ci: update ruff requirement from <0.14.0,>=0.13.0 to >=0.13.0,<0.17.0 - #562
Conversation
Updates the requirements on [ruff](https://github.com/astral-sh/ruff) to permit the latest version. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.13.0...0.16.1) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.16.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
@strandly-the-agent review this PR by going through each dependency update and do an analysis if this PR is safe |
strandly-the-agent
left a comment
strandly-the-agent
left a comment
There was a problem hiding this comment.
TL;DR — this won't break the build, but <0.15.0 is the number you want, not <0.17.0. There's exactly one dependency here (ruff, in two places: pyproject.toml:73 and :130). I swept every ruff version the new range allows; the linter is clean on all of them and CI is green. The formatter is the catch — it changes style at 0.15.0, and this repo's pre-commit hook runs the formatter in fix mode.
What I actually verified (branch dependabot/pip/ruff-gte-0.13.0-and-lt-0.17.0 @ a78fa22):
- ✅
ruff checkexits 0 on all 44 versions in>=0.13.0,<0.17.0— a real sweep, not a spot check, and sensitivity-controlled by injectingF401/E711to confirm the sweep would have caught a regression. - ✅ Real CI on this SHA:
call-test-lint / Lint,CI Gateand all 16 unit-test/dependency-check jobs SUCCESS. The rollup reads PENDING only becauseSecure Integration test / check-access-and-checkoutsits on the usual bot-approval gate. - ✅ ruff 0.16.0's headline breaking change ("enables 413 rules by default, up from 59") does not reach this repo —
[tool.ruff.lint] select = ["E","F","I","B"](pyproject.toml:206) is a closed allowlist, and becausehatch-static-analysis.scriptsare overridden with plainruff check, hatch never injects its ownruff_defaults.toml. - ✅ Wheels and provenance: no regression — 17
py3-none-*wheels cover the whole 3.10–3.13 × linux/windows/macOS matrix, and ruff ships 0 PyPI attestations on both the current pin and 0.16.1 (symmetric, so not an argument against this PR). - 🟡
ruff format --checkpasses on 0.13.0–0.14.14 and first fails at exactly 0.15.0 (through 0.16.1), on 2 files. Details below; one inline comment on:73.
Questions
- 🔶 (blocking-ish, the actual decision) Is widening past
<0.15.0deliberate?sdk-pythonandharness-sdkboth pinruff>=0.13.0,<0.15.0today, and this repo's constraint exists because of a deliberate sync tosdk-python(#315: "I also synced ruff version with our sdk-python repository for consistency").<0.15.0restores that parity and stays clear of the formatter change in one move. - 🔷 (non-blocking) This PR and the 13 sibling Dependabot PRs (#552–#565, all opened in the same ~95-second burst) don't reflect the
.github/dependabot.ymlmerged 3 days earlier in #538 — noci(python)prefix, nodevelopment-dependenciesgrouping, floor never raised (pure ceiling widening, i.e. the oldwidenbehavior), and this one opened 4 days after ruff 0.16.1 shipped, inside both the 5-day default and 7-day minor cooldown. Expected transition staleness, or does Dependabot need a nudge to pick the new config up?
🟡 The formatter finding, in full — who hits it and how
Ruff's stable formatter style changed at 0.15.0 (lambda / conditional-expression parenthesization). On this tree that's 2 files:
0.13.0–0.14.14 ruff format --check → 141 files already formatted (rc=0)
0.15.0–0.16.1 ruff format --check → 2 files would be reformatted, 139 ok (rc=1)
--- tests/test_agent_core_memory.py (line 20)
- mock_client.side_effect = (
- lambda service, **kwargs: mock_bedrock_agent_core if service == "bedrock-agentcore" else None
+ mock_client.side_effect = lambda service, **kwargs: (
+ mock_bedrock_agent_core if service == "bedrock-agentcore" else None
)
--- tests/utils/test_generate_schema_util.py (line 210)
- side_effect=lambda obj, name: (False if name in ["invalid_operation", "InvalidOperation"] else True),
+ side_effect=lambda obj, name: False if name in ["invalid_operation", "InvalidOperation"] else True,Nothing in CI goes red, and I checked rather than assumed: the only lint invocation repo-wide is .github/workflows/test-lint.yml:121 → hatch run test-lint → hatch fmt --linter --check → lint-check = ruff check. No workflow runs a format check.
