Repository navigation
Phase 4: repository infrastructure — CI, pyproject, lint, Docker, tools - #4
Merged
Merged
Conversation
…ive calls - Three tools built their paths from parents[2] / "heatshield", so they broke if the clone had any other name, and they wrote output to tools/ instead of evidence/ as the docs say. A shared tools/_common.py now provides the repository root, a python-dotenv loader (replacing five hand-written parsers) and evidence_file(). - Every tool that reaches a live API (the Nokia sandbox, Gemini or Groq) now exits unless given --live. verify_live.py requires --mode; it used to default to live. The reason: a smoke run of these tools during this phase found a real .env in the parent folder and made about 25 live sandbox calls. Nothing was committed from that run, and the results matched the 9 Sep evidence. - tests/test_tools.py checks these guards by parsing the tools, never by running them. - .gitignore drops the portfolio-era _ortak/ rules and ignores the sink log. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The image ran as root and COPY . . pulled in tests, tools, evidence, docs and any local virtualenv. It now copies apps/, packages/ and fixtures/, installs only runtime dependencies, and runs as an unprivileged user (uid 10001). Built and run locally: /health, /demo and a demo scenario return 200, and an unauthenticated write returns 401. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- GitHub Actions: ruff and pytest on Python 3.12 and 3.13, plus a Docker job that builds the image, runs it, and checks /health, /demo, one demo scenario, a 401 on an unauthenticated write, and a non-root user. - SECURITY.md: how to report privately, the scope, and the guarantees the code makes, with where they are tested. There is no CONTRIBUTING file, because the licence stays all-rights-reserved. - CHANGELOG.md summarises phases 1-4 against v0.1-hackathon. - README gains a CI badge; the test count is now 194. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This belongs before the tools commit. It was left unstaged when an earlier `git add pytest.ini` failed, so pytest.ini's removal landed in c02d8be. - pyproject.toml holds the project metadata, compatible dependency ranges, pytest settings (replacing pytest.ini) and ruff config. - requirements.txt pins the runtime versions the tests and the image run. pytest moved to requirements-dev.txt with ruff. - Ruff checks correctness only: pyflakes, syntax errors, bugbear. B008 is ignored because it is FastAPI's idiom. There is no formatter, so a lint run never rewrites whole files. The fixes it asked for: unused imports, exception chaining (`from e`) in three places, and a strict zip in the planner guard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Sep 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #3. Merge order: #1 → #2 → #3 → this. The licence stays all-rights-reserved (owner's decision), so there is no CONTRIBUTING file.
What's added
/health,/demo, one demo scenario, a 401 on an unauthenticated write, and a non-root user.pyproject.tomlpytest.ini) and ruff config.requirements.txtpins the runtime versions;requirements-dev.txtadds pytest and ruff.strict, unused imports, and one real bug in this branch (an undefinedROOTafter the tools refactor).apps/,packages/andfixtures/; no tests, tools, evidence, docs or local venv.heatshield, and output goes toevidence/as the docs said..envloader instead of five.Guard against accidental live calls
During this phase a smoke run of three tools found the real
.envin the parent folder and made about 25 live Nokia sandbox calls.The fix:
--live.verify_live.pyrequires--mode(it used to default tolive).tests/test_tools.pychecks this by parsing the tools, never running them.Known and left for phase 5
tools/verify_live.py(623 lines) still carries portfolio-era table-patching code (PROJECTS,api-availability-master.md). It can't be exercised without live keys, so it is only guarded here, not refactored.Note on history
c02d8bealso carries thepytest.iniremoval;191c23cadds thepyproject.tomlthat replaces it. Squash-merging makes this invisible.🤖 Generated with Claude Code