chore: migrate tooling from Poetry to uv and modernize pre-commit#144
Open
williaby wants to merge 4 commits into
Open
chore: migrate tooling from Poetry to uv and modernize pre-commit#144williaby wants to merge 4 commits into
williaby wants to merge 4 commits into
Conversation
- Replace prepare-poetry.yml with prepare-uv.yml using astral-sh/setup-uv (SHA-pinned to v8.1.0). GCP Artifact Registry auth is unchanged; uv sync replaces poetry install and uv export replaces poetry export. Update all workflows that call the prepare workflow. - Rewrite .pre-commit-config.yaml with SHA-pinned hooks for ruff + ruff-format (replacing black/flake8/isort), basedpyright (type checking), detect-secrets (secret scanning), and the standard pre-commit-hooks for trailing-whitespace and end-of-file-fixer. Local Nox-driven hooks now invoke via uv run. - Migrate pyproject.toml from [tool.poetry] sections to PEP 621 [project] + [dependency-groups] + [tool.uv], switching the build backend to hatchling. Remove poetry.lock and poetry.toml (uv.lock will be generated on first uv sync). Closes #136 References #82 (redirected to ruff) References #96 (redirected to uv)
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (18)
📝 WalkthroughWalkthroughMigrates the project from Poetry to uv by introducing a new ChangesPoetry to uv Dependency Management Migration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
FIPS Compatibility Check: PASSED
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub. |
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
- Generate uv.lock so uv sync --frozen succeeds in every workflow that calls prepare-uv.yml or otherwise uses the lock-based install path (python-compatibility matrix, fips-compatibility, code quality, etc.). - Add `permissions: contents: read` to prepare-uv.yml to satisfy CodeQL alert that workflows must minimize GITHUB_TOKEN scope.
FIPS Compatibility Check: PASSED
|
Replaces the stale Poetry-exported file. Resolves the Socket Security warning about nltk@3.9.1 (GHSA-7p94-766c-hgjp, Zip Slip): the uv lock resolves nltk@3.9.4 which is patched.
FIPS Compatibility Check: PASSED
|
There was a problem hiding this comment.
Pull request overview
Migrates LedgerBase’s Python tooling from Poetry-centric configuration to an uv + PEP 621 setup, and modernizes pre-commit to use ruff/ruff-format plus basedpyright, while updating CI workflows to call a new prepare-uv reusable workflow.
Changes:
- Replace Poetry-managed project metadata/dependencies in
pyproject.tomlwith PEP 621 + uv conventions and switch build backend to Hatchling. - Rewrite
.pre-commit-config.yamlto use ruff/ruff-format, basedpyright, detect-secrets, and update local hooks to useuv run. - Add
.github/workflows/prepare-uv.yml, deleteprepare-poetry.yml, and update multiple workflows/templates to reference the new reusable workflow.
Reviewed changes
Copilot reviewed 21 out of 23 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
pyproject.toml |
Migrates project metadata/deps to PEP 621 + uv; adds hatchling + basedpyright config. |
poetry.toml |
Removes Poetry-specific configuration. |
.pre-commit-config.yaml |
Updates hooks to ruff/ruff-format, basedpyright, detect-secrets; moves local hooks to uv run. |
.github/workflows/prepare-uv.yml |
New reusable workflow for setting up uv + Assured OSS and exporting dev requirements. |
.github/workflows/prepare-poetry.yml |
Removes the old Poetry-based reusable workflow. |
.github/workflows/weekly-check.yml |
Points the “prepare” job at prepare-uv.yml. |
.github/workflows/templates/test-matrix.yml |
Updates the “prepare” job to use prepare-uv.yml. |
.github/workflows/templates/python-template-pip.yml |
Updates the “prepare” job to use prepare-uv.yml. |
.github/workflows/templates/nox-template.yml |
Updates the “prepare” job to use prepare-uv.yml. |
.github/workflows/templates/nox-template-matrix.yml |
Updates the “prepare” job to use prepare-uv.yml. |
.github/workflows/templates/lint-matrix.yml |
Updates the “prepare” job to use prepare-uv.yml. |
.github/workflows/templates/generate-matrix.yml |
Updates the “prepare” job to use prepare-uv.yml. |
.github/workflows/security-trivy.yml |
Updates the “prepare” job to use prepare-uv.yml. |
.github/workflows/security-snyk.yml |
Updates the “prepare” job to use prepare-uv.yml. |
.github/workflows/security-semgrep.yml |
Updates the “prepare” job to use prepare-uv.yml. |
.github/workflows/security-pip-audit.yml |
Updates the “prepare” job to use prepare-uv.yml. |
.github/workflows/sbom.yml |
Updates the “prepare” job to use prepare-uv.yml. |
.github/workflows/release.yml |
Updates the “prepare” job to use prepare-uv.yml. |
.github/workflows/license.yml |
Updates the “prepare” job to use prepare-uv.yml. |
.github/workflows/gh-pages.yml |
Updates the “prepare” job to use prepare-uv.yml. |
Comments suppressed due to low confidence (16)
pyproject.toml:113
- Ruff is configured with
target-version = "py312"while the project declaresrequires-python = ">=3.11,<4.0"and basedpyright is set to 3.11. Align Ruff’s target version with the minimum supported Python version to avoid permitting 3.12-only syntax/features.
[tool.ruff]
target-version = "py312"
line-length = 88
fix = true
show-fixes = true
.github/workflows/weekly-check.yml:46
- This workflow now calls
prepare-uv.yml, but the subsequent jobs still runpoetry run …without installing Poetry (and thepreparejob environment can’t be reused across jobs). Update the jobs that run Python tooling to set upuv/Python and run commands viauv run …(or explicitly install Poetry in each job).
prepare:
name: Prepare uv & Assured OSS
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/templates/test-matrix.yml:20
- This reusable workflow now depends on
prepare-uv.yml, but thetestjob still runspoetry run …without installing Poetry/setting up a Python environment. Since jobs don’t share theprepareenvironment, thetestjob should set upuv/Python and useuv run nox …(or install Poetry in that job).
jobs:
prepare:
name: Prepare uv & Assured OSS
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/templates/python-template-pip.yml:33
- This template now uses
prepare-uv.yml, but thetaskjob still runspoetry run …without installing Poetry. Because thepreparejob’s environment isn’t shared, thetaskjob needs its ownuv/Python setup and should execute viauv run …(or explicitly install Poetry).
jobs:
prepare:
name: Prepare uv & Assured OSS
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/templates/nox-template.yml:37
- This template now calls
prepare-uv.yml, but thenox-singlejob still usespoetry run nox …without installing Poetry. Since thepreparejob doesn’t provision tools for other jobs, update the job to set upuv/Python and useuv run nox …(or install Poetry innox-single).
jobs:
prepare:
name: Prepare uv & Assured OSS
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/templates/nox-template-matrix.yml:39
- This template now calls
prepare-uv.yml, but thenox-matrixjob still usespoetry run nox …without installing Poetry. Since jobs don’t share theprepareenvironment, updatenox-matrixto set upuv/Python and runuv run nox …(or install Poetry in that job).
jobs:
prepare:
name: Prepare uv & Assured OSS
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/templates/lint-matrix.yml:20
- This template now depends on
prepare-uv.yml, but thelint-matrixjob still runspoetry run nox …without installing Poetry. Because thepreparejob environment can’t be reused across jobs, adduv/Python setup tolint-matrixand run sessions viauv run nox …(or install Poetry there).
jobs:
prepare:
name: Prepare uv & Assured OSS
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/templates/generate-matrix.yml:20
- This template now depends on
prepare-uv.yml, but thegeneratejob still runspoetry run nox …without installing Poetry. Since thepreparejob doesn’t affect other jobs, thegeneratejob should set upuv/Python and useuv run nox …(or install Poetry in that job).
jobs:
prepare:
name: Prepare uv & Assured OSS
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/release.yml:36
- This workflow now calls
prepare-uv.yml, but thereleasejob still executespoetry run …without installing Poetry/setting up Python. Since thepreparejob environment isn’t shared, thereleasejob needs its own tool setup (preferablysetup-uv+uv run …) or an explicit Poetry install step.
jobs:
prepare:
name: Prepare uv & Assured OSS
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/sbom.yml:37
- This workflow now calls
prepare-uv.yml, but thesbomjob still runspoetry run …without installing Poetry/setting up Python. Because thepreparejob environment can’t be reused across jobs, add per-job setup (e.g.,setup-uv+uv sync/uv run) or install Poetry in thesbomjob.
# 1. Prepare uv & Assured OSS environment (with caching)
prepare:
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/license.yml:42
- This workflow now calls
prepare-uv.yml, but subsequent jobs still runpoetry run …without installing Poetry/setting up Python. Sinceprepareruns in a separate job, adduv/Python setup to the jobs that run Nox (or install Poetry in those jobs).
jobs:
prepare:
name: Prepare uv & Assured OSS
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/gh-pages.yml:31
- This workflow now calls
prepare-uv.yml, but thedocsjob still runspoetry run …without installing Poetry/setting up Python. Because thepreparejob environment isn’t shared, thedocsjob should set upuv/Python and run viauv run nox …(or install Poetry in thedocsjob).
jobs:
prepare:
name: Prepare uv & Assured OSS
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/security-trivy.yml:40
- This workflow now calls
prepare-uv.yml, but thetrivyjob still runspoetry run nox …without installing Poetry/setting up Python. Since thepreparejob is isolated, addsetup-uv/Python (and dependency sync) to thetrivyjob and run viauv run nox …(or install Poetry there).
jobs:
prepare:
name: Prepare uv & Assured OSS
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/security-snyk.yml:44
- This workflow now calls
prepare-uv.yml, but thesnyk_scanjob still usespoetry run …without installing Poetry/setting up Python. Sinceprepareis a separate job,snyk_scanneeds its own Python toolchain setup (prefersetup-uv+uv run nox …) or an explicit Poetry install step.
jobs:
prepare:
name: Prepare uv & Assured OSS
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/security-semgrep.yml:45
- This workflow now calls
prepare-uv.yml, but thesemgrepjob still runspoetry run nox …without installing Poetry/setting up Python. Because thepreparejob environment isn’t shared, adduv/Python setup to thesemgrepjob and run viauv run nox …(or install Poetry there).
jobs:
prepare:
name: Prepare uv & Assured OSS
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
.github/workflows/security-pip-audit.yml:42
- This workflow now calls
prepare-uv.yml, but thepip_audit_reportjob still runspoetry run …without installing Poetry/setting up Python. Sinceprepareruns in a separate job, add per-job setup (prefersetup-uv+uv run pip-audit/uv run sarif …) or install Poetry inpip_audit_report.
jobs:
prepare:
uses: ./.github/workflows/prepare-uv.yml
with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
secrets:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| credentials_json: ${{ secrets.GCP_SA_JSON }} | ||
|
|
||
| - name: Install Dependencies | ||
| run: uv sync --all-extras --frozen |
Comment on lines
+14
to
+22
| [project] | ||
| name = "ledgerbase" | ||
| version = "0.1.0" | ||
| description = "A financial ledger and budgeting application." | ||
| authors = ["Byron Williams"] | ||
| license = "MIT" | ||
| authors = [{ name = "Byron Williams" }] | ||
| license = { text = "MIT" } | ||
| readme = "README.md" | ||
| packages = [{ include = "ledgerbase", from = "src" }] | ||
|
|
||
| [tool.poetry.dependencies] | ||
| python = ">=3.11,<4.0" | ||
| Flask = "^3.1.0" | ||
| Flask-SQLAlchemy = "^3.1.1" | ||
| cryptography = "^44.0.2" | ||
| python-dotenv = "^1.1.0" | ||
| sentry-sdk = { extras = ["flask"], version = "^2.25.1" } | ||
| marshmallow = "^3.21.2" | ||
| Flask-Limiter = "^3.5.0" | ||
| gunicorn = "^23.0.0" | ||
| psycopg = { version = "^3.1.18", extras = ["binary"] } | ||
| python-dateutil = "^2.9.0.post0" | ||
| plaid-python = "^30.0.0" | ||
| PyYAML = "^6.0.1" | ||
| jinja2 = ">=3.1.6,<3.2.0" | ||
| nox = "^2025.2.9" | ||
| requests = "^2.31.0" | ||
| semgrep = "^1.119.0" | ||
| keyring = "^24.0.0" | ||
| "keyrings.google-artifactregistry-auth" = "^1.1.2" | ||
| packaging = "^23.1" | ||
|
|
||
| [tool.poetry.group.dev.dependencies] | ||
| # Core testing & linting | ||
| pytest = "^8.3.5" | ||
| pytest-cov = "^6.1.1" | ||
| ruff = "^0.11.7" | ||
| mypy = "^1.15.0" | ||
| pre-commit = "^4.2.0" | ||
| sqlfluff = "^3.4.0" | ||
| nox = "^2025.2.9" | ||
|
|
||
| # Security scanning tools | ||
| bandit = "^1.8.3" | ||
| safety = "^3.4.0" | ||
|
|
||
| # Security report formatters | ||
| bandit-sarif-formatter = "^1.1.1" | ||
| "sarif-tools" = "^3.0.4" | ||
|
|
||
| # Documentation tools | ||
| sphinx = "^8.2.0" | ||
| sphinxcontrib-plantuml = "^0.25" | ||
| readthedocs-sphinx-search = "^0.3.2" | ||
| sphinxcontrib-spelling = "^7.2" | ||
| sphinx-lint = "^0.8" | ||
| myst-parser = ">=4.0.1" | ||
| furo = ">=2024.8.6" | ||
| sphinx-copybutton = ">=0.5.2" | ||
| sphinx-autodoc-typehints = ">=3.1.0" | ||
|
|
||
| # Other dev utilities | ||
| codespell = "^2.1" | ||
| pip-licenses = "^4.4.0" | ||
| python-semantic-release = "^9.21.0" | ||
| twine = "^5.1.0" | ||
| vulture = "^2.11" | ||
| yamllint = "^1.35.1" | ||
| types-requests = "^2.31.0.10" | ||
| pathspec = "^0.12.1" | ||
| pydantic = "^2.9.0,<2.10.0" | ||
| poetry-plugin-export = "^1.8.0" | ||
| PyGithub = "^1.59.0" | ||
| contourpy = "^1.3.2" | ||
|
|
||
|
|
||
| [[tool.poetry.source]] | ||
| name = "assured-oss" | ||
| url = "https://us-python.pkg.dev/cloud-aoss/cloud-aoss-python/simple" | ||
| priority = "primary" | ||
|
|
||
| [[tool.poetry.source]] | ||
| name = "pypi" | ||
| priority = "supplemental" | ||
| requires-python = ">=3.11,<4.0" | ||
| dependencies = [ |
| "pytest>=8.3.5,<9.0.0", | ||
| "pytest-cov>=6.1.1,<7.0.0", | ||
| "ruff>=0.11.7,<1.0.0", | ||
| "basedpyright>=1.39.0,<2.0.0", |
Comment on lines
+111
to
+116
| - id: pip-audit | ||
| name: pip-audit (project-installed) | ||
| entry: uv run pip-audit | ||
| language: system | ||
| types: [markdown] | ||
| args: | ||
| - --disable | ||
| - MD013 | ||
| - MD051 | ||
| - --fix | ||
| stages: [pre-push] | ||
| pass_filenames: false |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/gh-pages.yml (1)
26-31:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDrop
with.GCP_SA_JSON; pass it only viasecrets.
prepare-uv.ymldefinesGCP_SA_JSONunderworkflow_call.secrets, so providing it viawithviolates the reusable workflow contract and will be ignored.Suggested fix
prepare: name: Prepare uv & Assured OSS uses: ./.github/workflows/prepare-uv.yml - with: - GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }} secrets: GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/gh-pages.yml around lines 26 - 31, Remove the unsupported with.GCP_SA_JSON input and only pass the secret via the reusable workflow's secrets mapping: delete the with: GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }} line (the "with" block entry) and keep the secrets: GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }} mapping so prepare-uv.yml (the reusable workflow) receives GCP_SA_JSON via workflow_call.secrets as intended.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/prepare-uv.yml:
- Around line 1-16: Remove the YAML front-matter block containing metadata keys
like title, category, usage, behavior, inputs, outputs, dependencies, author,
last_modified, changelog, and tags from the top of
.github/workflows/prepare-uv.yml so the file begins with the actual GitHub
Actions workflow definition; keep the existing workflow starting at the "name:"
and "on:" keys (and any subsequent jobs/steps such as uv setup and artifact
registry auth) and ensure no unknown top-level keys remain before "name:".
