Skip to content

feat: Harden CI, cache dependencies, and automate schema PRs - #186

Merged
rdlauer merged 9 commits into
mainfrom
rob-namespace
Sep 23, 2026
Merged

rdlauer merged 9 commits into
mainfrom
rob-namespace

Conversation

@rdlauer

@rdlauer rdlauer commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

Reviewed every workflow and fixed the defects rather than migrating runners.

  • Skipped Namespace. Public repo, so GitHub runners are free and CI already
    runs in <60s with ~4s queue — migrating would add cost for no gain.
  • Fixed a silent no-op in the schema sync. git diff --quiet misses untracked
    files, so a newly generated API module produced no PR at all.
  • Schema PRs now open with an App token, not GITHUB_TOKEN. Their CI used to park
    in action_required until a human pressed the button — one sat 15 hours.
    Auto-merge is armed on a new build / ci-gate check.
  • Hardening: least-privilege permissions: on all seven workflows (default was
    read/write), timeout-minutes in place of GitHub's 6h default, dependabot.yml.
  • Dropped ddtrace — DD_API_KEY exists nowhere, so it instrumented all five
    matrix jobs and reported to nothing. Added pipenv caching and concurrency.
  • Dev deps pinned and bumped (flake8 7, pydocstyle 6, pytest 9.1.1, twine 7).
    pyproject.toml keeps a range — an == there downgrades consumers' filelock.
  • HIL disabled temporarily (workflow_dispatch only); the rig is offline with 0
    successes in 60 runs. Restore steps are in a banner in each file.

Verified: actionlint clean, flake8 0, 419 tests passing, pipenv verify in sync.

After merge

  • Add build / ci-gate as a required status check — there are currently none,
    and Auto-update: API changes from upstream #178 merged with a failing test.
  • Uncheck "Require branches to be up to date" — it deadlocks auto-merge.
  • Auto-merge still needs one human approval until the review rule moves to a ruleset
    the App bypasses.

🤖 Generated with Claude Code

rdlauer and others added 9 commits September 22, 2026 11:29
Pipfile bumped filelock to ==3.32.7 in 68f10e7 without the lock, which left
pipenv re-resolving the whole dependency set at install time. filelock is the
only package that moves.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
pytest on 3.10 imports exceptiongroup, which needs typing-extensions
(python_version < "3.13"). The lock was generated on 3.14, where that marker is
false, so the package was dropped -- along with tomli, importlib-metadata and
zipp. 3.11+ passed because BaseExceptionGroup is builtin there and pytest never
imports exceptiongroup.

Previously masked: ddtrace depended on typing-extensions unconditionally, so it
was in the lock regardless. Dropping ddtrace removed that cover.

Relocked with `pipenv lock --python 3.10`. Purely additive: 5 backports restored,
nothing removed or bumped. Verified 419 tests passing on both 3.10 and 3.14.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@rdlauer
rdlauer requested a review from Bucknalla September 22, 2026 16:29
@rdlauer
rdlauer merged commit 6da58fa into main Sep 23, 2026
7 checks passed
@rdlauer
rdlauer deleted the rob-namespace branch September 23, 2026 15:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants