Chore: sync Rhiza template v0.18.8 → v0.19.3 - #767
Merged
Conversation
Ran 'make sync' against the v0.19.3 template and resolved the fallout: - Conflict-marked managed files (.github/workflows/*, .github/CONFIG.md, .claude/commands/rhiza_update.md): took the upstream/incoming side. All workflow 'uses:' refs now pin @v0.19.3; CodeQL/release/sync permissions moved to job level per upstream. - 33 *.rej leftovers were all spurious (the hunks were already applied by the 3-way merge); verified each added line was present, then deleted them. - Makefile (repo-owned): preserved the local MKDOCS_EXTRA_PACKAGES override including '--with-editable .' so mkdocstrings can import the package for API docs; the sync had dropped it. - ruff.toml (locally-hardened): no change needed — local already matched the upstream rule additions. New managed files pulled in: rhiza_fuzzing/mutation/scorecard workflows, DISCUSSION templates, cliff.toml, pip-audit/suppression-audit tests.
v0.19.3's ruff config enforces ANN201 and BLE001. Added '-> str' return annotations to read_readme/read_license and narrowed their blind 'except Exception' to 'except OSError' (both guard file I/O).
'make validate' runs the .rhiza integration test test_default_book_command_does_not_use_editable_install, which v0.19.3 added to enforce that the default 'make book' command installs mkdocstrings but NOT the package as editable. My earlier conflict resolution wrongly restored '--with-editable .' as a repo-owned override; it was actually an intentional upstream policy change. Align the Makefile with it. make validate: 125 passed, 3 skipped.
Contributor
There was a problem hiding this comment.
Pull request overview
Syncs this repository to Rhiza template v0.19.3, bringing in updated CI/security workflows and refreshed template-managed tooling/config, plus a small set of local fixes to satisfy newly enforced lint rules.
Changes:
- Bump Rhiza template pin (
.rhiza/template.yml/.rhiza/template.lock) and update synced workflows (CodeQL/Scorecard/Release/Sync + new fuzzing/mutation stubs). - Update Makefile tooling and quality gates (typecheck now runs
ty+mypy, security/docs-coverage include.rhiza/utils, addgit-cliffchangelog support). - Tighten Ruff configuration and update locally-owned Python code (
web/app.py) to satisfy newANN*/BLE001enforcement.
Reviewed changes
Copilot reviewed 46 out of 47 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| web/app.py | Add return type annotations and narrow exception handling for file I/O helpers and request handler methods. |
| SECURITY.md | Document additional security measures (fuzzing, SBOM attestations). |
| ruff.toml | Enable additional Ruff rule families + expand per-file ignores rationale and coverage. |
| pytest.ini | Disable live CLI logging by default; document opt-in behavior. |
| Makefile | Restore editable install in MKDOCS_EXTRA_PACKAGES for API docs generation. |
| docs/development/TESTS.md | Document how to opt in to live pytest CLI logs per run. |
| cliff.toml | Add git-cliff configuration used by make changelog. |
| .rhiza/utils/suppression_audit.py | Broaden tokenization error handling and add helper docstring. |
| .rhiza/tests/utils/test_suppression_audit.py | Add unit tests for suppression audit utilities. |
| .rhiza/tests/utils/test_pip_audit_policy.py | Add unit tests for pip-audit policy behavior and output handling. |
| .rhiza/tests/stress/README.md | Minor docs cleanup in stress test README. |
| .rhiza/tests/shell/test_scripts.sh | Add shellcheck suppression for an intentionally-retained helper. |
| .rhiza/tests/integration/test_docs_targets.py | Add integration coverage around MkDocs/book targets and extra package flags. |
| .rhiza/tests/api/test_makefile_targets.py | Update Makefile dry-run expectations; make bump test less hardcoded. |
| .rhiza/tests/api/test_make_variable_overrides.py | Update expectations for typecheck path propagation. |
| .rhiza/template.yml | Bump template branch pin to v0.19.3. |
| .rhiza/template.lock | Update template lock metadata and managed file list for v0.19.3. |
| .rhiza/rhiza.mk | Add Windows POSIX-shell probe + defaults for common .env variables; adjust CI OS matrix emission. |
| .rhiza/requirements/tools.txt | Add mypy to Rhiza tooling requirements. |
| .rhiza/make.d/test.mk | Expand typecheck/security/docs-coverage to cover .rhiza/utils and add mypy strict run. |
| .rhiza/make.d/releasing.mk | Bump rhiza-tools pin, add changelog target, adjust release/publish semantics. |
| .rhiza/make.d/bootstrap.mk | Skip pre-commit install when core.hooksPath is set. |
| .rhiza/CONTRIBUTING.md | Add Windows WSL quick-start section and related contributor guidance. |
| .rhiza/completions/rhiza-completion.zsh | Cache make target completion results for performance. |
| .rhiza/completions/rhiza-completion.bash | Cache make target completion results for performance. |
| .rhiza/completions/README.md | Update completion docs to reflect caching behavior and cache location. |
| .rhiza/.rhiza-version | Bump pinned Rhiza CLI version. |
| .rhiza/.env | Expand comments and document defaults for optional env overrides. |
| .rhiza/.cfg.toml | Add bump-my-version rule to keep bundled workflow stubs pinned to the current version. |
