Skip to content

fix(ci): quality.yml invalid since 2026-10-27 (env: on a uses: job) — lean gate has never actually run - #304

Merged
Prekzursil merged 9 commits into
mainfrom
fleet-sec/quality-yml-valid
Nov 13, 2026
Merged

Prekzursil merged 9 commits into
mainfrom
fleet-sec/quality-yml-valid

Conversation

@Prekzursil

Copy link
Copy Markdown
Owner

jobs.quality.env is not a valid key next to uses:, so GitHub rejects the whole file: every quality run since 6a6fed1 (2026-10-27) failed as a 'workflow file issue' with zero jobs executed — verified via the run list (all recent main runs red, gh run view reports the file-issue banner). The block was inert anyway: reusable-workflow jobs never see the caller's job env; the settings-contract env lives in this repo's verify job where it works.

After this merges, the lean 6-gate actually runs on WebCoder for the first time in 2.5 weeks.

owner-directed automation; --admin documented

…— env: is not allowed on a job that calls a reusable workflow

Every run since 2026-10-27 failed instantly with 'workflow file issue'
(verified: all 5 most-recent main runs are red with zero executed jobs).
The env block was also a no-op for its stated purpose: reusable-workflow
jobs never inherit the caller job's env. SECRET_KEY/DB_PASSWORD stay where
they work, in this repo's own verify job (56a9639).

owner-directed automation; --admin documented
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 13, 2026 •

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-13T22:29:32.569149Z abc6711 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

…surfaced on its first real run

- register/page.test.tsx: drop the unused React type import (only a comment
  referenced React).
- e2e/lib/realStack.ts: build headers imperatively — both the conditional
  spread and the empty-object fallback are unicorn/no-useless-fallback-in-
  spread violations.
- e2e/mock-api/server.mjs: ...res._corsHeaders directly (falsy adds nothing).

Verified: oxlint@1.69.0 --deny-warnings over the tracked tree → 0 warnings.

owner-directed automation; --admin documented
…gate's jsts format lane, first real run)

The lean gate ran for the first time since 2026-10-27 (previous PR fixed the
invalid workflow file) and its biome lane flagged 40 accumulated files.
Formatted with the gate's exact pinned tool (@biomejs/biome@2.5.0, single
quotes, 2-space, width 100, LF) and shipped the config so the check is
caller-owned rather than template-default. Verified locally: biome ci over
the tracked tree is clean.

owner-directed automation; --admin documented
…t real run)

- ruff.toml: the repo had NO root config, so the gate's repo-wide 'ruff
  check .' ran on defaults; this pins target py312, line-length 88 (the
  tree's existing black-era wrapping) and per-file-ignores for the Django
  settings/* composition patterns (E402/F403/F405/F821), URL modules'
  sys.path bootstrap (E402), package __init__ re-exports (F401) and the
  unittest-bootstrapped submissions/tests.py (E402).
- ruff check --fix removed 118 genuinely unused imports/variables;
  analytics.py's lazy OwnerWeeklySnapshot now type-checks via
  TYPE_CHECKING + __future__ annotations; contests/views.py's dead 'now'
  dropped.
- ruff format over the tree (AST-preserving; 180 files were never
  ruff-formatted). Verified: ruff check + ruff format --check clean over
  every tracked .py.

owner-directed automation; --admin documented
Comment thread backend/problems/test_community.py Fixed
…migrations/settings excluded)

Modeled on the fleet's lean-gate caller shape (momentstudio's
pyrightconfig.json): standard typeCheckingMode, python 3.12, the app tree
included, tests/migrations/the settings composition excluded from the
type surface, missing-import imports downgraded to warning (the gate
installs backend/requirements.txt, so imports resolve in CI).

owner-directed automation; --admin documented
@Prekzursil

Copy link
Copy Markdown
Owner Author

Status after this PR: the lean quality gate goes from permanently-broken (invalid workflow file since 2026-10-27 — zero executions) to RUNNING with three of its four lanes green: jsts lint (oxlint 0 warnings), jsts format (biome clean, caller-owned config), python lint/format (ruff clean, caller-owned config).

Remaining red: gate-types basedpyright, 221 Django-typing findings (TextChoices tuple[Literal[...]] assignments, Optional member access, model-manager resolution). These pre-date this PR — they were invisible because the workflow file never executed. Clearing them needs a deliberate django-stubs adoption or per-site fixes (an owner-scope typing campaign, not a fleet-sec scope). quality is not a required check on this repo (profile requires CodeQL only), so main stays mergeable while the debt is visible.

owner-directed automation; --admin documented

…ysis surfaced

- 4x py/empty-except: explanatory comments added where swallow-and-continue
  is the documented behavior (admin dangling-FK rows, paginator-abort test
  boundary, Scratch SystemExit).
- 18x py/unused-local-variable + F841 test ignore dropped: fixture locals
  that only existed for side effects now call directly; the twin
  participation tests keep names only where read.
- py/ineffectual-statement: interface method's bare Ellipsis became an
  explicit NotImplementedError.
- py/unnecessary-delete / py/multiple-definition / py/uninitialized-local-
  variable: dead 'del', dead final_error initializer, try/else for the
  sentinel assertion.
- 2x py/unused-global-variable: dead _MATH_OPS removed; SUPPORTED_LANGUAGE_IDS
  is imported by both serializers modules (alert expected to close on
  re-analysis).
- 2x py/imprecise-assert: assertTrue(x is y) -> assertIs.

Verified: ruff check + ruff format clean over all 307 tracked .py files;
compileall backend OK.

owner-directed automation; --admin documented
@Prekzursil
Prekzursil merged commit 7c89c40 into main Nov 13, 2026
9 of 11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants