Skip to content

ci(python-lint): pin ruff to 0.17.0 and run it via the installing interpreter - #378

Merged
jdfalk merged 3 commits into
mainfrom
ci/pin-ruff-python-lint
Oct 21, 2026
Merged

jdfalk merged 3 commits into
mainfrom
ci/pin-ruff-python-lint

Conversation

@jdfalk

@jdfalk jdfalk commented Oct 20, 2026

Copy link
Copy Markdown
Collaborator

Pin ruff in the shared python-lint

python_lint in ci_workflow.py ran pip install --upgrade ruff when ruff was missing. Every consumer of reusable-ci therefore linted with whatever ruff was newest, so a ruff release could break all consumers' CI overnight.

Changes

  • ci_workflow.py:
    • RUFF_VERSION = "0.17.0".
    • _ensure_ruff installs ruff==<version> with sys.executable -m pip. It also replaces an installed ruff whose version differs, re-checks the version after install, and raises on a mismatch.
    • format --check and check run as sys.executable -m ruff, so a different ruff on PATH (pipx, the runner image) is never used.
  • reusable-ci.yml: a new optional ruff-version input, empty by default, so the script's constant applies. It is passed to the Lint Python step as RUFF_VERSION.
  • ci-tests.yml: the unpinned pip install ruff becomes python -m pip install ruff==0.17.0 plus python -m ruff.
  • Tests: 3 new tests in tests/workflow_scripts/test_ci_workflow.py. The file now has 18 tests, all passing.
  • An end-to-end run of python_lint in a temp venv holding ruff 0.16.10: it replaced ruff with 0.17.0 and then linted clean.
  • ci_workflow.py is also reformatted by this repo's own pre-commit ruff hooks (.github/linters/ruff.toml). That part is formatting only.

Not changed

  • The "Lint Python workflow scripts" job is already pinned at ruff==0.16.10, and is left as is.
  • .pre-commit-config.yaml pins ruff-pre-commit at v0.14.3, and is left as is.

The consumer is falkcorp/audiobook-organizer, which formats against ruff 0.17.0. It will move its reusable-ci and ghcommon-ref pins to this commit once it merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QfaLiLJxzi62hjzmR7uAZH

…erpreter

python_lint ran `pip install --upgrade ruff` when ruff was missing, so every
consumer linted with whatever ruff was newest and a ruff release could break
all consumers' CI at once. It now installs ruff==0.17.0 (RUFF_VERSION, with
an optional reusable-ci `ruff-version` input that defaults to it), replaces a
mismatched installed ruff, re-checks the version after install and fails
loudly on a mismatch, and runs ruff as `sys.executable -m ruff` so a
different ruff on PATH can never be used. ci-tests.yml's unpinned
`pip install ruff` is pinned the same way.

ci_workflow.py is also reformatted by the repo's pre-commit ruff hooks
(.github/linters/ruff.toml); that churn is formatting only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QfaLiLJxzi62hjzmR7uAZH
@github-actions github-actions Bot added size/L github-actions GitHub Actions related work type:documentation Improvements or additions to documentation type:testing Testing related work module:config Configuration management tech:python Python programming language workflow:github-actions GitHub Actions workflows workflow:ci-cd Continuous integration and deployment labels Oct 20, 2026
jdfalk and others added 2 commits October 20, 2026 19:21
The Python CI check linted ci_workflow.py with the repo-root ruff.toml and
found 36 issues that predate the ruff pin: 31 D103, 3 PLW0603, 2 S310.

- one-line docstrings on every public function (D103)
- _CONFIG_CACHE global replaced by functools.lru_cache on
  get_repository_config (PLW0603); behaviour is unchanged, tests clear it via
  cache_clear()
- the urllib fallback in _http_get now refuses non-https URLs before urlopen;
  the S310 noqa is scoped to those two lines and says why
- header: last-edited on ci_workflow.py; test_ci_workflow.py gets a header

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QfaLiLJxzi62hjzmR7uAZH
…refix, docs)

- reusable-ci: ruff-version input sits next to python-version; description
  says "bare version, e.g. 0.17.0", points at RUFF_VERSION instead of
  duplicating the number, and states that it takes effect once the script ref
  includes this change; TODO comment on the separate ruff==0.16.10 job
- ci_workflow.py: strip a leading v from the RUFF_VERSION override; the
  override test is parametrized over bare, v-prefixed and padded values and
  has a docstring
- headers: last-edited on ci-tests.yml, version bumps on touched files
- changelog: rollout section (script ref follows in a separate PR, as in
  #374), known consumers and their effect, the ruff-version escape hatch

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QfaLiLJxzi62hjzmR7uAZH
@jdfalk
jdfalk merged commit 861d4e8 into main Oct 21, 2026
42 checks passed
@jdfalk
jdfalk deleted the ci/pin-ruff-python-lint branch October 21, 2026 13:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

github-actions GitHub Actions related work module:config Configuration management size/L tech:python Python programming language type:documentation Improvements or additions to documentation type:testing Testing related work workflow:ci-cd Continuous integration and deployment workflow:github-actions GitHub Actions workflows

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant