fix(core): remove invalid CLI print guidance - #339
Conversation
chore(release): estabilizacao da linha 0.12.0-dev no flext-core
…27b55 chore(wip): preserve local worktree changes
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
📝 WalkthroughWalkthroughThe PR replaces the Makefile workspace flow, updates Python and development-tool configuration, adds generated cross-platform CI and Linux container checks, and adjusts enforcement wording, documentation examples, and test imports. ChangesWorkspace automation and CI
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 2⚔️ Resolve merge conflicts 💡
🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
Canonical association (governance evidence, no body replacement)
|
0f0c90c to
c0097c9
Compare
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
There was a problem hiding this comment.
Pull request overview
This PR removes invalid u.Cli.print guidance from flext-core by updating enforcement messaging and replacing print-based documentation examples, while also regenerating project scaffolding (Make surface, toolchain pins, CI, and clean-machine Docker proofs) to keep the developer workflow aligned with canonical make verbs.
Changes:
- Updated enforcement catalog/fix-action messaging to target raw
print()and describe the structured-logging rewrite. - Replaced print-based handler doc examples with assertion-based snippets.
- Regenerated repo scaffolding: Makefile verb surface/serialization, CI workflows, toolchain pins (
.python-version/.mise.toml),.gitignore, and distro Docker bootstrap images.
Reviewed changes
Copilot reviewed 28 out of 29 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/unit/test_utilities_runtime_violation_registry_coverage_100.py | Import order adjustment. |
| tests/unit/test_typings_aliases.py | Import order adjustment. |
| tests/unit/test_service.py | Import order adjustment. |
| tests/unit/test_result_transforms.py | Import order adjustment. |
| tests/unit/test_public_api_contract.py | Import consolidation/reorder (includes FlextSettings). |
| tests/unit/test_handler_discovery_class.py | Import order adjustment. |
| tests/unit/test_handler_decorator_edges.py | Import order adjustment. |
| tests/unit/test_handler_decorator_discovery.py | Import order adjustment. |
| tests/unit/test_exceptions_structured_contracts.py | Import order adjustment. |
| tests/unit/_utilities/test_mapper.py | Minor formatting (blank line). |
| src/flext_core/_handlers_parts/flexthandlers_part_07.py | Replaced print-based discovery examples with assertions. |
| src/flext_core/_handlers_parts/flexthandlers_part_05.py | Replaced print-based handler execution example with assertion. |
| src/flext_core/_handlers_parts/flexthandlers_part_04.py | Replaced print-based validation example with assertion. |
| src/flext_core/_constants/_enforcement_parts/flextconstantsenforcement_part_08.py | Updated fix-action message for the print() rewrite. |
| src/flext_core/_constants/_enforcement_catalog_rows_parts/_parts/flextconstantsenforcementcatalogrows_part_01_b.py | Updated enforcement catalog row text to reference print(). |
| pyproject.toml | Regenerated/updated tooling config (coverage source, pyrefly paths, pytest defaults, etc.). |
| Makefile | Regenerated Make surface (serialization, docs phases, worktree ops, environment handling). |
| development/contributing.md | Installation verification now uses make status. |
| ci/docker/ubuntu.Dockerfile | Added generated clean-machine bootstrap proof (Ubuntu). |
| ci/docker/fedora.Dockerfile | Added generated clean-machine bootstrap proof (Fedora). |
| ci/docker/debian.Dockerfile | Added generated clean-machine bootstrap proof (Debian). |
| ci/docker/arch.Dockerfile | Added generated clean-machine bootstrap proof (Arch). |
| ci/docker/alpine.Dockerfile | Added generated clean-machine bootstrap proof (Alpine). |
| .vscode/settings.json | Simplified Python env search paths. |
| .python-version | Relaxed Python pin from patch to minor (3.13). |
| .mise.toml | Toolchain definition updated to match regenerated SSOT outputs. |
| .gitignore | Replaced prior “block-all” model with managed-artifact allowlist + ignores. |
| .github/workflows/ci.yml | CI now targets 0.12.0-dev, adds mise toolchain step, makes tests blocking. |
| .github/workflows/ci-matrix.yml | Added multi-environment “clean machine” CI matrix workflow. |
Suppressed comments (1)
src/flext_core/_handlers_parts/flexthandlers_part_07.py:104
- Same issue here:
all(...)is True for an empty sequence, so the example can succeed even if no handlers were found. As an example assertion, it’s more meaningful to also check thathandlersis non-empty.
Example:
>>> handlers = FlextHandlers.Discovery.scan_module(my_module)
>>> assert all(settings.command for _, _, settings in handlers)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| Example: | ||
| >>> handlers = FlextHandlers.Discovery.scan_class(MyService) | ||
| >>> for method_name, settings in handlers: | ||
| ... u.Cli.print(f"{method_name}: {settings.command.__name__}") | ||
| >>> assert all(settings.command for _, settings in handlers) | ||
|
|
| @set -eu; \ | ||
| selected="$(strip $(PROJECTS))"; \ | ||
| if [ -z "$$selected" ]; then selected="."; fi; \ | ||
| set --; \ |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 14
🧹 Nitpick comments (4)
Makefile (3)
593-598: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winReference
PYTEST_TARGETSinstead of repeating its default value.Line 594 compares the resolved run set against the literal
$(PROJECT_ROOT)/tests.PYTEST_TARGETSat Line 33 holds that value and is overridable. If a caller overridesPYTEST_TARGETS, the comparison fails and coverage stays required for a narrowed run. Compare against$(PYTEST_TARGETS).♻️ Proposed fix
- [ "$$_pytest_run" != "$(PROJECT_ROOT)/tests" ]; then \ + [ "$$_pytest_run" != "$(PYTEST_TARGETS)" ]; then \🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Makefile` around lines 593 - 598, Update the coverage condition in the Makefile test-running logic to compare _pytest_run against the overridable $(PYTEST_TARGETS) variable instead of the hardcoded $(PROJECT_ROOT)/tests value, preserving the existing coverage behavior for narrowed runs.
559-559: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDeclare
FILESor remove it.Line 559 reads
$(FILES). The variable block at Lines 18-37 declaresFILEbut notFILES. The expansion is empty unless a caller overrides it on the command line, so the selector is undocumented and absent from the help output. AddFILES ?=next toFILE ?=and document it, or drop the reference.♻️ Proposed declaration
FILE ?= +FILES ?=🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Makefile` at line 559, Declare the FILES Make variable alongside FILE in the variable block and add it to the Makefile help output, preserving the existing $(FILES) selector used by the command at the affected target.
189-215: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueAlign the indentation of the
_builtin_docs_*and_builtin_clean_generatedentries.Lines 203-208 have no leading tab, while every other entry in
_BUILTIN_HANDLERShas one. Make joins backslash continuations into single spaces, so behavior does not change. The inconsistency indicates a formatting defect in the SSOT template that generates this file. Fix it inMakefile.j2and regenerate.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Makefile` around lines 189 - 215, Align the leading-tab indentation for the `_builtin_docs_*` and `_builtin_clean_generated` entries in the `_BUILTIN_HANDLERS` template within `Makefile.j2`, then regenerate `Makefile` so all continuation entries match the surrounding formatting..github/workflows/ci-matrix.yml (1)
23-31: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winAdd
timeout-minutesto the matrix jobs.No job in this workflow declares a timeout.
.github/workflows/ci.ymlsetstimeout-minutes: 60. The distro jobs build five container images and run a fullmake setupinside each build. A stalled package download or a stalleduvresolution then consumes the default six-hour runner limit for every matrix leg. Declare an explicit timeout per job.Also applies to: 45-46, 64-65
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci-matrix.yml around lines 23 - 31, Add an explicit timeout-minutes setting to the distro-matrix job and the other matrix jobs identified in the workflow, matching the existing 60-minute timeout used by ci.yml. Place it at each job level so every matrix leg, including container builds and setup execution, is bounded.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci-matrix.yml:
- Line 48: Update the checkout steps for the macOS and Windows jobs in
ci-matrix.yml to match ci.yml by enabling recursive submodules, setting
fetch-depth to 0, and disabling persisted credentials with persist-credentials:
false. Apply these options to both checkout usages identified near the macOS and
Windows setup flows.
- Around line 33-39: Update the checkout step using the visible actions/checkout
invocation to enable recursive submodule checkout before the matrix Docker build
runs. Preserve the existing pinned action version and build command so the
context passed by “Build ${{ matrix.distro }} image” includes all managed
submodule contents.
In @.github/workflows/ci.yml:
- Around line 22-26: Update the actions/checkout step in the workflow to set
persist-credentials to false while preserving its existing submodules and
fetch-depth settings; apply the same checkout credential configuration to the
checkout steps in ci-matrix.yml.
In `@ci/docker/alpine.Dockerfile`:
- Around line 6-13: Add the same Bash SHELL directive used by the other
Dockerfiles immediately after the apk package-install step, enabling the
pipefail option before the curl-to-sh pipeline in the uv installation block.
In `@ci/docker/arch.Dockerfile`:
- Around line 13-15: Update the arch Dockerfile after the uv installation to set
ENV PATH explicitly, adding /root/.local/bin alongside the existing system paths
so managed Python executables installed by uv are discoverable during make
setup.
- Around line 7-9: Update the package setup command before the existing pacman
upgrade in the Docker build to run pacman-key --init, ensuring the Arch keyring
is initialized before package hooks execute. Keep the current package
installation and cache cleanup flow unchanged.
In `@ci/docker/fedora.Dockerfile`:
- Line 20: Bootstrap and materialize the local flext-infra checkout at the path
expected by the setup flow before invoking make setup in
ci/docker/fedora.Dockerfile lines 20-20 and ci/docker/ubuntu.Dockerfile lines
21-21; apply the same sequence in both files so uv can resolve the local
requirement.
In `@Makefile`:
- Around line 658-661: Update the test result status logic in the Makefile
recipe so warnings and skipped tests do not set rc=1; restrict the failure
condition to failed_count and error_count, preserving the existing nonzero
return behavior for actual test failures and errors.
- Around line 140-146: Make FLEXT_INFRA_BOOTSTRAP select the editable checkout
only when FLEXT_INFRA_SOURCE_ROOT contains the expected pyproject.toml;
otherwise fall back to FLEXT_INFRA_BOOTSTRAP_REQUIREMENT. In
ci/docker/debian.Dockerfile:21, ci/docker/alpine.Dockerfile:18, and
ci/docker/arch.Dockerfile:20, confirm that make setup resolves flext-infra from
the pinned git requirement after this change, or copy the submodule content into
each image if required.
- Around line 529-536: Update _builtin_deps_upgrade to derive its selected
projects using the same PROJECT/PROJECTS selector logic as the lock helper,
rather than reading PROJECTS alone. Ensure PROJECT=flext-cli targets flext-cli
for deps modernize while preserving existing PROJECTS and default-directory
behavior.
- Around line 752-758: Add explicit non-empty validation for both BRANCH and
BASE in _builtin_worktree_add and _builtin_worktree_update before invoking the
workspace worktree mutations. Ensure each missing variable fails with an error
message that identifies whether BRANCH or BASE is unset, while preserving the
existing CLI arguments and operation behavior.
- Around line 372-488: Update preflight_managed_submodules,
initialize_declared_submodules, and reconcile_managed_submodules so each git
config --get-regexp result feeds its while read loop without a pipeline, keeping
loop execution in the current Makefile shell. Preserve the existing set -eu
behavior and ensure exit 1 from validation or reconciliation terminates
_builtin_setup_submodules and triggers normal Make cleanup.
In `@pyproject.toml`:
- Around line 368-369: Update the Pyright configuration entries venv and
venvPath so they resolve to the project’s created .venv: use .venv as the
virtual-environment name and the default path rather than pointing to the parent
directory.
In
`@src/flext_core/_constants/_enforcement_parts/flextconstantsenforcement_part_08.py`:
- Line 50: Update the print-call transformation logic near the regex and
replacement associated with "change_message" to match only bare print() calls,
excluding qualified calls such as u.Cli.print(...), so replacements cannot
create invalid chained expressions. Prefer AST-aware detection or an equivalent
qualification check, and add coverage verifying both bare and qualified print
calls.
---
Nitpick comments:
In @.github/workflows/ci-matrix.yml:
- Around line 23-31: Add an explicit timeout-minutes setting to the
distro-matrix job and the other matrix jobs identified in the workflow, matching
the existing 60-minute timeout used by ci.yml. Place it at each job level so
every matrix leg, including container builds and setup execution, is bounded.
In `@Makefile`:
- Around line 593-598: Update the coverage condition in the Makefile
test-running logic to compare _pytest_run against the overridable
$(PYTEST_TARGETS) variable instead of the hardcoded $(PROJECT_ROOT)/tests value,
preserving the existing coverage behavior for narrowed runs.
- Line 559: Declare the FILES Make variable alongside FILE in the variable block
and add it to the Makefile help output, preserving the existing $(FILES)
selector used by the command at the affected target.
- Around line 189-215: Align the leading-tab indentation for the
`_builtin_docs_*` and `_builtin_clean_generated` entries in the
`_BUILTIN_HANDLERS` template within `Makefile.j2`, then regenerate `Makefile` so
all continuation entries match the surrounding formatting.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 754eb963-e595-4f26-9aff-16891de15020
📒 Files selected for processing (29)
.github/workflows/ci-matrix.yml.github/workflows/ci.yml.gitignore.mise.toml.python-version.vscode/settings.jsonMakefileci/docker/alpine.Dockerfileci/docker/arch.Dockerfileci/docker/debian.Dockerfileci/docker/fedora.Dockerfileci/docker/ubuntu.Dockerfiledevelopment/contributing.mdpyproject.tomlsrc/flext_core/_constants/_enforcement_catalog_rows_parts/_parts/flextconstantsenforcementcatalogrows_part_01_b.pysrc/flext_core/_constants/_enforcement_parts/flextconstantsenforcement_part_08.pysrc/flext_core/_handlers_parts/flexthandlers_part_04.pysrc/flext_core/_handlers_parts/flexthandlers_part_05.pysrc/flext_core/_handlers_parts/flexthandlers_part_07.pytests/unit/_utilities/test_mapper.pytests/unit/test_exceptions_structured_contracts.pytests/unit/test_handler_decorator_discovery.pytests/unit/test_handler_decorator_edges.pytests/unit/test_handler_discovery_class.pytests/unit/test_public_api_contract.pytests/unit/test_result_transforms.pytests/unit/test_service.pytests/unit/test_typings_aliases.pytests/unit/test_utilities_runtime_violation_registry_coverage_100.py
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| - name: Build ${{ matrix.distro }} image | ||
| run: >- | ||
| docker build | ||
| -f ci/docker/${{ matrix.distro }}.Dockerfile | ||
| -t ci-matrix-${{ matrix.distro }} | ||
| . |
There was a problem hiding this comment.
🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win
Check out submodules before the Docker build.
Line 33 checks out the repository without submodules: recursive. .github/workflows/ci.yml uses that option. Line 39 passes . as the build context, and line 18 of each Dockerfile copies that context, so every managed submodule path arrives empty. make setup then runs _builtin_setup_submodules and the flext-infra bootstrap against an empty flext-infra directory. The ci-matrix logs for debian and arch show exactly that failure.
🐛 Proposed fix
- - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+ submodules: recursive
+ fetch-depth: 0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Build ${{ matrix.distro }} image | |
| run: >- | |
| docker build | |
| -f ci/docker/${{ matrix.distro }}.Dockerfile | |
| -t ci-matrix-${{ matrix.distro }} | |
| . | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| fetch-depth: 0 | |
| - name: Build ${{ matrix.distro }} image | |
| run: >- | |
| docker build | |
| -f ci/docker/${{ matrix.distro }}.Dockerfile | |
| -t ci-matrix-${{ matrix.distro }} | |
| . |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 33-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci-matrix.yml around lines 33 - 39, Update the checkout
step using the visible actions/checkout invocation to enable recursive submodule
checkout before the matrix Docker build runs. Preserve the existing pinned
action version and build command so the context passed by “Build ${{
matrix.distro }} image” includes all managed submodule contents.
Source: Pipeline failures
| macos: | ||
| runs-on: macos-latest | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Align the macOS and Windows checkout options with ci.yml.
Both steps omit submodules: recursive and fetch-depth: 0, while .github/workflows/ci.yml sets both. Line 60 and line 80 then run make setup, which reconciles managed submodules and bootstraps flext-infra from the local checkout. The two jobs therefore validate a different input tree than the main CI job. Add the same options, and add persist-credentials: false.
Also applies to: 67-67
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 48-48: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci-matrix.yml at line 48, Update the checkout steps for
the macOS and Windows jobs in ci-matrix.yml to match ci.yml by enabling
recursive submodules, setting fetch-depth to 0, and disabling persisted
credentials with persist-credentials: false. Apply these options to both
checkout usages identified near the macOS and Windows setup flows.
Source: Linters/SAST tools
| - name: Checkout | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| submodules: recursive | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Set persist-credentials: false on the checkout step.
actions/checkout writes the job token into .git/config by default. The token then persists for every later step and can leak through uploaded artifacts or through submodule operations. No step in this job pushes to the repository, so the credential is not needed. zizmor reports the same finding for the checkout steps in .github/workflows/ci-matrix.yml.
🔒️ Proposed fix
with:
+ persist-credentials: false
submodules: recursive
fetch-depth: 0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: recursive | |
| fetch-depth: 0 | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| fetch-depth: 0 |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 22-26: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 22 - 26, Update the actions/checkout
step in the workflow to set persist-credentials to false while preserving its
existing submodules and fetch-depth settings; apply the same checkout credential
configuration to the checkout steps in ci-matrix.yml.
Source: Linters/SAST tools
| RUN apk add --no-cache \ | ||
| bash ca-certificates coreutils curl git make build-base nodejs util-linux-misc | ||
|
|
||
| # uv is an environment-provided executable, intentionally without a project | ||
| # patch pin. It installs the declared Python family before canonical bootstrap. | ||
| RUN curl -LsSf https://astral.sh/uv/install.sh \ | ||
| | env UV_UNMANAGED_INSTALL=/usr/local/bin sh | ||
| RUN uv python install 3.13 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Add the SHELL directive with pipefail.
ci/docker/arch.Dockerfile line 5 and ci/docker/debian.Dockerfile line 5 both set SHELL ["/bin/bash", "-o", "pipefail", "-c"]. This file does not. Line 11 pipes curl into sh, so a failed download still produces a successful layer and the missing uv surfaces later at line 13. Set the same SHELL directive after the apk add step that installs bash.
🐛 Proposed fix
RUN apk add --no-cache \
bash ca-certificates coreutils curl git make build-base nodejs util-linux-misc
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
# uv is an environment-provided executable, intentionally without a project📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN apk add --no-cache \ | |
| bash ca-certificates coreutils curl git make build-base nodejs util-linux-misc | |
| # uv is an environment-provided executable, intentionally without a project | |
| # patch pin. It installs the declared Python family before canonical bootstrap. | |
| RUN curl -LsSf https://astral.sh/uv/install.sh \ | |
| | env UV_UNMANAGED_INSTALL=/usr/local/bin sh | |
| RUN uv python install 3.13 | |
| RUN apk add --no-cache \ | |
| bash ca-certificates coreutils curl git make build-base nodejs util-linux-misc | |
| SHELL ["/bin/bash", "-o", "pipefail", "-c"] | |
| # uv is an environment-provided executable, intentionally without a project | |
| # patch pin. It installs the declared Python family before canonical bootstrap. | |
| RUN curl -LsSf https://astral.sh/uv/install.sh \ | |
| | env UV_UNMANAGED_INSTALL=/usr/local/bin sh | |
| RUN uv python install 3.13 |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci/docker/alpine.Dockerfile` around lines 6 - 13, Add the same Bash SHELL
directive used by the other Dockerfiles immediately after the apk
package-install step, enabling the pipefail option before the curl-to-sh
pipeline in the uv installation block.
| RUN pacman -Syu --noconfirm --needed \ | ||
| bash ca-certificates curl git make base-devel \ | ||
| && pacman -Scc --noconfirm |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Initialize the pacman keyring before the package upgrade.
The ci-matrix log for the arch leg reports that pacman found no secret key available to sign with, and the package hook failed. The log states the fix: run pacman-key --init. Add the keyring initialization before line 7.
🐛 Proposed fix
-RUN pacman -Syu --noconfirm --needed \
+RUN pacman-key --init \
+ && pacman-key --populate archlinux \
+ && pacman -Syu --noconfirm --needed \
bash ca-certificates curl git make base-devel \
&& pacman -Scc --noconfirm📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN pacman -Syu --noconfirm --needed \ | |
| bash ca-certificates curl git make base-devel \ | |
| && pacman -Scc --noconfirm | |
| RUN pacman-key --init \ | |
| && pacman-key --populate archlinux \ | |
| && pacman -Syu --noconfirm --needed \ | |
| bash ca-certificates curl git make base-devel \ | |
| && pacman -Scc --noconfirm |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci/docker/arch.Dockerfile` around lines 7 - 9, Update the package setup
command before the existing pacman upgrade in the Docker build to run pacman-key
--init, ensuring the Arch keyring is initialized before package hooks execute.
Keep the current package installation and cache cleanup flow unchanged.
Source: Pipeline failures
| @set -eu; \ | ||
| selected="$(strip $(PROJECTS))"; \ | ||
| if [ -z "$$selected" ]; then selected="."; fi; \ | ||
| set --; \ | ||
| for project in $$selected; do set -- "$$@" --projects "$$project"; done; \ | ||
| $(PROJECT_FLEXT_INFRA) deps modernize --workspace "$(PROJECT_ROOT)" \ | ||
| --apply --rewrite-constraints --skip-check "$$@" | ||
| $(call _run_for_selected_projects,) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
_builtin_deps_upgrade ignores PROJECT when it calls deps modernize.
Line 530 reads $(strip $(PROJECTS)) only. _run_for_selected_projects at Line 250 accepts PROJECT as well as PROJECTS. If a caller passes PROJECT=flext-cli, then uv lock --upgrade targets flext-cli, but deps modernize falls back to . and rewrites constraints in the wrong project. Use the same selector as the lock helper.
