ci(quality): add report-only Code Quality workflow (mypy + ruff → code scanning) - #190
Conversation
Adds .github/workflows/code-quality.yml with two non-blocking jobs that complement the hard gates in ci.yml: - mypy static type check (report-only): surfaces the known typing backlog (audit H-3) without failing the build; flip continue-on-error off to make it a hard gate once clean. - ruff -> SARIF -> code scanning: emits ruff findings, including the deferred ANN (type-annotation) ratchet backlog, to the code-scanning dashboard. Non-blocking (ci.yml already hard-gates the active rule set). All actions are SHA-pinned to the versions already used in the repo, and no GOV-NNN labels are used so the governance spec-drift check stays green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E98zHqp7UdZGbMKS9M7yjo
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 14c92f0124
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ruff check --extend-select ANN --output-format sarif \ | ||
| src/zettelforge/ > ruff.sarif || true |
There was a problem hiding this comment.
On pull_request runs this is not actually report-only unless the repository has manually relaxed code-scanning failure thresholds: Ruff’s SARIF marks ANN findings with level/problem.severity as error (verified by running this command in the repo), and GitHub’s Code scanning results check fails by default for error-severity alerts (docs). A PR that adds or touches a missing-annotation finding can therefore get a failing Code scanning results / ruff check even though the workflow step uses || true.
Useful? React with 👍 / 👎.
| ruff check --extend-select ANN --output-format sarif \ | ||
| src/zettelforge/ > ruff.sarif || true |
There was a problem hiding this comment.
When Ruff cannot run for reasons other than findings (for example an invalid pyproject.toml rule selector or a future CLI/config incompatibility), this || true still turns the step green after writing an empty or partial ruff.sarif; because the upload step also continues on error, the workflow can silently stop producing dashboard results. Ruff’s help provides --exit-zero specifically to return success only when diagnostics are found, so use that instead of swallowing all execution failures.
Useful? React with 👍 / 👎.
| # findings without failing the build. Drop continue-on-error to make | ||
| # mypy a hard gate once it is clean. Config lives in [tool.mypy]. | ||
| continue-on-error: true | ||
| run: mypy src/zettelforge/ |
There was a problem hiding this comment.
With the current dev install, PyYAML is present but its stub package is not; running this exact mypy invocation reports Library stubs not installed for "yaml" across the YAML-using modules and exits with errors prevented further checking, so the job mostly reports missing third-party stubs instead of the intended typing backlog. Add types-PyYAML to the environment or suppress that import-untyped error before invoking mypy.
Useful? React with 👍 / 👎.
3 participants
Adds
.github/workflows/code-quality.yml— a non-blocking quality workflow that complements the hard gates already inci.yml(ruff lint/format, pip-audit, tests, coverage). It runs on push tomaster, PRs, and weekly.Jobs
mypy— static type check (report-only). The repo configures mypy ([tool.mypy],disallow_untyped_defs = true) but never ran it in CI. This surfaces type findings without failing the build, because there's a known typing backlog (audit H-3) to ratchet per-module. Flipcontinue-on-erroroff to make it a hard gate once clean.ruff-scan— ruff → SARIF → code scanning.ci.ymlalready hard-gates the active ruff rule set, so this--extend-select ANN(the deferred type-annotation backlog) and uploads SARIF to the code-scanning dashboard (thesettings/code-qualitypage). Non-blocking; findings appear as code-scanning alerts, not build failures.Why report-only / safe
ANN) would break a hard gate today, so this is deliberately non-gating — it makes them visible for ratcheting rather than blocking work.checkout@9c091bb,setup-python@ece7cb06,upload-sarif@54f647b— the same SARIF pattern assnyk-security.yml, which proves third-party SARIF uploads work under the default CodeQL setup).GOV-NNNlabels, so thegovernancespec-drift check stays green (nocontrols.yamlchange needed).Notes / knobs
ANNupload will surface the annotation backlog (~120 findings) as dashboard alerts — that's intentional (a live view of the ratchet). If it's too noisy, drop--extend-select ANNand it'll only report new active-rule findings.mypyto a hard gate as modules are annotated (ties into audit H-3), and the earlier-noted Python 3.10 CI leg.🤖 Generated with Claude Code
https://claude.ai/code/session_01E98zHqp7UdZGbMKS9M7yjo
Generated by Claude Code