Port git-auto-merge check set + bandit + post-release install verification - #36
Merged
Conversation
…mat:check row, release-verify workflow (#35) pyright found a real bug: get_home_dir crashed with TypeError when HOME was unset (now a clear KeyError), and execute_module relied on pytest having already imported importlib.util/machinery.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the applicable checks from git-auto-merge's CI (#35), per-row like the rest.
New checks (each its own CI row)
get_home_dir()didgetenv('HOME') + '/'→TypeErrorwhen HOME is unset (nowenviron['HOME'], a clear KeyError), andexecute_moduleusedimportlib.util/importlib.machinerywithout importing them (worked only because pytest imports them first).# nosec+ comments (B602shell=— only used with fixed command strings; B310 urlopen — hardcoded https URLs). Also replaced a release-pathassertwith an explicit raise (B101).known_first_partycovers the flat src/ modules, pytest plugins/CLI tools per-rule-ignored (invoked, never imported). Clean.release-verify workflow
New
release-verify.yml: on release-published (+ manual dispatch), installs from the live tap —brew install clintmod/formulas/macprefs— with 5×60s retries (the v1.0.27 rollout hit exactly this propagation transient), asserts the installed version equals the release tag, and runs a real backup. This covers the gap between thebuildjob (local tarball) and what users actually run.Skipped, with reasons
flake8 (ruff already runs pyflakes/pycodestyle — would double-report), hadolint/docker (no Dockerfile).
New umbrella task:
rite checkruns everything CI runs, in parallel. All checks verified green locally.Closes #35
🤖 Generated with Claude Code