In @.github/workflows/templates/test-matrix.yml:
- Around line 15-16: The workflow still calls Poetry via "poetry run" even
though the job uses the prepare-uv.yml setup; open the test-matrix.yml and
replace the remaining "poetry run" invocations (the commands referenced in the
job steps) with "uv run" (or add an explicit Poetry install step if you intend
to keep Poetry), ensuring the step names that currently call "poetry run" are
updated to use "uv run" so they run under uv's environment created by
prepare-uv.yml.
In @.github/workflows/weekly-check.yml:
- Around line 41-42: Update the CI workflow to replace all uses of poetry with
uv: change every invocation like "poetry run <tool>" to "uv run <tool>" in the
weekly-check.yml job definitions (targets include commands invoking nox and
aikido-local-scanner). Specifically update the commands that call nox sessions
verify_assured, aikido-weekly-scan, aikido-usage-report, lint_other, vulture,
and lint_rst and the aikido-local-scanner invocation so they use "uv run"
instead of "poetry run"; after switching the runner, verify that the nox
sessions referenced (verify_assured, aikido-weekly-scan, aikido-usage-report)
exist in your noxfile and either add or correct those session names to match
actual session functions in the noxfile.
In `@pyproject.toml`:
- Line 110: Ruff's configured target-version ("target-version = \"py312\"") is
higher than the project's declared runtime floor ("requires-python =
\"\u003e=3.11,<4.0\""), which can mask 3.11-only incompatibilities; update the
Ruff configuration to target the minimum supported runtime (e.g., change
target-version to "py311" or otherwise match the requires-python floor) so
linting/fixes reflect the actual supported Python version.
- Around line 36-41: The listed tooling packages (nox, semgrep, keyring,
keyrings.google-artifactregistry-auth, and any similar dev-only tools) are
incorrectly placed in [project].dependencies; move each of these entries out of
that list and add them under dependency-groups.dev in pyproject.toml (create a
dev group if missing) so they become dev-only installs; ensure you remove
"nox>=2025.2.9", "semgrep>=1.119.0,<2.0.0", "keyring>=24.0.0,<25.0.0", and
"keyrings.google-artifactregistry-auth>=1.1.2,<2.0.0" from the runtime
dependencies and add equivalent entries under dependency-groups.dev.
---
Outside diff comments:
In @.github/workflows/gh-pages.yml:
- Around line 26-31: Remove the unsupported with.GCP_SA_JSON input and only pass
the secret via the reusable workflow's secrets mapping: delete the with:
GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }} line (the "with" block entry) and keep
the secrets: GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }} mapping so prepare-uv.yml
(the reusable workflow) receives GCP_SA_JSON via workflow_call.secrets as
intended.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 11a927ab-f140-40ec-899f-0bc03c172514
⛔ Files ignored due to path filters (2)
poetry.lockis excluded by!**/*.lockuv.lockis excluded by!**/*.lock
📒 Files selected for processing (21)
.github/workflows/gh-pages.yml.github/workflows/license.yml.github/workflows/prepare-poetry.yml.github/workflows/prepare-uv.yml.github/workflows/release.yml.github/workflows/sbom.yml.github/workflows/security-pip-audit.yml.github/workflows/security-semgrep.yml.github/workflows/security-snyk.yml.github/workflows/security-trivy.yml.github/workflows/templates/generate-matrix.yml.github/workflows/templates/lint-matrix.yml.github/workflows/templates/nox-template-matrix.yml.github/workflows/templates/nox-template.yml.github/workflows/templates/python-template-pip.yml.github/workflows/templates/test-matrix.yml.github/workflows/weekly-check.yml.pre-commit-config.yamldev-requirements.txtpoetry.tomlpyproject.toml
💤 Files with no reviewable changes (2)
- .github/workflows/prepare-poetry.yml
- poetry.toml
Addresses reviewer feedback (Copilot, CodeRabbit, github-advanced-security):
- prepare-uv.yml: drop YAML front-matter block. The metadata keys
(title/category/usage/etc.) at the workflow root violate the GitHub
Actions schema and cause actionlint syntax errors. Keeping only the
valid `name:`/`on:`/`jobs:` structure.
- Downstream workflow jobs (gh-pages, license, release, sbom, security-*,
templates/*, weekly-check): replace `poetry run` with `uv run` and add
`astral-sh/setup-uv` + `uv sync --frozen` to each affected job. The
prepare-uv reusable workflow runs in its own runner so its environment
is not shared with sibling jobs that need uv.
- All callers: drop the redundant `with: GCP_SA_JSON: ...` block. The
reusable workflow declares the value under `secrets:` only, not
`inputs:`, so the `with:` mapping was being silently ignored.
- pyproject.toml:
* Move CI/dev-only tools (nox, semgrep, keyring,
keyrings.google-artifactregistry-auth) out of runtime `dependencies`
and into `dependency-groups.dev`.
* Add back `mypy` (still used by the mypy nox session) and `pip-audit`
(used by the pre-commit hook) under `dependency-groups.dev`.
* Align ruff's `target-version = "py311"` with
`requires-python = ">=3.11,<4.0"`.
- Regenerate uv.lock and dev-requirements.txt.
FIPS Compatibility Check: PASSED
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Single PR addressing three open tooling issues. The project standard is now uv (not Poetry) and ruff (not black/flake8/isort), and this PR aligns the repo with that standard.
Issue 1 — Migrate CI workflow to uv (Closes #136)
.github/workflows/prepare-poetry.yml→.github/workflows/prepare-uv.yml.astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b(v8.1.0, SHA-pinned) for both Python install and uv setup, withenable-cache: true+cache-dependency-glob: uv.lockreplacing the manual Poetry cache step.google-github-actions/authstep preserved unchanged.uv sync --all-extras --frozenreplacespoetry install.uv export --only-group dev --no-hashes --format requirements-txtreplacespoetry export.UV_INDEX_URL/UV_EXTRA_INDEX_URLenv vars../.github/workflows/prepare-uv.yml.Issue 2 — Pre-commit hooks via ruff, not black/flake8/isort (References #82, redirected to ruff)
.pre-commit-config.yamlwith:ruff(linting, replaces flake8 + isort) with--fix --exit-non-zero-on-fixruff-format(formatting, replaces black)basedpyright(type checking)detect-secrets(secret scanning) with existing.secrets.baselinetrailing-whitespace,end-of-file-fixerfrompre-commit-hooksrev:fields are pinned to full 40-character SHAs (ruff-pre-commit v0.15.13, basedpyright-pre-commit-mirror 1.39.4, detect-secrets v1.5.0, pre-commit-hooks v6.0.0).poetry runtouv run.Issue 3 — pyproject.toml on uv/PEP 621 conventions (References #96, redirected to uv)
[tool.poetry]→ PEP 621[project](withdependencieslist using PEP 508 specifiers).[tool.poetry.group.dev.dependencies]→[dependency-groups].dev.[tool.uv]and[[tool.uv.index]]entries for Assured OSS + PyPI.poetry-core→hatchling(with[tool.hatch.build.targets.wheel] packages = ["src/ledgerbase"]).[tool.basedpyright]configuration.poetry.lockandpoetry.toml—uv.lockis generated on firstuv sync.Out of scope
Downstream workflow steps in
weekly-check.yml,security-*.yml, etc. still invokepoetry run nox -s …inside their own jobs. Those are independent of theprepare-*reusable workflow and weren't part of the three issues; they'd need a separate PR to migrate touv run.Test plan
uv syncsucceeds locally and generatesuv.lockuv export --only-group dev --no-hashes --format requirements-txtproduces a valid requirements filepre-commit run --all-filespasses (ruff, ruff-format, basedpyright, detect-secrets, file hygiene)prepare-uv.yml(e.g.release.yml,sbom.yml) completes the prepare job successfullyGenerated by Claude Code
Summary by CodeRabbit