refactor(config): migrate to pyproject.toml, patch tests with mock

- Remove pytest-based integration tests requiring real `gh` authentication.
- Add mocked tests for `test_issue_fetch_sh.py` and `test_resolve_preflight_sh.py` to simulate `gh` CLI behavior.
- Ensure mocked tests preserve key behaviors like command passthrough, environment variable handling, and output validation.
- Minor adjustment in `locate-scan-query.sh` fallback logic to avoid error when no matching files are found.
- Update CI workflow to install `scipy` for compatibility or extended test dependencies.
- Consolidated configuration by moving pytest options and ruff settings to `pyproject.toml`.
- Removed `pytest.ini` and adjusted pre-commit hooks to reflect updated config.
- Simplified GitHub Actions workflow by removing unnecessary `working-directory`.

Author: Borda

.github/workflows/ci-tests.yml

@@ -11,6 +11,7 @@ jobs:
   tests:
     runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
         os: ["ubuntu-latest", "macos-latest", "windows-latest"]
         python-version: ["3.10", "3.12"]
@@ -24,10 +25,9 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Install pytest
-        run: pip install -q pytest
+        run: pip install -q pytest pytest-cov scipy
 
       - name: Run plugin's bin tests
-        working-directory: plugins/
         env:
           RUN_INTEGRATION: "1"
-        run: pytest .
+        run: pytest

.gitignore

@@ -48,3 +48,6 @@ site/
 __pycache__/
 *.py[cod]
 *$py.class
+
+.coverage
+uv.lock

.pre-commit-config.yaml

@@ -70,10 +70,9 @@ repos:
     hooks:
       - id: ruff
         name: 🦀 ruff
-        args: ["--line-length=120", "--fix"]
+        args: ["--fix"]
       - id: ruff-format
         name: 🦀 ruff-format
-        args: ["--line-length=120"]
 
   - repo: https://github.com/codespell-project/codespell
     rev: v2.4.2

plugins/codemap/bin/locate-scan-query.sh

@@ -17,7 +17,7 @@ if command -v scan-query >/dev/null 2>&1; then
 elif [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -x "${CLAUDE_PLUGIN_ROOT}/bin/scan-query" ]; then
     SQ="${CLAUDE_PLUGIN_ROOT}/bin/scan-query"
 else
-    SQ=$(ls "$HOME/.claude/plugins/cache"/*/codemap/*/bin/scan-query 2>/dev/null | sort -V | tail -1)
+    SQ=$(ls "$HOME/.claude/plugins/cache"/*/codemap/*/bin/scan-query 2>/dev/null | sort -V | tail -1 || true)
 fi
 
 if [ -n "$SQ" ] && [ -x "$SQ" ]; then

plugins/develop/tests/test_issue_fetch_sh.py

@@ -11,7 +11,6 @@
 import subprocess
 from pathlib import Path
 
-import pytest
 
 SCRIPT = Path(__file__).parent.parent / "bin" / "issue-fetch.sh"
 
@@ -89,11 +88,10 @@ def test_non_numeric_arg_rejected(tmp_path: Path):
     assert not (tmp_path / "gh-args.txt").exists()
 
 
-@pytest.mark.skipif(not os.getenv("RUN_INTEGRATION"), reason="requires real gh auth")
-def test_integration_fetches_real_issue():
-    """End-to-end: fetch a known public issue through real gh CLI."""
-    # Use a low-numbered, stable issue on a well-known public repo.
-    # Caller must set RUN_INTEGRATION=1 and have gh authenticated.
-    result = sh("#1", cwd="/tmp")
-    # gh returns 0 on success; output should be non-empty.
-    assert result.returncode in (0, 1)
+def test_mocked_fetch_passes_through_output(tmp_path: Path):
+    """Mocked fetch: gh stdout is forwarded and exit 0 is preserved."""
+    _make_fake_gh(tmp_path, exit_code=0, stdout_text="Issue title: Fix the bug")
+    env = {"PATH": f"{tmp_path}/bin:/usr/bin:/bin"}
+    result = sh("#1", env=env)
+    assert result.returncode == 0
+    assert "Fix the bug" in result.stdout

plugins/foundry/tests/test_c33_dir_resolution.py

@@ -3,7 +3,7 @@
 Old code: ls -d ~/.claude/plugins/cache/borda-ai-rig/ returns the root dir itself —
 no version specificity, causing grep to scan all cached versions × all plugins.
 
