Finding
The 2026-08-31 dev-cleanup sweep was the first static-analysis pass on this repo in some time, and it surfaced 782 ruff findings, 38 bandit findings, and 11 functions at radon rank D or E. Nothing in CI runs ruff, vulture, radon, or bandit today, so the count only moves when somebody runs a manual sweep.
Four of the ruff findings (F821, undefined CHILmesh in gmsh_io.py return annotations) were genuine defects that had been sitting in the tree unnoticed. That is the case for automating the check: the sweep pays for itself when it runs continuously rather than once a quarter.
Suggested approach
DomI ships a repo-cleanup skill with a ready scan script (skills/repo-cleanup/scripts/code_smell_scan.sh) and an accompanying .github/workflows/code-smell.yml shape. Per the DomI no-vendored-skills rule, CHILmesh should fetch it at runtime rather than commit a copy.
Recommended lane shape:
- Add a
[tool.ruff] config first (tracked separately) so the lane has a standard to check against.
- Gate hard on the correctness rules only —
F (pyflakes) — so undefined names and dead imports fail the build.
- Report, do not fail, on
E style rules, radon complexity, and bandit LOW findings.
- Fail on bandit MEDIUM or higher in
src/.
- Schedule it on PRs plus a low-frequency cron; register any cron job in DomI
docs/governance/CRON-REGISTRY.md.
Note on dependency scanning
pip-audit was also run during the sweep. Its nine findings were all against pip and setuptools inside the throwaway scan virtualenv, not against any CHILmesh runtime or dev dependency declared in pyproject.toml. If a dependency lane is added, it should audit the resolved project dependencies specifically, or it will report noise like this on every run.
[model: claude-opus, repo: CHILmesh, session: dev-cleanup sweep]
Finding
The 2026-08-31
dev-cleanupsweep was the first static-analysis pass on this repo in some time, and it surfaced 782 ruff findings, 38 bandit findings, and 11 functions at radon rank D or E. Nothing in CI runs ruff, vulture, radon, or bandit today, so the count only moves when somebody runs a manual sweep.Four of the ruff findings (
F821, undefinedCHILmeshingmsh_io.pyreturn annotations) were genuine defects that had been sitting in the tree unnoticed. That is the case for automating the check: the sweep pays for itself when it runs continuously rather than once a quarter.Suggested approach
DomI ships a
repo-cleanupskill with a ready scan script (skills/repo-cleanup/scripts/code_smell_scan.sh) and an accompanying.github/workflows/code-smell.ymlshape. Per the DomI no-vendored-skills rule, CHILmesh should fetch it at runtime rather than commit a copy.Recommended lane shape:
[tool.ruff]config first (tracked separately) so the lane has a standard to check against.F(pyflakes) — so undefined names and dead imports fail the build.Estyle rules, radon complexity, and bandit LOW findings.src/.docs/governance/CRON-REGISTRY.md.Note on dependency scanning
pip-auditwas also run during the sweep. Its nine findings were all againstpipandsetuptoolsinside the throwaway scan virtualenv, not against any CHILmesh runtime or dev dependency declared inpyproject.toml. If a dependency lane is added, it should audit the resolved project dependencies specifically, or it will report noise like this on every run.[model: claude-opus, repo: CHILmesh, session: dev-cleanup sweep]