chore: repo cleanup (static analysis sweep)

[domattioli]

Summary

A static-analysis sweep over src/chilmesh, tests, and scripts using ruff, vulture, radon, bandit, and pip-audit. Findings that could be fixed mechanically without judgement calls are fixed here; everything requiring a design decision is filed as an issue instead of being changed under a cleanup label.

Branch note: this work is on dev-cleanup rather than development as an explicit operator-authorized carve-out for this sweep.

What the scan found

Tool	Findings
ruff (F, E)	782
bandit	38 (11 MEDIUM, 27 LOW)
radon	11 functions at rank D or E
vulture (confidence ≥ 80)	1
pip-audit	9, all against pip/setuptools in the scan virtualenv, none against project dependencies

Fixed here (3 commits)

Real defects. src/chilmesh/gmsh_io.py referenced CHILmesh in four return annotations without importing it (F821). Because the module uses from __future__ import annotations these never raised at runtime, but they broke any tooling that resolves the annotations. Fixed with a TYPE_CHECKING import.

Error handling. Four bare except: clauses in scripts/github_release.py and scripts/pypi_publish.py were swallowing KeyboardInterrupt and SystemExit during release operations. Narrowed to except Exception:.

Dead code. Removed unused imports and locals: four top-level imports in CHILmesh.py (including a top-level spsolve shadowed by the local import inside direct_smoother), one unused typing import in bridge.py, three unused local imports in gmsh_io.py, and unused imports plus redundant f-string prefixes across the scripts and test suite. Two fort.14 boundary-count parses were renamed to _ so the parse cursor still advances while the discarded value is explicit.

Net effect: ruff findings drop from 782 to 711, and the F821, F541, F811, and E722 classes go to zero. Remaining F401 findings are two intentional availability probes.

Deliberately not fixed

• gmsh_io.py unused locals. Seven F841 findings there are validation-only parses whose int() call exists to raise ValueError for the surrounding handler. Deleting them would remove input validation from the .msh reader. Filed as chore: keep the gmsh reader's validation-only parses but silence the F841 warnings #266 so a future pass does not "fix" them.
• 575 line-too-long and 82 semicolon-statement findings. The repo has no ruff config, so there is no standard to normalize against, and the E702 cases are concentrated in fort.14 parse-cursor lines. Filed as chore: adopt a ruff config and clear the 575 line-too-long / 82 semicolon-statement findings #262.
• Test-suite unused locals (33). In test code these frequently indicate a dropped assertion rather than dead code, so each needs a human decision. Filed as test: 36 assigned-but-unused locals in the test suite may be dropped assertions #265.
• _vendor_admesh_truss.py. Vendored; left to track upstream.

Issues filed

• chore: adopt a ruff config and clear the 575 line-too-long / 82 semicolon-statement findings #262 — adopt a ruff config and clear the line-length / semicolon findings
• chore: replace hardcoded /tmp paths in benchmark and scene scripts (bandit B108, 11 sites) #263 — replace 11 hardcoded /tmp paths in benchmark and scene scripts (bandit B108), plus B310/B110 in pypi_publish.py
• refactor: reduce cyclomatic complexity in the mesh I/O readers and mutation routines (radon D/E) #264 — reduce cyclomatic complexity in the mesh I/O readers and mutation routines (radon D/E)
• test: 36 assigned-but-unused locals in the test suite may be dropped assertions #265 — 33 assigned-but-unused locals in the test suite may be dropped assertions
• chore: keep the gmsh reader's validation-only parses but silence the F841 warnings #266 — keep the gmsh reader's validation-only parses but silence the F841 warnings
• chore: add a code-smell / security scan lane to CI so these findings do not re-accumulate #267 — add a code-smell / security scan lane to CI so findings do not re-accumulate

No issues were closed.

Testing

pytest -k 'not block_o' before and after: 1488 passed, 79 skipped, 103 deselected, identical in both runs. The block_o fixture was deselected for runtime, as is standard for this suite.

Constraints held: no public API signature changed, no change to _skeletonize() behavior, no change to fort.14 I/O semantics, and no change to adjacency invariants.

---

Generated by Claude Code