build(deps): consolidate account-unification dependency updates - #33
Conversation
…in ruff rule set Dependabot opened five PRs (#27-#31) bumping account_unification dependencies, but each only edited pyproject.toml (or targeted a transitive package) without regenerating uv.lock, so every one fails `uv sync --locked` on the account-unification-tests gate ("The lockfile at uv.lock needs to be updated"). Apply all five bumps in one lock-consistent change: - fastapi 0.139.0 -> 0.140.13 (pulls starlette 1.3.1) - uvicorn 0.51.0 -> 0.52.0 - ruff 0.15.21 -> 0.16.0 (dev) - annotated-doc 0.0.4 -> 0.0.5 (transitive) - annotated-types 0.7.0 -> 0.8.0 (transitive) ruff 0.16.0 widened its implicit default rule set (adding flake8-bugbear, pyupgrade, flake8-pyi, flake8-blind-except, RUF100, isort), which surfaced 21 lints on code that previously passed. Pin the classic default select (["E4","E7","E9","F"]) so the established lint policy stays explicit and stable across ruff upgrades instead of silently changing on a version bump. Verified in services/account_unification: `uv sync --locked --extra dev`, `ruff check app tests tools` (All checks passed), `interrogate .` (100%), `pytest -q` (52 passed). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AqtiEQFfuYFsS75Aku9tPT
📝 WalkthroughWalkthrough
Changes패키지 및 린트 설정 업데이트
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Status on this dependency consolidation:
Generated by Claude Code |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
5c7e1dd820d887e862bafa6b187c429c4176db53. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- SAST Semgrep/Semgrep (multi-language SAST): FAILURE (https://github.com/ContextualWisdomLab/keyverse/actions/runs/30455845708/job/90589076334)
- Semgrep (multi-language SAST) check run: failure (https://github.com/ContextualWisdomLab/keyverse/actions/runs/30455845708/job/90589076334)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Test: test_healthcheck.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_healthcheck.py"]
R2 --> V2["targeted test run"]
|
…llib finding The org-central "Semgrep (multi-language SAST)" gate reports a real Medium (WARNING) finding on every keyverse PR, blocking OpenCode approval: python.lang.security.audit.dynamic-urllib-use-detected services/account_unification/app/healthcheck.py:18 — dynamic value passed to urllib.request.urlopen (urllib honours file://, so a caller-controlled URL could read arbitrary files). Mitigate the actual risk by rejecting any non-http(s) scheme before opening the URL (closes the file:// vector), then annotate the audited call with a narrow, documented `# nosemgrep` for that single rule. Add a regression test for the rejected-scheme path. Fixed at base so all open keyverse PRs inherit a clean SAST gate. Verified in services/account_unification: `ruff check app tests tools`, `interrogate .` (100%), `pytest -q`. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AqtiEQFfuYFsS75Aku9tPT
|
Correction to my earlier comment: I mis-read the Fixed at base in Generated by Claude Code |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head3e033462e719dc19d36e70a764d62379bafba056. -
Head SHA:
3e033462e719dc19d36e70a764d62379bafba056 -
Workflow run: 30482870472
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Test: test_healthcheck.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_healthcheck.py"]
R2 --> V2["targeted test run"]
|
Blocker triage for the
Generated by Claude Code |
Integrate the validated AnyIO lockfile refresh into the consolidated account-unification dependency branch.
Integrate the validated certificate bundle lockfile refresh into the consolidated account-unification dependency branch.
seonghobae
changed the title
Dismissed as stale: it evaluated an earlier head with a Semgrep failure. The dependency branch has since been rebuilt with lock-consistent updates and is undergoing fresh current-head checks.
2 participants
Summary
Consolidates the account-unification dependency updates into one lock-consistent change. Merging the original Dependabot PRs independently would leave
pyproject.toml,uv.lock, and the hash-pinnedrequirements-dev.txtout of sync.fastapiuvicornruffannotated-docannotated-typesanyiocertifiStable Ruff policy
Ruff 0.16 expands its implicit default rules. This PR makes the established repository policy explicit with
select = ["E4", "E7", "E9", "F"], avoiding an unrelated lint-policy migration in a dependency-only update.Verification required
uv sync --locked --extra devuv run ruff check app tests toolsuv run interrogate .at 100%uv run pytest -qSupersedes #17, #20, #27, #28, #29, #30, and #31.
Summary by CodeRabbit