 0.16.0, matching the fleet pin in `dotfiles` `.chezmoidata/uv-tools.yaml`, so these runs reproduce what a developer sees. CI still installs 0.15.22; #1953 is what closes that half. ## Related - melodic-software/standards#336 — registers the `ruff` component as `locally-owned` for this repo; closes melodic-software/standards#335. - Refs #1953 — the Dependabot bump to ruff 0.16.0. This makes it safe against the failure that happened: with `select` explicit, the bump cannot change which CATEGORIES run. - Refs #1871 — resolves ruff from the pin file rather than PATH; it reads the pin dynamically, so it needs no value change once #1953 lands. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
@dependabot rebase |
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.15.22 to 0.16.1. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.22...0.16.1) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.16.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/pip/dot-github/ruff-0.16.0
branch
from
August 8, 2026 08:06
25dfbbb to
682d724
Compare
kyle-sexton
added a commit
that referenced
this pull request
Aug 8, 2026
Closes #1856 ## Summary A bare `ruff` on `PATH` and the one CI installs can be different versions, and then they disagree about what a finding is. This adds `scripts/run-ruff.sh`, which resolves ruff from the pin declared in `.github/requirements-ci.txt` rather than from `PATH`, and points the `babysit-prs` lint pass at it. **The direction has been re-targeted since this PR was opened, deliberately.** It was written as "align local ruff with CI pin 0.15.22" — pinning workstations *down* to CI. CI has since moved to `ruff==0.16.1` (#1953) and the repo's rule set is pinned explicitly (#1991), so that framing would read as the fleet moving backwards. **No value in this PR changes:** the wrapper parses the pin at run time, so it follows the repository's version wherever it goes and carries no copy of its own. What changed is the title, the docs, and the changelog entry, so a merged commit does not assert the opposite of what the fleet does. ## Fix - **`scripts/run-ruff.sh`** — uses a PATH `ruff` only when it already reports the pinned version (the CI install path), otherwise `uvx ruff==<pin>`; exit 2 when a drifted PATH ruff is all there is and `uvx` is unavailable, exit 127 when neither exists. - **`engine.test.sh`** lints through the wrapper, skipping visibly rather than silently when the pin cannot be resolved. - **`docs/CI-RUNNER-ROUTING.md`** records the local rule, and now also records which way the pin moves: it is held equal to the fleet inventory in melodic-software/dotfiles `.chezmoidata/uv-tools.yaml`, because that is what installs a developer's toolchain. - **`source-control` 0.47.2** with a matching changelog entry (was 0.45.1 against a 0.45.0 baseline; rebased onto 0.47.1). ## A real defect found while re-verifying `engine.test.sh` re-derived the repository root from `BASH_SOURCE` *after* `cd`-ing to its own directory. `BASH_SOURCE` holds the path as invoked, so a relative invocation resolved against the new cwd and landed outside the repository. The lint pass then printed ``` SKIP: scripts/run-ruff.sh not found (lint pass omitted) ``` and the suite exited 0 having linted nothing. Running the suite from the repository root — which is exactly how `scripts/run-plugin-tests.sh` runs it — took that path every time, so the wrapper this PR exists to introduce would have been inert in CI. The script directory is now captured once, before the `cd`. ## Verification - `bash scripts/run-ruff.sh --version` → `ruff 0.15.22` before merging main and `ruff 0.16.1` after, with an unchanged 0.16.0 ruff on `PATH` throughout and no edit to this branch in between. That is the design demonstrated rather than asserted: #1953 landed at 0.16.1 rather than the 0.16.0 its title advertised, and the wrapper followed a version this PR never named. - `bash plugins/source-control/skills/babysit-prs/scripts/engine.test.sh` from the repository root **and** from the script's own directory → exit 0, both printing `== ruff (CI pin via scripts/run-ruff.sh) ==`. Before the lookup fix, the repository-root invocation printed the SKIP line instead. - `shellcheck scripts/run-ruff.sh plugins/source-control/skills/babysit-prs/scripts/engine.test.sh` → clean. - `bash scripts/check-changelog-parity.sh --check-bump origin/main` → `Every plugin whose version changed vs origin/main has a '## [<version>]' CHANGELOG.md entry.` - Merged `origin/main` (100 commits behind at the start); the only conflicts were the `source-control` manifest version and changelog, resolved onto 0.47.1. ## Related - Refs #1991 — pins the repo's rule set so a version bump cannot change which categories run; that and this are the two halves of local-equals-CI. - Refs #1953 — the Dependabot bump, merged at `ruff==0.16.1`, which this wrapper picked up with no change here. - Refs melodic-software/dotfiles#416 — the check that keeps the CI pin and the fleet inventory equal, so the value this wrapper reads stays the one developers run. --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps ruff from 0.15.22 to 0.16.1.
Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
... (truncated)
Commits
80790b3Bump 0.16.1 (#27330)63830f3[ty] Borrow from constraint set storage less often (#27328)f40dca9[ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)0d80497Lint TOML files in the LSP (#26862)d91586bUpdate prek dependencies (#27293)7da4b8b[ty] Respect bounds and constraints in generic materializations (#27228)b20daf7[ty] refactor: add helper function to send partial results (#27249)4d4c8fa[ty] Emit diagnostic when specializing a non-generic class (#26883)7c3e2db[ty] Fix enum class container assignability (#27318)d5ef97f[flake8-return] Fix false positive when variable is read infinallyclaus...