Upgrade dependencies, migrate to Copilot SDK 1.x, fix cost estimation, act on code review findings#53
Merged
Merged
Conversation
…, act on code review findings - Upgrade all dependencies (uv lock --upgrade), bump github-copilot-sdk 0.3.0 -> 1.0.6 - Migrate runner.py/judge.py to the SDK 1.x CopilotClient API; fix PermissionDecisionApproveOnce import path (copilot.session -> copilot.generated.rpc) - Wire up cost estimation (was dead code); pre-fill pricing.toml for new default models - Bump default/integration test models to frontier flagships - Investigate premium_requests SDK event gap (documented as upstream limitation) - Fix broken docs examples (sessions.md, evals.md, CONTRIBUTING.md) referencing removed PydanticAI harness - Harden CI: pin all core workflow actions to SHAs, add missing permissions blocks, fix hardcoded Azure endpoint, fix SECURITY.md reporting method - Remove dead hover-popup report feature (scripts.js/overlay.py/report.css) - Replace placeholder assertion in test_04_agent_selector.py - Add unit test coverage for plugin_options.py, plugin_recording.py, plugin.py hooks, execution/servers.py (89 new tests) - Fix MCPServerProcess.start() resource leak on failed tools wait, found by the new tests Note: pyright and mkdocs-build pre-commit hooks skipped locally (SKIP env var) -- both require 'uv run' which fails to build cryptography from source on this Windows ARM64 host (no MSVC linker; known env limitation, dev workflow uses WSL2). Both verified passing via WSL2 uv run immediately before this commit (pyright: 0 errors; mkdocs build --strict: success).
Dependency ReviewThe following issues were found:
License Issuesuv.lock
OpenSSF ScorecardScorecard details
Scanned Files
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Drop the redundant 'import pytest_skill_engineering.execution.servers as servers_module' alias flagged by CodeQL (module imported both ways in the same file); monkeypatch the shared sys module directly instead, since it's the same singleton object referenced by servers.py. pyright/mkdocs-build hooks skipped locally (same Windows ARM64 MSVC/cryptography build limitation as prior commit); verified via WSL2 uv run immediately before commit: pyright 0 errors, full unit suite 520 passed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
uv lock --upgradeacross all 39 packages;github-copilot-sdk0.3.0 -> 1.0.6 (breaking client API change, migratedrunner.py/judge.py)CopilotEval.cost_usdwas dead code (hardcoded0.0); now computed from real token usage viapricing.tomlclaude-opus-4.8/gpt-5.6-solsessions.md,evals.md,CONTRIBUTING.md)permissions:blocks; replaced a hardcoded Azure endpoint with a secret reference; fixedSECURITY.mdreporting method and stale version tableassert Truein a visual test with a real console/pageerror checkplugin_options.py,plugin_recording.py,plugin.pyhooks,execution/servers.py)MCPServerProcess.start()leaked its subprocess/connection when the required-tools wait check failedValidation
ruff check/ruff format --check: cleanpyright: 0 errorsmkdocs build --strict: passestests/integration/copilot/test_01_basic.py, real Copilot SDK calls againstclaude-opus-4.8andgpt-5.6-sol): 4/4 passed, judge/AI-insights analysis generated correctly with non-zero cost figuresKnown Issues (documented in CHANGELOG)
premium_requestsremains always0.0- confirmed upstream SDK gap, not fixable from this codebase today