-Fixed code: ls -td .../foundry/*/ resolves to latest version dir only.
+Fixed code: ls -d .../foundry/*/ | sort -V | tail -1 resolves to latest version dir only.
 """
 
 import subprocess
@@ -20,10 +20,10 @@ def test_fixed_resolution_finds_latest_version(tmp_path: Path) -> None:
     v2 = tmp_path / "foundry" / "0.17.0"
     v1.mkdir(parents=True)
     v2.mkdir(parents=True)
-    # Touch v2 to ensure ls -td sorts it first (newer mtime)
-    v2.touch()
 
-    result = _bash(f'_C33_DIR=$(ls -td "{tmp_path}/foundry/"*/ 2>/dev/null | head -1); echo "${{_C33_DIR:-.claude/}}"')
+    result = _bash(
+        f'_C33_DIR=$(ls -d "{tmp_path}/foundry/"*/ 2>/dev/null | sort -V | tail -1); echo "${{_C33_DIR:-.claude/}}"'
+    )
     assert result.returncode == 0
     resolved = result.stdout.strip()
     assert "0.17.0" in resolved, f"Expected version-specific path, got: {resolved}"
@@ -33,9 +33,8 @@ def test_fixed_resolution_excludes_older_versions(tmp_path: Path) -> None:
     """Fixed resolution returns exactly one version, not all of them."""
     for ver in ["0.15.0", "0.16.0", "0.17.0"]:
         (tmp_path / "foundry" / ver).mkdir(parents=True)
-    (tmp_path / "foundry" / "0.17.0").touch()
 
-    result = _bash(f'ls -td "{tmp_path}/foundry/"*/ 2>/dev/null | head -1')
+    result = _bash(f'ls -d "{tmp_path}/foundry/"*/ 2>/dev/null | sort -V | tail -1')
     assert result.returncode == 0
     lines = [line for line in result.stdout.strip().splitlines() if line]
     assert len(lines) == 1, f"Should resolve to single version dir, got: {lines}"
@@ -60,6 +59,8 @@ def test_old_code_returns_root_not_version(tmp_path: Path) -> None:
 
 def test_fallback_when_no_cache(tmp_path: Path) -> None:
     """_C33_DIR falls back to .claude/ when cache absent."""
-    result = _bash(f'_C33_DIR=$(ls -td "{tmp_path}/foundry/"*/ 2>/dev/null | head -1); echo "${{_C33_DIR:-.claude/}}"')
+    result = _bash(
+        f'_C33_DIR=$(ls -d "{tmp_path}/foundry/"*/ 2>/dev/null | sort -V | tail -1); echo "${{_C33_DIR:-.claude/}}"'
+    )
     assert result.returncode == 0
     assert result.stdout.strip() == ".claude/"

plugins/oss/bin/commit_all_items.sh

@@ -11,6 +11,8 @@
 #   $5  SUMMARIES_FILE    — optional path to file with bullet-list item summaries
 #   --codex               — include OpenAI Codex co-author trailer (pass anywhere)
 set -euo pipefail
+# timeout is GNU coreutils — not available on macOS by default.
+command -v timeout >/dev/null 2>&1 || { timeout() { shift; "$@"; }; }
 
 PR_NUMBER=""
 N_AS_SUGGESTED=0

plugins/oss/bin/setup_release_dir.sh

@@ -9,6 +9,8 @@
 # CHANGELOG.md is excluded from the backup loop — it is a symlink; re-linking
 # on re-run is safe and intentional.
 set -euo pipefail
+# timeout is GNU coreutils — not available on macOS by default.
+command -v timeout >/dev/null 2>&1 || { timeout() { shift; "$@"; }; }
 
