Repository navigation
ci: consolidate lint and dependency audit jobs - #5301
Conversation
Share checkout and tool setup across Ruff, Markdown lint, ShellCheck, and the committed dependency audit while preserving independent failure reporting and the scheduled audit matrix. Assisted-by: GitHub Copilot (model: GPT-6.1 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
The whitespace check silently skips changes when manually dispatched on a merge commit, allowing introduced trailing whitespace to pass undetected.
1 open issue
What changed in this PR
Consolidates Spec Kit’s lint and committed dependency-audit checks into one Ubuntu job, reducing repeated setup while retaining separate check steps.
Changes:
- Shares checkout, Python, and uv setup, with conditions that let independent checks continue after failures.
- Preserves full Git history and adds whitespace checking for manual runs.
- Updates contributor guidance and workflow tests while preserving the pytest and scheduled audit matrices.
| File | Description |
|---|---|
tests/test_security_workflow.py |
Tests consolidated checks, prerequisites, and audit configuration. |
tests/test_github_workflows.py |
Updates job lookup and adds whitespace-check cases. |
CONTRIBUTING.md |
Documents the combined job and independent checks. |
.github/workflows/test.yml |
Removes the Ruff job; retains pytest. |
.github/workflows/security.yml |
Removes the workflow after relocating its audit jobs. |
.github/workflows/lint.yml |
Combines lint and audit checks and hosts the scheduled audit matrix. |
Review effort: Balanced (auto)
mnriem
added
the
triage-nice-to-have
Use first-parent merge diffs while retaining root-commit handling. Cover clean and whitespace-breaking manual runs against root and merge commits. Assisted-by: GitHub Copilot (model: GPT-6.1 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Fixed in 5bb6002: manually dispatched whitespace checks now use first-parent merge diffs while retaining root-commit handling. Added clean and trailing-whitespace cases for manual runs on merge and root commits; the merge regression failed before the fix and passes afterward. All 202 targeted workflow tests pass. Posted on behalf of @mnriem by GitHub Copilot using GPT-6.1 Sol (gpt-6.1-sol), autonomous execution within user-directed scope; reasoning-effort setting was not exposed. AI assistance covered the workflow fix, regression tests, local validation, and this summary. |
Preserve upstream's routine and scheduled/manual Python matrices and setup-uv v10.3.3 pins while retaining the consolidated lint and dependency audit job. Assisted-by: GitHub Copilot (model: GPT-6.1 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
Markdownlint can execute repository-provided JavaScript before both dependency audits in the same workspace, allowing audited files to be altered so successful results may not reflect committed requirements.
1 open issue
Review effort: Balanced (auto)
Run both committed dependency-audit steps immediately after shared setup, before Markdownlint can execute repository-provided JavaScript in the workspace. Add an ordering regression test while retaining independent failure handling. Assisted-by: GitHub Copilot (model: GPT-6.1 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Addressed in da9a4df: both committed dependency-audit steps now run immediately after shared setup, before Markdownlint can execute repository-provided JavaScript configuration. Independent checks still run after failures without masking the job result. The ordering regression test failed before the change and passes afterward; all 207 targeted workflow tests pass, along with Ruff and git diff --check. Posted on behalf of @mnriem by GitHub Copilot using GPT-6.1 Sol (gpt-6.1-sol), autonomous execution within user-directed scope; reasoning-effort setting was not exposed. AI assistance covered the workflow fix, regression test, validation, and this summary. |
* ci: consolidate lint and dependency audit jobs Share checkout and tool setup across Ruff, Markdown lint, ShellCheck, and the committed dependency audit while preserving independent failure reporting and the scheduled audit matrix. Assisted-by: GitHub Copilot (model: GPT-6.1 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * ci: check whitespace in manually dispatched merge commits Use first-parent merge diffs while retaining root-commit handling. Cover clean and whitespace-breaking manual runs against root and merge commits. Assisted-by: GitHub Copilot (model: GPT-6.1 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * ci: audit dependencies before executable Markdown configuration Run both committed dependency-audit steps immediately after shared setup, before Markdownlint can execute repository-provided JavaScript in the workspace. Add an ordering regression test while retaining independent failure handling. Assisted-by: GitHub Copilot (model: GPT-6.1 Sol, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Description
Combine Ruff, Markdown lint, ShellCheck, and the committed dependency audit into one Ubuntu job with shared checkout, Python, and uv setup. This removes three jobs from each push and pull request without removing checks.
Keep checks in separately named steps so independent checks still run after another check fails, while preserving the job's failure status. Preserve full Git history for dependency comparisons and handle whitespace checks on manual runs.
Leave the pytest matrix, scheduled dependency-audit matrix, CodeQL jobs, and extension version guard unchanged. Update contributor guidance and workflow tests for the consolidated job.
Testing
Set up this checkout's
.venvand editable install using the local development guide. Run commands from the checkout root..venv/bin/specify --help(Windows PowerShell:.\.venv\Scripts\specify.exe --help).venv/bin/python -m pytest tests -q(Windows PowerShell:.\.venv\Scripts\python.exe -m pytest tests -q); use affected test paths for focused checks andLC_ALL=en_US.UTF-8on macOSCommands and results:
.venv/bin/specify --help— passed.LC_ALL=en_US.UTF-8 .venv/bin/python -m pytest tests/test_security_workflow.py tests/test_github_workflows.py -q— passed, 198 tests.uvx ruff@0.15.0 check tests/test_security_workflow.py tests/test_github_workflows.py— passed.git diff --check— passed.A sample project is not applicable to this CI-only behavior change. The full pytest suite and the consolidated job on GitHub Actions were not run locally; combined-job runtime has not been measured.
AI Disclosure
AI disclosure: GitHub Copilot using GPT-6.1 Sol (model ID: gpt-6.1-sol), autonomous execution within user-directed scope; reasoning-effort setting was not exposed. The agent investigated workflow timings, authored the workflow, test, and contributor-documentation changes, ran local checks, and prepared the commit and pull request.