Skip to content

ci: rename ruff.yml to ci.yml, add timeouts/concurrency, cache Playwright browsers - #95

Merged
tiankaima-copilot merged 1 commit into
masterfrom
ci/hardening-20261017
Oct 17, 2026
Merged

tiankaima-copilot merged 1 commit into
masterfrom
ci/hardening-20261017

Conversation

@tiankaima-copilot

Copy link
Copy Markdown
Collaborator

Changes

ruff.yml → ci.yml (git mv, 81% similarity)

The workflow runs ruff lint, ruff format, and the full unittest suite with coverage, so the file and workflow name: now say CI. The required status context is the job name: the job has no name: key, so the context is its id ruff (ci.yml:17), which is untouched — branch protection keeps matching. Same for CodeQL's "Analyze (python)" (codeql.yml:16), which this PR does not touch.

Hardening in ci.yml

  • concurrency with cancel-in-progress: true (ci.yml:12-14) — superseded runs on the same ref stop early.
  • timeout-minutes: 10 (ci.yml:19); the suite takes ~70s locally.
  • uv sync --group dev → uv sync --frozen --group dev (ci.yml:25) so lockfile drift fails loudly instead of being silently re-resolved.

Playwright browser cache in build.yml

patchright install chromium (build.yml:50) re-downloaded ~150 MB of Chromium on every daily scheduled run. Two new steps before it (build.yml:33-44):

  • extract the pinned patchright version from uv.lock (currently 1.63.0);
  • actions/cache on ~/.cache/ms-playwright keyed ms-playwright-${{ runner.os }}-patchright-<version>, so the browser only downloads again when the patchright pin changes.

actions/cache is SHA-pinned (0057852b… # v4.3.0, resolved via gh api repos/actions/cache/git/ref/tags/v4) matching the repo's existing pinned style.

Validation

  • actionlint clean on ci.yml and build.yml
  • uv sync --frozen --group dev — OK
  • uv run ruff check . --output-format=github and uv run ruff format --check . — clean (53 files already formatted)
  • uv run coverage run -m unittest discover -s tests -p 'test_*.py' — 92 tests, OK; coverage 85%
  • version extraction verified locally: grep -A1 '^name = "patchright"$' uv.lock → 1.63.0

🤖 Generated with Claude Code

…ight browsers

- Rename the workflow file ruff.yml -> ci.yml and its name to CI: it
  runs lint, format and the full unittest suite, not just ruff. The
  required status context is the job name, and the job id/name `ruff`
  is unchanged, so branch protection is unaffected.
- Add timeout-minutes: 10 and concurrency with cancel-in-progress so
  superseded PR runs stop early.
- uv sync --group dev -> uv sync --frozen --group dev to fail on
  lockfile drift instead of silently re-resolving.
- build.yml: cache ~/.cache/ms-playwright keyed on the patchright
  version pinned in uv.lock, so `patchright install chromium` stops
  re-downloading ~150 MB on every daily run. actions/cache SHA-pinned
  to match the repo's pinning style.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 17, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
🔒 Security Review ✅ Completed 2026-10-17T09:50:33.719119Z f6834aa PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@tiankaima-copilot
tiankaima-copilot merged commit aa09afd into master Oct 17, 2026
3 checks passed
@tiankaima-copilot
tiankaima-copilot deleted the ci/hardening-20261017 branch October 17, 2026 13:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants