chore: replace Codacy with in-repo tooling - #151
Merged
Conversation
The repository is no longer registered with Codacy, so CODACY_PROJECT_TOKEN is invalid and this workflow would fail on every run. CodeQL continues to upload SARIF to GitHub code scanning, so security results are not lost. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The tree had drifted out of black compliance. Isolated in its own commit so the mechanical diff does not obscure the substantive changes that follow. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
select was commented out, leaving ruff's defaults with F401, F841, E501, B008 and C901 further suppressed, so ruff reported no findings at all. Also fixes two defects: target-version said py312 while requires-python allows 3.11, which would let UP rules emit 3.12-only syntax; and the setuptools-scm-generated _version.py was being linted despite being gitignored and absent from a fresh checkout. Findings are resolved in the following commit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Nine findings auto-fixed by `ruff check --fix` (import sorting, PEP
585/604 annotations, useless object inheritance, f-string conversion,
and the typing import cleanup, which ruff performed itself as a
cascading fix once List/Optional became unused). C416 fixed by hand
(ruff's unsafe-fix category).
Two findings are suppressed rather than fixed:
- F401 on models/proposal.py: `partner` is imported defensively.
models/__init__.py already imports partner six lines before proposal
is imported, so proposal.py's own import is not what registers the
model today; configure_mappers() succeeds without it, and the test
suite currently passes identically with or without this line, so it
does not discriminate between the two states. The import is kept so
that the string-based ForeignKey("partner.partner_id") keeps
resolving even if __init__.py's import order is ever changed.
- B006 on cli/cli_main.py: the mutable default is the standard Typer
Annotated idiom and Typer does not mutate it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Replaces the repository-external Codacy checks with equivalents whose configuration lives in the repository. ruff findings surface as inline PR annotations via --output-format=github. Kept separate from test_database.yml so lint results do not wait on Postgres startup and ER diagram generation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Mechanical sweep by the pre-commit hooks added in the preceding commit. Whitespace and final-newline changes only; no file's content is otherwise altered. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- Exclude alembic in the ruff config itself, not just in the runners' arguments, so editors and a bare `ruff check .` agree with CI. The migrations are historical records and are deliberately unlinted. - Drop `--fix` from the pre-commit ruff hook. F401 is auto-fixable, and this package uses deliberate registration-only imports; a hook that rewrites them can silently delete one and surface it later as a mapper-configuration failure. The hook now matches CI's check-only behaviour. - Rename the hook to its current id, `ruff-check`; `ruff` is a legacy alias that a future rev bump may drop. - Scope the whitespace hooks and the large-file check away from examples/data/uploader/, which holds multi-megabyte vendored fixtures. - Correct the README's claim that passing the hooks implies CI will pass. - Make black's exclusion of the generated _version.py explicit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The preceding commit moved the alembic exclusion into the ruff config so editors and a bare `ruff check .` agree with CI. black had the same gap: its config excluded only the generated _version.py, so an editor's black extension with format-on-save would reformat historical migrations that CI never inspects. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…to chore/replace-codacy-tooling # Conflicts: # diagrams/erdiagram_targetdb_latest.pdf # docs/tbls/public.fluxstd.md # docs/tbls/public.sky.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The repository was removed from the Codacy service, so
.github/workflows/codacy.ymlis dead —CODACY_PROJECT_TOKENis invalid and it would fail on every run. This replaces it with equivalent checks whose configuration lives in the repository, where it is visible and version-controlled rather than in a web UI.Note on security scanning: CodeQL has been disabled (
disabled_manually, since 2026-05-22) independently of this change, well before this work started. So removing Codacy does not, in itself, take away code-scanning coverage that CodeQL was providing — there wasn't any at the time of this PR. Re-enabling CodeQL is a separate, one-click decision under Settings → Actions → Workflows, not something this PR does.What changed
eb575a8361c05d86a72daE, W, F, I, B, C4, UP268ff346fdfeb8Lintworkflow and pre-commit hooks1bdd4712eb9072,a5d860cFormatting is isolated in its own commits so the mechanical diffs do not obscure the substantive changes.
Two ruff configuration defects fixed along the way
target-versionsaidpy312whilerequires-pythonallows 3.11. WithUPrules enabled, ruff was free to rewrite code into 3.12-only syntax and break the declared 3.11 support._version.pywas being linted despite being gitignored and absent from a fresh checkout, so the linted file set differed between local and CI.Two deliberate suppressions
F401onmodels/proposal.py.partneris imported defensively.models/__init__.pyalready imports it first, so this line is not what registers the model today —configure_mappers()succeeds without it and the test suite returns an identical result either way. It is kept so the string-basedForeignKey("partner.partner_id")keeps resolving if that import order is ever changed. A blanketruff check --fixwould have deleted it, which is why the pre-commit hook is check-only (below).B006oncli/cli_main.py. The standard TyperAnnotatedidiom; Typer does not mutate the default, and converting it would change the--helpoutput.Notes for review
F401,F841andB008move from globally ignored to enforced.C901stays off (C90is not selected) — the codebase currently has 5 latent mccabe violations inutils.pythat would surface if anyone adds it.alembic/is deliberately unlinted and unformatted. The exclusion lives inpyproject.tomlfor both ruff and black, not only in the workflow's arguments, so editor extensions agree with CI and cannot rewrite historical migrations.--fix, matching CI's check-only behaviour. BecauseF401is auto-fixable and this package uses deliberate registration-only imports, a rewriting hook could silently delete one and surface it later as aNoReferencedTableError.check-yamlexcludesmkdocs.yml, whose mkdocs-material!!python/name:tagsyaml.safe_loadcannot construct.args: [--unsafe]was rejected because it would weaken the check for every other YAML file, including the workflows added here.Verified locally
ruff check .clean ·black --check .clean ·pre-commit run --all-filesall 7 hooks pass, idempotent across two runs ·pytest tests/ -vwith Docker: 29 passed, 1 skipped.Not included
Enabling Dependabot alerts, secret scanning and push protection — those are settings changes requiring admin rights, not code changes. They have since been enabled directly on the repository, independently of this PR.
🤖 Generated with Claude Code