chore(deps-dev): update ruff requirement from >=0.3.0 to >=0.16.5 - #73
Open
dependabot[bot] wants to merge 1 commit into
Open
chore(deps-dev): update ruff requirement from >=0.3.0 to >=0.16.5#73dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Updates the requirements on [ruff](https://github.com/astral-sh/ruff) to permit the latest version. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@v0.3.0...0.16.5) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.16.5 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
srpatcha
reviewed
Sep 4, 2026
srpatcha
left a comment
srpatcha
left a comment
Member
There was a problem hiding this comment.
Review — eDB#73 "chore(deps-dev): update ruff requirement from >=0.3.0 to >=0.16.5"
head: c87afd7 author: app/dependabot ci: pass (CodeQL only — the test matrix did not run)
Verdict: Safe, and I measured it rather than assuming: under CI's exact ruff
invocation, 0.3.0 and 0.16.5 report the same 151 errors — the bump adds nothing new to
fix. The finding is that those 151 have been reported into a green tick the whole time,
and that CI runs a narrower rule set than the repo's own config declares.
What was measured
Cloned origin/master (0457c0a), installed each version, Python 3.12.14:
| Invocation | ruff 0.3.0 | ruff 0.16.5 |
|---|---|---|
ruff check . --select=E,F,W --ignore=E501 (what ci.yml:37 runs) |
151 errors | 151 errors |
ruff check . (what pyproject.toml:72-74 declares) |
— | 180 errors |
Identical under CI's flags, so the upgrade is a no-op for the build as configured. The
151 break down as 102 F405 (name may be undefined from a star import), 18 W293,
13 E701, 6 E702, 5 F401, 3 W291, 2 W292, 1 F403.
Findings
| # | Severity | File:line | Finding | Recommended fix |
|---|---|---|---|---|
| 1 | High | .github/workflows/ci.yml:38 |
continue-on-error: true on the Lint (ruff) step. ruff cannot fail this build, so raising its floor changes nothing observable — the 151 errors above are being emitted into a green tick today. .ai/reviewer.md is explicit that a verification whose result is discarded is a finding regardless of the reason given. |
Remove continue-on-error: true from ci.yml:37-38. 29 of the 151 are auto-fixable (ruff check --fix) and 102 are a single F403/F405 star-import cluster; this is a smaller cleanup than the raw number suggests. If it still cannot land at once, gate on --select=E,W,F401,F403,F405 and grow, rather than running everything and ignoring all of it. |
| 2 | Medium | .github/workflows/ci.yml:37 vs pyproject.toml:72-74 |
CI passes --select=E,F,W --ignore=E501 on the command line, which overrides the repo's declared select = ["E", "F", "W", "I", "N", "UP", "B", "SIM", "RUF"]. Six rule families the project says it lints for — I, N, UP, B, SIM, RUF — are never enforced anywhere. That is the 180-vs-151 gap in the table above. |
Drop the --select/--ignore flags from ci.yml:37 and let ruff check . read pyproject.toml, so the config is the single source of truth. Doing this and finding 1 together is a 180-error cleanup; sequence it deliberately. |
| 3 | High | .github/workflows/ci.yml:33-34 |
Line 33 installs from requirements.txt, a file that does not exist in this repository — the most recent CI — eDB push run on master concluded failure with ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'. Line 34 then installs pytest pytest-cov pytest-benchmark mypy ruff unconstrained, never installing the project or its [project.optional-dependencies].dev extra. No check in this repository reads pyproject.toml:43, the line this PR edits. |
Replace ci.yml:33-34 with pip install -e ".[dev]". That resolves the declared floor and fixes a job that currently cannot pass. |
| 4 | Medium | .github/workflows/ci.yml:8 (at base 5e436bd6) |
The Test (Python …) matrix did not run on this PR; the only checks are Analyze (Python)/CodeQL and assign. Root cause, verified: at base 5e436bd6 the trigger was pull_request: branches: [main] while this PR targets master. Fixed on master by #70 (6d53641); this PR is 3 commits behind. The green tick is CodeQL, not tests or lint. |
Rebase onto origin/master. |
| 5 | Medium | repo setting: branches/master/protection |
required_status_checks: null on master — reviews required, no check required. CI — eDB failing on master blocks nothing, which is how finding 3 has survived. |
Set required status checks once finding 3 makes the job passable. |
| 6 | Low | (repo-wide) | .github/dependabot.yml is absent from master — removed by eaf4e1c (PR #68): "Dependabot is disabled org-wide: config removed here, and alerts plus automated security fixes turned off via the API. 90 open Dependabot PRs". This PR is an orphan; nothing will rebase or supersede it, and closing it will not cause the bump to be re-proposed. |
Merge it or close it deliberately. |
Findings 3–6 are shared with eDB#71 and #72 and are stated there too; findings 1 and 2 are
specific to ruff.
Architecture conformance
Conforms.
- §5.1 architectural law. One line in
[project.optional-dependencies].dev. ruff is a
development-time tool, never a runtime dependency, so nothing points up a tier. - §21 tier placement. eDB is Tier 3 — Advanced ("AI, neural interfaces and embedded
data"). Its lint tooling belongs in its ownpyproject.toml. §21.1 untouched. - §28 evidence policy / STANDARDS.md.
.github/STANDARDS.md:100-106says a compliance
claim is aspirational unless a verifying workflow runs on every push. A lint workflow
that runs but cannot fail (finding 1) and that enforces a narrower rule set than the
project declares (finding 2) is exactly that distinction, applied to code quality rather
than to a named framework.
Proposed changes
Smallest sequence that keeps things working:
- Fix
ci.yml:33-34→pip install -e ".[dev]"(finding 3). Do this first; it is what
makes the floor real and it fixes a job that cannot currently pass. - Merge this PR. I have measured that 0.16.5 introduces no new violations over 0.3.0
under CI's current flags, so it can land ahead of the cleanup. ruff check . --select=E,F,W --ignore=E501 --fix— clears 29 of the 151 mechanically.- Fix the
F403/F405star-import cluster (103 of the remaining 122). - Remove
continue-on-error: truefromci.yml:38(finding 1) once the count is near
zero, then drop the--selectoverride sopyproject.tomlgoverns (finding 2). - Set required status checks on
master(finding 5).
Not checked
- The 151 violations individually. I counted them and grouped them by rule code. I did
not read them, and I am not asserting any of them is benign — only that both ruff
versions report the same set, which is what the bump turns on. - The 29 additional violations under the repo's full rule set. 180 − 151 = 29 come
fromI,N,UP,B,SIM,RUF; I did not examine them, so I cannot say how much
work finding 2 represents beyond the count. - ruff 0.3 → 0.16 release notes. I measured the outcome on this tree instead. ruff
changed its default rule behaviour repeatedly across that range; a change this codebase
does not exercise would not show up in my numbers. ruff format. Not run and not configured in CI; formatting drift is outside what I
measured.- The test suite.
pytestwas not run —ci.yml:33prevents CI from doing so and I
did not work around it locally. I do not know whether eDB's tests currently pass. - Platform coverage. All runs were Python 3.12.14 on Linux. The matrix's 3.10 and 3.11
entries and itsmacos-13/windows-2022legs were not exercised.
Automated architecture review of c87afd77097c — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on ruff to permit the latest version.
Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
... (truncated)
Commits
9e4938cBump 0.16.5 (#28110)aad0e90Allow rules without codes (#28049)5fdab73Update preview default rules and categories (#27877)29c8e5bDocument rule acceptance guidelines (#27910)50a4d7fDocument the new category selectors (#27906)ada8795Introduce category selectors (#27666)d894723[ty] Infer lambda parameters through callable type aliases (#28109)2685fde[ty] Narrow functional enum members in==andmatch(#28103)efcffd2[ty] Intersection simplifications with subtype-related generic specialization...eb78048[ty] Bump ecosystem-analyzer for HTML escaping (#28104)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)