[andife]

Summary: Run Ruff in the existing test workflow. Start with fatal syntax and undefined-name checks so CI can enforce correctness without bundling unrelated legacy style cleanup. Testing: Ruff passes with E9, F63, F7, and F82 selected.

[drk-ram]

Reviewed head 7c88399586dd65837f944570bf740a0851c80b36.

Approving. The new step is the right first Ruff gate for this tree: fatal syntax and undefined-name checks, not a style sweep.

.github/workflows/tests.yml runs ruff check --output-format=github --select E9,F63,F7,F82 . after pip install -e ".[dev]". That extra already declares ruff, so the command is on PATH in the same job. E9 / F63 / F7 / F82 is the usual starter set (syntax errors, invalid assert/raise, and undefined names, including F821). --output-format=github will annotate the run rather than only printing a log. Leaving the broader rule set off is the correct call until the existing tree is clean; bundling that cleanup into this PR would hide whether the gate itself works.

I ran that exact select on this head: ruff check --select E9,F63,F7,F82 . passed (Ruff 0.17.0, Windows, Python 3.11). Hosted Actions did not report a check run for this pull request, so this approval is on that local reproduction plus inspection of the workflow, not on a green hosted job. Please let the workflow run once on the merge commit so the annotation path is exercised in Actions.

I am not holding the unpinned actions/checkout@v4 / setup-python@v5 tags or the unpinned ruff extra. Both pre-exist this change. Pinning the Ruff version is worth a follow-up if you want the gate to stop moving under you, but it is not a defect in adding the check.

No application code changes. The step fails the job on a finding, which is what a correctness gate should do.