| .pre-commit-config.yaml | Update hook revisions; add betterleaks; exclude gh-aw-generated workflows from schema checks. |
| .github/workflows/rhiza_weekly.yml | Update reusable workflow pin to v0.19.3. |
| .github/workflows/rhiza_sync.yml | Move elevated permissions to job-level and update reusable workflow pin. |
| .github/workflows/rhiza_scorecard.yml | Add Scorecard workflow stub with least-privilege job permissions. |
| .github/workflows/rhiza_release.yml | Update release workflow pinning/permissions; adjust SBOM/provenance handling; remove changelog commit job. |
| .github/workflows/rhiza_mutation.yml | Add optional mutation testing workflow stub (opt-in via repo variable). |
| .github/workflows/rhiza_marimo.yml | Update reusable workflow pin to v0.19.3. |
| .github/workflows/rhiza_fuzzing.yml | Add optional fuzzing workflow stub (opt-in via repo variable/config). |
| .github/workflows/rhiza_codeql.yml | Update reusable workflow pin; move write permissions to job-level. |
| .github/workflows/rhiza_ci.yml | Update reusable workflow pin and clarify Python matrix source-of-truth. |
| .github/workflows/rhiza_book.yml | Update reusable workflow pin and set least-privilege top-level permissions. |
| .github/workflows/rhiza_benchmark.yml | Update reusable workflow pin to v0.19.3. |
| .github/pull_request_template.md | Add checklist item for CHANGELOG.md entry. |
| .github/DISCUSSION_TEMPLATE/ideas.yml | Add discussion template for new ideas. |
| .github/DISCUSSION_TEMPLATE/help-wanted.yml | Add discussion template for help-wanted items. |
| .github/CONFIG.md | Document required/optional GitHub Actions secrets/variables (PAT sync + release). |
| .claude/commands/rhiza_update.md | Update Rhiza update procedure and add guidance for configuring workflow variables/secrets. |
| .claude/commands/rhiza_book.md | Add Claude command for building/serving the docs book locally. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ], | ||
| ) | ||
| except Exception as e: | ||
| except OSError as e: |
| with open(license_path, encoding="utf-8") as f: | ||
| license_content = f.read() | ||
| except Exception as e: | ||
| except OSError as e: |
Comment on lines
+32
to
+34
| The Makefile system requires GNU Make and a POSIX shell, so native Windows | ||
| shells (PowerShell, cmd.exe, Git Bash) fail fast with an error. Use the | ||
| Windows Subsystem for Linux instead: |
Comment on lines
+54
to
+56
| git clone https://github.com/jebel-quant/rhiza.git ~/projects/rhiza | ||
| cd ~/projects/rhiza && make install | ||
| ``` |
Comment on lines
+350
to
+352
| releasing_mk = Path(".rhiza/make.d/releasing.mk").read_text() | ||
| version = re.search(r"^_VERSION=(\S+)", releasing_mk, re.MULTILINE).group(1) | ||
| assert f"[MOCK] uvx rhiza-tools>={version} bump" in result.stdout |
Comment on lines
+51
to
+57
| def test_default_book_command_does_not_use_editable_install(git_repo): | ||
| """Test default book dry-run avoids editable local package installation.""" | ||
| result = subprocess.run([MAKE, "-n", "book"], cwd=git_repo, capture_output=True, text=True) # nosec | ||
|
|
||
| assert result.returncode == 0, f"Dry-run failed: {result.stderr}" | ||
| assert "--with-editable ." not in result.stdout | ||
| assert "--with 'mkdocstrings[python]'" in result.stdout |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the Rhiza template pin from v0.18.8 → v0.19.3 (
make sync) and resolves the merge fallout. Between these versions the notable upstream change is movingid-token/security-events: writeto job-level only in the scorecard/codeql/release/sync workflows (least-privilege, Scorecard Token-Permissions), plus new managed files (fuzzing/mutation/scorecard workflows, discussion templates,cliff.toml, pip-audit/suppression-audit tests). v0.19.3 also drops editable install from the defaultmake bookcommand.Conflict resolution
.github/workflows/*,.github/CONFIG.md,.claude/commands/rhiza_update.md): took the upstream/incoming side. All workflowuses:refs now pin@v0.19.3; permissions moved to job level per upstream.*.rejleftovers: all spurious — the 3-way merge had already applied each hunk. Verified every added line was present (and no conflict markers remained), then deleted them. Zero.rejfiles and zero conflict markers remain.Makefile(repo-owned): kept the synced version ofMKDOCS_EXTRA_PACKAGESwithout--with-editable .. I initially restored the editable flag thinking the sync had clobbered a local override, butmake validateshowed v0.19.3 added an integration test (test_default_book_command_does_not_use_editable_install) deliberately enforcing that the default book command installsmkdocstrings[python]but not the package as editable. Aligned with upstream policy.ruff.toml(locally-hardened): no change needed — the local config already matched v0.19.3's rule additions.Gate fallout fixed
v0.19.3's ruff config newly enforces
ANN201andBLE001, which flaggedweb/app.py(locally-owned). Fixed in-scope: added-> strreturn annotations toread_readme/read_licenseand narrowed their blindexcept Exceptiontoexcept OSError(both guard file I/O).Gate results
make fmtmake typecheckmake docs-coveragemake deptrymake securitymake testmake validateNo upstream Rhiza fixes are required — all failures were in locally-owned files and fixed here.
🤖 Generated with Claude Code