From 812149f9284cfa79e6bba93447484594d18d79af Mon Sep 17 00:00:00 2001 From: JasonZQH Date: Tue, 28 Jul 2026 04:17:36 -0700 Subject: [PATCH] chore: pin the Ruff rule set and point Dependabot at dev Two config gaps that both showed up while triaging the open Dependabot PRs. Ruff: [tool.ruff] set only line-length and target-version, so the project inherited whatever Ruff's defaults were. 0.16.0 widened them and turned 84 findings up in code nobody had touched (PR #33 is red on exactly this). Pinning select to Ruff's classic defaults makes "lint clean" a decision made here rather than one made by whichever Ruff version resolved. Verified as a no-op: `ruff check src tests` passes on both 0.15.19 and 0.16.0 with the pin, matching what CI enforced before it. Widening the set is separate work. Dependabot: it opens against the repository's default branch, which is main, while CONTRIBUTING requires PRs to be based on dev. Merging those bumps put them on main only, leaving dev's CI to keep testing the old versions. target-branch fixes that for future runs. Note: Dependabot reads this file from the default branch, so the change takes effect once it reaches main. The five PRs already open stay pointed at main. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 6 ++++++ pyproject.toml | 8 ++++++++ 2 files changed, 14 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 31fb2d0..c6fc0dd 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,13 +1,19 @@ # Keeps GitHub Actions and Python (uv) dependencies fresh. The github-actions # updates also handle version drift on the Actions pinned in CI, so we don't # hand-pin them to commit SHAs. +# +# target-branch is set on every entry because Dependabot otherwise opens against the +# default branch (main), while CONTRIBUTING requires PRs to be based on dev. Without +# it, a merged bump lands on main only and dev's CI keeps testing the old version. version: 2 updates: - package-ecosystem: "github-actions" directory: "/" + target-branch: "dev" schedule: interval: "weekly" - package-ecosystem: "uv" directory: "/" + target-branch: "dev" schedule: interval: "weekly" diff --git a/pyproject.toml b/pyproject.toml index 1b262a5..cfc29f4 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -63,3 +63,11 @@ pythonpath = ["src"] [tool.ruff] line-length = 100 target-version = "py311" + +# Pin the rule set explicitly. Without this, the project inherits whatever Ruff's +# defaults happen to be, so "lint clean" changes meaning on a Ruff upgrade rather +# than on a decision here — 0.16.0 widened the defaults and surfaced 84 findings in +# unchanged code. These four are Ruff's classic defaults and are exactly what CI +# enforced before the pin. Widening the set is a deliberate, separate change. +[tool.ruff.lint] +select = ["E4", "E7", "E9", "F"]