🐛 Proposed fix for the selector
- selected="$(strip $(PROJECTS))"; \
+ selected="$(strip $(if $(PROJECT),$(PROJECT),$(PROJECTS)))"; \📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| @set -eu; \ | |
| selected="$(strip $(PROJECTS))"; \ | |
| if [ -z "$$selected" ]; then selected="."; fi; \ | |
| set --; \ | |
| for project in $$selected; do set -- "$$@" --projects "$$project"; done; \ | |
| $(PROJECT_FLEXT_INFRA) deps modernize --workspace "$(PROJECT_ROOT)" \ | |
| --apply --rewrite-constraints --skip-check "$$@" | |
| $(call _run_for_selected_projects,) | |
| `@set` -eu; \ | |
| selected="$(strip $(if $(PROJECT),$(PROJECT),$(PROJECTS)))"; \ | |
| if [ -z "$$selected" ]; then selected="."; fi; \ | |
| set --; \ | |
| for project in $$selected; do set -- "$$@" --projects "$$project"; done; \ | |
| $(PROJECT_FLEXT_INFRA) deps modernize --workspace "$(PROJECT_ROOT)" \ | |
| --apply --rewrite-constraints --skip-check "$$@" | |
| $(call _run_for_selected_projects,) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Makefile` around lines 529 - 536, Update _builtin_deps_upgrade to derive its
selected projects using the same PROJECT/PROJECTS selector logic as the lock
helper, rather than reading PROJECTS alone. Ensure PROJECT=flext-cli targets
flext-cli for deps modernize while preserving existing PROJECTS and
default-directory behavior.
| if [ "$${failed_count:-0}" -gt 0 ] || [ "$${error_count:-0}" -gt 0 ] || \ | ||
| [ "$${warning_count:-0}" -gt 0 ] || [ "$${skipped_count:-0}" -gt 0 ]; then \ | ||
| if [ "$$rc" -eq 0 ]; then rc=1; fi; \ | ||
| fi; \ |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Confirm that warnings and skips must fail make test.
Lines 658-659 set rc=1 when warning_count or skipped_count is greater than zero. Skips are normal for platform-gated and optional-dependency tests. With this rule, make test fails on any skipped test, and the ci.yml test step is now blocking. Confirm the policy is intended, or restrict the failure condition to failed_count and error_count.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Makefile` around lines 658 - 661, Update the test result status logic in the
Makefile recipe so warnings and skipped tests do not set rc=1; restrict the
failure condition to failed_count and error_count, preserving the existing
nonzero return behavior for actual test failures and errors.
| _builtin_worktree_add: | ||
| $(call _require_apply) | ||
| @$(PROJECT_FLEXT_INFRA) workspace worktree --workspace "$(WORKSPACE)" --operation add --branch "$(BRANCH)" --base "$(BASE)" --apply | ||
|
|
||
| _builtin_worktree_update: | ||
| $(call _require_apply) | ||
| @$(PROJECT_FLEXT_INFRA) workspace worktree --workspace "$(WORKSPACE)" --operation update --branch "$(BRANCH)" --base "$(BASE)" --apply |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Validate BRANCH and BASE before the worktree mutations.
Lines 754 and 758 pass --branch "$(BRANCH)" and --base "$(BASE)" without checking that either is set. Both default to empty at Lines 27-28. An empty value reaches the CLI as an empty string argument. Add an explicit guard so the failure message names the missing variable.
🛡️ Proposed guard
_builtin_worktree_add:
$(call _require_apply)
+ `@if` [ -z "$(strip $(BRANCH))" ] || [ -z "$(strip $(BASE))" ]; then \
+ printf 'ERROR: worktree add requires BRANCH and BASE\n' >&2; exit 2; \
+ fi
@$(PROJECT_FLEXT_INFRA) workspace worktree --workspace "$(WORKSPACE)" --operation add --branch "$(BRANCH)" --base "$(BASE)" --apply🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Makefile` around lines 752 - 758, Add explicit non-empty validation for both
BRANCH and BASE in _builtin_worktree_add and _builtin_worktree_update before
invoking the workspace worktree mutations. Ensure each missing variable fails
with an error message that identifies whether BRANCH or BASE is unset, while
preserving the existing CLI arguments and operation behavior.
| venv = ".venv" | ||
| venvPath = ".." |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 3 'RUNTIME_VENV|venvPath|venv\s*=' Makefile pyproject.toml .vscode/settings.json
fd -H -t d '^\.venv$' . .. --max-depth 2 | sortRepository: flext-sh/flext-core
Length of output: 3391
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Repository top-level directories containing .venv:\n'
fd -H -t d '^\.venv$' . .. --max-depth 2 | sort || true
printf '\npyproject relevant sections:\n'
sed -n '340,380p' pyproject.toml
printf '\nMakefile profile setup section:\n'
sed -n '480,525p' Makefile
printf '\nSearch for make setup targets and RUNTIME_ROOT calculation:\n'
rg -n -C 2 '^(setup|.*setup|RUNTIME_ROOT|PROJECT_ROOT|MAKE_PROFILE|workspace-root|workspace-member)' MakefileRepository: flext-sh/flext-core
Length of output: 6928
Align Pyright to match the created virtual environment.
make setup creates $(PROJECT_ROOT)/.venv, and the VS Code setting points to <workspace>/.venv, but pyproject.toml points Pyright to ../.venv. Change the Pyright config to use .venv with the default path unless the workspace is intentionally outside the project root.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pyproject.toml` around lines 368 - 369, Update the Pyright configuration
entries venv and venvPath so they resolve to the project’s created .venv: use
.venv as the virtual-environment name and the default path rather than pointing
to the parent directory.
| "regex": r"\bprint\s*\(\s*(?P<args>[^)]*)\s*\)", | ||
| "replacement": r"u.fetch_logger(__name__).info(\g<args>)", | ||
| "change_message": "Rewrote u.Cli.print() to u.fetch_logger(__name__).info()", | ||
| "change_message": "Rewrote print() to u.fetch_logger(__name__).info()", |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Constrain the transformer to valid print() targets.
The regex on Line 48 also matches the print suffix in u.Cli.print(...). The replacement on Line 49 then produces invalid code such as u.Cli.u.fetch_logger(...).
Use an AST-aware match or exclude qualified calls. Add coverage for both bare print() and qualified calls.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@src/flext_core/_constants/_enforcement_parts/flextconstantsenforcement_part_08.py`
at line 50, Update the print-call transformation logic near the regex and
replacement associated with "change_message" to match only bare print() calls,
excluding qualified calls such as u.Cli.print(...), so replacements cannot
create invalid chained expressions. Prefer AST-aware detection or an equivalent
qualification check, and add coverage verifying both bare and qualified print
calls.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
7 issues found across 29 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="ci/docker/debian.Dockerfile">
<violation number="1" location="ci/docker/debian.Dockerfile:19">
P3: `COPY . .` copies the entire build context into the image because there is no .dockerignore at the repo root. This pulls in .git, the large history/history.json artifacts, and any developer-local .venv, inflating the build context and risking stale host artifacts being baked into the clean-machine image. Recommend adding a repo-root .dockerignore (exclude .git, .venv, history*, docs, .beads, etc.) so the proof image only carries sources.</violation>
</file>
<file name="ci/docker/arch.Dockerfile">
<violation number="1" location="ci/docker/arch.Dockerfile:13">
P2: The uv install step pipes a network-fetched script straight into `sh` with no pinned version or SHA-256 verification, which is a supply-chain risk (a compromised/updated install.sh executes with root in the build). Pin the installer to a fixed version and verify the script's checksum before execution, or fetch the prebuilt uv binary at a pinned release tag instead of piping the live install script.</violation>
<violation number="2" location="ci/docker/arch.Dockerfile:18">
P2: `COPY . .` without a .dockerignore bakes the whole build context into the image: this repo's root includes .git/ with full history, and tooling/state dirs (.agents/, .beads/, .ropeproject/, .serena/, .sisyphus/, .qlty/, .scope/, development/) that aren't needed for, and shouldn't be embedded in, a clean-machine proof image. This inflates layers, slows every build, makes the image non-reproducible, and can leak local state or secrets. Since Docker ignores .gitignore, add a .dockerignore that excludes .git, the dot-tooling dirs, .venv, development, and other non-runtime content before the COPY.</violation>
</file>
<file name="Makefile">
<violation number="1" location="Makefile:140">
P1: `make setup` fails in checkouts without a colocated `flext-infra`, because bootstrap selects a nonexistent editable path. Select the editable route only when that source path exists, otherwise use the declared package fallback.</violation>
</file>
<file name="ci/docker/ubuntu.Dockerfile">
<violation number="1" location="ci/docker/ubuntu.Dockerfile:3">
P2: This clean-machine proof image uses a floating base tag (`ubuntu:24.04`) and an unpinned `astral.sh/uv/install.sh` piped into `sh`. Both resolve to different toolchain versions between builds, so the 'clean-machine proof' isn't reproducible and the piped remote script carries supply-chain risk. Consider pinning the base image to a digest and verifying/pinning the uv installer version so the proof reflects a fixed toolchain.</violation>
</file>
<file name=".gitignore">
<violation number="1" location=".gitignore:256">
P2: This block's `!` negations (`!ci/`, `!.github/workflows/`, `!.vscode/settings.json`, `!LICENSE`, `!config/`, `!custom.mk`) are dead configuration: after deleting the "BLOCK EVERYTHING BY DEFAULT" header, no `!`/`*` rule elsewhere ignores these paths, so every negation here silently does nothing. More importantly, removing that header flips the repo from a default-deny whitelist to a default-track blacklist — any new file not covered by an ignore pattern is now auto-stageable. Please confirm the blacklist switch is intentional and audit `git status --ignored`; otherwise restore the default-deny policy (which also makes this block meaningful).</violation>
</file>
<file name="ci/docker/alpine.Dockerfile">
<violation number="1" location="ci/docker/alpine.Dockerfile:11">
P2: Alpine Dockerfile is missing the `SHELL` directive that every other distro Dockerfile sets. Without `SHELL ["/bin/bash", "-o", "pipefail", "-c"]`, the `RUN curl ... | env ... sh` pipeline uses Alpine's default `/bin/sh` (busybox ash) which does not support `pipefail`. If `curl` fails (e.g. network issue, unreachable URL), the pipeline may silently succeed because only the exit code of the final `sh` process is checked — a curl failure would be swallowed instead of failing the build.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| override PATH := $(RUNTIME_BIN):$(SANITIZED_CALLER_PATH) | ||
| export FLEXT_INFRA_PYTHON UV UV_PROJECT UV_PROJECT_ENVIRONMENT VIRTUAL_ENV PATH | ||
|
|
||
| ifneq ($(strip $(FLEXT_INFRA_SOURCE_ROOT_REL)),) |
There was a problem hiding this comment.
P1: make setup fails in checkouts without a colocated flext-infra, because bootstrap selects a nonexistent editable path. Select the editable route only when that source path exists, otherwise use the declared package fallback.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At Makefile, line 140:
<comment>`make setup` fails in checkouts without a colocated `flext-infra`, because bootstrap selects a nonexistent editable path. Select the editable route only when that source path exists, otherwise use the declared package fallback.</comment>
<file context>
@@ -72,10 +101,49 @@ RUNTIME_ROOT := $(PROJECT_ROOT)
+override PATH := $(RUNTIME_BIN):$(SANITIZED_CALLER_PATH)
+export FLEXT_INFRA_PYTHON UV UV_PROJECT UV_PROJECT_ENVIRONMENT VIRTUAL_ENV PATH
+
+ifneq ($(strip $(FLEXT_INFRA_SOURCE_ROOT_REL)),)
+FLEXT_INFRA_SOURCE_ROOT := $(abspath $(PROJECT_ROOT)/$(FLEXT_INFRA_SOURCE_ROOT_REL))
+FLEXT_INFRA_BOOTSTRAP := env -u PYTHONPATH -u MYPYPATH -u VIRTUAL_ENV -u UV_PROJECT -u UV_PROJECT_ENVIRONMENT PATH="$(SANITIZED_CALLER_PATH)" $(UV) run --no-project --with-editable "$(FLEXT_INFRA_SOURCE_ROOT)" python -m flext_infra
</file context>
| ifneq ($(strip $(FLEXT_INFRA_SOURCE_ROOT_REL)),) | |
| ifneq ($(wildcard $(PROJECT_ROOT)/$(FLEXT_INFRA_SOURCE_ROOT_REL)),) |
|
|
||
| # uv is an environment-provided executable, intentionally without a project | ||
| # patch pin. It installs the declared Python family before canonical bootstrap. | ||
| RUN curl -LsSf https://astral.sh/uv/install.sh \ |
There was a problem hiding this comment.
P2: The uv install step pipes a network-fetched script straight into sh with no pinned version or SHA-256 verification, which is a supply-chain risk (a compromised/updated install.sh executes with root in the build). Pin the installer to a fixed version and verify the script's checksum before execution, or fetch the prebuilt uv binary at a pinned release tag instead of piping the live install script.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At ci/docker/arch.Dockerfile, line 13:
<comment>The uv install step pipes a network-fetched script straight into `sh` with no pinned version or SHA-256 verification, which is a supply-chain risk (a compromised/updated install.sh executes with root in the build). Pin the installer to a fixed version and verify the script's checksum before execution, or fetch the prebuilt uv binary at a pinned release tag instead of piping the live install script.</comment>
<file context>
@@ -0,0 +1,23 @@
+
+# uv is an environment-provided executable, intentionally without a project
+# patch pin. It installs the declared Python family before canonical bootstrap.
+RUN curl -LsSf https://astral.sh/uv/install.sh \
+ | env UV_UNMANAGED_INSTALL=/usr/local/bin sh
+RUN uv python install 3.13
</file context>
| RUN uv python install 3.13 | ||
|
|
||
| WORKDIR /workspace | ||
| COPY . . |
There was a problem hiding this comment.
P2: COPY . . without a .dockerignore bakes the whole build context into the image: this repo's root includes .git/ with full history, and tooling/state dirs (.agents/, .beads/, .ropeproject/, .serena/, .sisyphus/, .qlty/, .scope/, development/) that aren't needed for, and shouldn't be embedded in, a clean-machine proof image. This inflates layers, slows every build, makes the image non-reproducible, and can leak local state or secrets. Since Docker ignores .gitignore, add a .dockerignore that excludes .git, the dot-tooling dirs, .venv, development, and other non-runtime content before the COPY.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At ci/docker/arch.Dockerfile, line 18:
<comment>`COPY . .` without a .dockerignore bakes the whole build context into the image: this repo's root includes .git/ with full history, and tooling/state dirs (.agents/, .beads/, .ropeproject/, .serena/, .sisyphus/, .qlty/, .scope/, development/) that aren't needed for, and shouldn't be embedded in, a clean-machine proof image. This inflates layers, slows every build, makes the image non-reproducible, and can leak local state or secrets. Since Docker ignores .gitignore, add a .dockerignore that excludes .git, the dot-tooling dirs, .venv, development, and other non-runtime content before the COPY.</comment>
<file context>
@@ -0,0 +1,23 @@
+RUN uv python install 3.13
+
+WORKDIR /workspace
+COPY . .
+
+RUN make setup
</file context>
| @@ -0,0 +1,24 @@ | |||
| # Generated by `flext-infra codegen conform` for flext_core. | |||
| # Clean-machine proof: project bootstrap + canonical make verbs on Ubuntu. | |||
| FROM ubuntu:24.04 | |||
There was a problem hiding this comment.
P2: This clean-machine proof image uses a floating base tag (ubuntu:24.04) and an unpinned astral.sh/uv/install.sh piped into sh. Both resolve to different toolchain versions between builds, so the 'clean-machine proof' isn't reproducible and the piped remote script carries supply-chain risk. Consider pinning the base image to a digest and verifying/pinning the uv installer version so the proof reflects a fixed toolchain.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At ci/docker/ubuntu.Dockerfile, line 3:
<comment>This clean-machine proof image uses a floating base tag (`ubuntu:24.04`) and an unpinned `astral.sh/uv/install.sh` piped into `sh`. Both resolve to different toolchain versions between builds, so the 'clean-machine proof' isn't reproducible and the piped remote script carries supply-chain risk. Consider pinning the base image to a digest and verifying/pinning the uv installer version so the proof reflects a fixed toolchain.</comment>
<file context>
@@ -0,0 +1,24 @@
+# Generated by `flext-infra codegen conform` for flext_core.
+# Clean-machine proof: project bootstrap + canonical make verbs on Ubuntu.