 RELEASE_DIR="${1:?release_dir required}"
 CHANGELOG_FILE="${2:?changelog_file required}"

plugins/oss/bin/stage_item_changes.sh

@@ -4,6 +4,8 @@
 # source-extension untracked files.  Extracted from oss:resolve
 # action-item-dispatch Phase 2 staging block (AI7).
 set -euo pipefail
+# timeout is GNU coreutils — not available on macOS by default.
+command -v timeout >/dev/null 2>&1 || { timeout() { shift; "$@"; }; }
 
 ITEM_ID="${1:?item_id required}"
 

plugins/oss/tests/test_resolve_preflight_sh.py

@@ -9,11 +9,43 @@
 from __future__ import annotations
 
 import os
+import shutil
 import stat
 import subprocess
 from pathlib import Path
 
-import pytest
+_SHADOW_TOOLS = [
+    "bash",
+    "sh",
+    "date",
+    "grep",
+    "head",
+    "xargs",
+    "wc",
+    "tr",
+    "mkdir",
+    "git",
+    "find",
+    "cat",
+    "sort",
+    "tail",
+]
+
+
+def _make_shadow_bin(tmp_path: Path, exclude: list[str] | None = None) -> Path:
+    """Create bin dir with symlinks to system tools, excluding named executables."""
+    shadow = tmp_path / "shadow_bin"
+    shadow.mkdir(exist_ok=True)
+    for tool in _SHADOW_TOOLS:
+        if exclude and tool in exclude:
+            continue
+        found = shutil.which(tool)
+        if found:
+            link = shadow / tool
+            if not link.exists():
+                link.symlink_to(found)
+    return shadow
+
 
 SCRIPT = Path(__file__).parent.parent / "bin" / "resolve_preflight.sh"
 
@@ -42,14 +74,12 @@ def _make_fake_bin(tmp_path: Path, name: str, script_content: str) -> Path:
 
 def test_gh_not_found(tmp_path: Path):
     """No gh on PATH → exit 1 with stderr "gh not found"."""
-    # Provide only basic shell utilities — no gh, no claude.
-    # Need at least bash, find, mkdir, date, cat, grep, head, xargs, git in PATH.
+    # Shadow bin has real tools but no gh — prevents pre-installed gh on CI from being found.
+    shadow = _make_shadow_bin(tmp_path, exclude=["gh"])
     env = {
         "HOME": str(tmp_path),
-        "PATH": "/usr/bin:/bin",  # standard tools but no gh
+        "PATH": str(shadow),
     }
-    # Run in tmp_path (not a git repo) — the script's git checks fail silently
-    # via `|| true`, so gh-not-found is the first hard failure.
     result = sh(env=env, cwd=str(tmp_path))
     assert result.returncode == 1
     assert "gh not found" in result.stderr
@@ -76,10 +106,23 @@ def test_gh_present_but_unauthenticated(tmp_path: Path):
     assert "gh found but not authenticated" in result.stderr
 
 
-@pytest.mark.skipif(not os.getenv("RUN_INTEGRATION"), reason="requires real gh auth")
-def test_integration_happy_path():
-    """End-to-end: real gh auth + real git repo → exit 0, GH_OK=true emitted."""
-    repo_root = Path(__file__).parents[3]
-    result = sh(cwd=str(repo_root))
+def test_happy_path_mocked(tmp_path: Path):
+    """Mocked happy path: authenticated gh → exit 0, GH_OK=true on stdout."""
+    _make_fake_bin(
+        tmp_path,
+        "gh",
+        "#!/bin/sh\n"
+        'if [ "$1" = "auth" ]; then\n'
+        '  echo "Logged in to github.com as testuser (oauth_token)" >&2\n'
+        "  exit 0\n"
+        "fi\n"
+        "exit 0\n",
+    )
+    _make_fake_bin(tmp_path, "claude", "#!/bin/sh\nexit 0\n")
+    env = {
+        "HOME": str(tmp_path),
+        "PATH": f"{tmp_path / 'bin'}:/usr/bin:/bin",
+    }
+    result = sh(env=env, cwd=str(tmp_path))
     assert result.returncode == 0
     assert "GH_OK=true" in result.stdout