+FROM ubuntu:24.04
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
</file context>
| .mcp.json | ||
| CLAUDE.local.md | ||
|
|
||
| # Tracked managed artifacts |
There was a problem hiding this comment.
P2: This block's ! negations (!ci/, !.github/workflows/, !.vscode/settings.json, !LICENSE, !config/, !custom.mk) are dead configuration: after deleting the "BLOCK EVERYTHING BY DEFAULT" header, no !/* rule elsewhere ignores these paths, so every negation here silently does nothing. More importantly, removing that header flips the repo from a default-deny whitelist to a default-track blacklist — any new file not covered by an ignore pattern is now auto-stageable. Please confirm the blacklist switch is intentional and audit git status --ignored; otherwise restore the default-deny policy (which also makes this block meaningful).
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .gitignore, line 256:
<comment>This block's `!` negations (`!ci/`, `!.github/workflows/`, `!.vscode/settings.json`, `!LICENSE`, `!config/`, `!custom.mk`) are dead configuration: after deleting the "BLOCK EVERYTHING BY DEFAULT" header, no `!`/`*` rule elsewhere ignores these paths, so every negation here silently does nothing. More importantly, removing that header flips the repo from a default-deny whitelist to a default-track blacklist — any new file not covered by an ignore pattern is now auto-stageable. Please confirm the blacklist switch is intentional and audit `git status --ignored`; otherwise restore the default-deny policy (which also makes this block meaningful).</comment>
<file context>
@@ -337,3 +252,20 @@ skill-create-output/
.mcp.json
CLAUDE.local.md
+
+# Tracked managed artifacts
+!ci/
+!ci/docker/
</file context>
|
|
||
| # uv is an environment-provided executable, intentionally without a project | ||
| # patch pin. It installs the declared Python family before canonical bootstrap. | ||
| RUN curl -LsSf https://astral.sh/uv/install.sh \ |
There was a problem hiding this comment.
P2: Alpine Dockerfile is missing the SHELL directive that every other distro Dockerfile sets. Without SHELL ["/bin/bash", "-o", "pipefail", "-c"], the RUN curl ... | env ... sh pipeline uses Alpine's default /bin/sh (busybox ash) which does not support pipefail. If curl fails (e.g. network issue, unreachable URL), the pipeline may silently succeed because only the exit code of the final sh process is checked — a curl failure would be swallowed instead of failing the build.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At ci/docker/alpine.Dockerfile, line 11:
<comment>Alpine Dockerfile is missing the `SHELL` directive that every other distro Dockerfile sets. Without `SHELL ["/bin/bash", "-o", "pipefail", "-c"]`, the `RUN curl ... | env ... sh` pipeline uses Alpine's default `/bin/sh` (busybox ash) which does not support `pipefail`. If `curl` fails (e.g. network issue, unreachable URL), the pipeline may silently succeed because only the exit code of the final `sh` process is checked — a curl failure would be swallowed instead of failing the build.</comment>
<file context>
@@ -0,0 +1,21 @@
+
+# uv is an environment-provided executable, intentionally without a project
+# patch pin. It installs the declared Python family before canonical bootstrap.
+RUN curl -LsSf https://astral.sh/uv/install.sh \
+ | env UV_UNMANAGED_INSTALL=/usr/local/bin sh
+RUN uv python install 3.13
</file context>
| RUN uv python install 3.13 | ||
|
|
||
| WORKDIR /workspace | ||
| COPY . . |
There was a problem hiding this comment.
P3: COPY . . copies the entire build context into the image because there is no .dockerignore at the repo root. This pulls in .git, the large history/history.json artifacts, and any developer-local .venv, inflating the build context and risking stale host artifacts being baked into the clean-machine image. Recommend adding a repo-root .dockerignore (exclude .git, .venv, history*, docs, .beads, etc.) so the proof image only carries sources.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At ci/docker/debian.Dockerfile, line 19:
<comment>`COPY . .` copies the entire build context into the image because there is no .dockerignore at the repo root. This pulls in .git, the large history/history.json artifacts, and any developer-local .venv, inflating the build context and risking stale host artifacts being baked into the clean-machine image. Recommend adding a repo-root .dockerignore (exclude .git, .venv, history*, docs, .beads, etc.) so the proof image only carries sources.</comment>
<file context>
@@ -0,0 +1,24 @@
+RUN uv python install 3.13
+
+WORKDIR /workspace
+COPY . .
+
+RUN make setup
</file context>
|
Closing stale conflicting PR: mixes CI/mise noise with old cutover; reopen scoped if unique delta remains (mro-81ci.1). |
Outcome
u.Cli.printreferencesprint()make status.envrcto the flext-infra template ownerEvidence
git pull --ff-only origin 0.12.0-dev— up to date before mutationdevelopmentandsrc— zerou.Cli.printmatchesgit diff --checkand staged diff check — exit 013d9a49f9dc6280c929fb641e6c79583f1f3c339Pending canonical gate
The current root Make surface cannot target an external worktree through
WORKSPACEorPROJECT; it diagnoses the root itself. No override or gitlink mutation was used. Root Make Ruff/Pyrefly validation remains pending the.43/topology owner or PR integration lane, so this PR is intentionally draft and is not a Done claim.Bead:
mro-e9j0.6.1Summary by cubic
Removed all invalid
u.Cli.printreferences and examples across core and docs. Enforcement now targets rawprint()and fix messages match; setup verification usesmake status.print(), notu.Cli.print.print()tou.fetch_logger(__name__).info()”.make statusinstead of apython -cprint.Written for commit 13d9a49. Summary will update on new commits.
Summary by CodeRabbit
New Features
Documentation
print()usage.Chores