The cost lands on contributors instead. .pre-commit-config.yaml:4-10's hatch-format hook runs hatch fmt --formatter in fix mode with pass_filenames: false, using the env pinned at pyproject.toml:130:
$ printf '\n# unrelated edit\n' >> src/strands_tools/calculator.py && git add $_
$ pre-commit run hatch-format
Format code..............................................................Failed
- files were modified by this hook
3 files reformatted, 138 files left unchanged
$ git status --porcelain
MM src/strands_tools/calculator.py
M tests/test_agent_core_memory.py <-- unrelated
M tests/utils/test_generate_schema_util.py <-- unrelatedThe commit is blocked, and the natural git add -A drags the churn into an unrelated PR. On main the same command is a no-op (141 files left unchanged). One thing bounds the blast radius: hatch does not re-sync an env whose pin is still satisfied — an existing hatch-static-analysis env created at 0.13.3 stays at 0.13.3 after checking out this branch, and only a fresh or pruned env resolves 0.16.1. So it's intermittent: new contributors and pruned envs hit it, long-lived envs don't. That's why this is 🟡 and not 🔴.
Two ways out, either is fine:
- Narrow to
<0.15.0(my suggestion inline) — matches the siblings, stays below the style change, nothing to reformat. - Keep
<0.17.0and land the reformat here —hatch env prune && hatch fmt --formatterproduces exactly the 3-line diff above. If you go this way, also worth addinghatch run test-formatto the lint job, since right now nothing enforces formatting in CI and that's what let the drift stay invisible.
(Editing the diff does mean Dependabot stops managing this branch — fine either way, just don't @dependabot recreate afterwards or the edit is overwritten.)
Appendix — 2 pre-existing items, not this PR's problem
Both are true with this PR closed, so they shouldn't gate it. Happy to file them as issues if useful — say the word.
pyproject.toml:203— 22 files are silently unlinted.includelists"tests-integ/**/*.py"(hyphen) but the directory istests_integ(underscore). Proof: 12 deliberate errors injected intotests_integ/utils/knowledge_base_util.pyandruff checkstill reportedAll checks passed!, whileruff check <that file>reported all 12. One-character fix.pyproject.toml:66—hatch>=1.16.5has no upper bound, andtest-lint.ymlinstalls that then runshatch run test-lint. hatch 1.17.1 already prints "Thehatch fmtcommand is deprecated and will be removed in a future release". When hatch drops it, CI lint breaks with no PR to review — arguably a larger version risk than the bounded ruff range Dependabot keeps widening.
Reviewed by strandly-the-agent — an experimental AI agent built with Strands. Independent passes: dependency-safety sweep (44 versions), CI/workflow trace, repo-convention check. Worth a human eye before you act on it; the <0.15.0 call in particular is a judgment call about how closely tools should track sdk-python.
Co-authored-by: Strandly (The Agent) <strands-agents+strandly@amazon.com>
GitHub Actions
Waiting
|
@strandly-the-agent Apply the fix and push to this branch: |
|
Couldn't push — I only have Two things you need to know before applying: 1. I reverted your web-UI commit 2. I split the change in two, because the CI gate you asked for has a blast radius I don't think you want yet. Patch A is safe and ready. Patch B (the gate) would turn 43 of the 68 measurable open PRs red — 39 of them on files their authors never touched. Not because of anything in this PR: those heads already fail under the ruff their own Patch A — land this now (constraint coherence + the reformat, 3 lines of code)Easiest path, no patch file needed — this reproduces commits 1+2 exactly: git checkout dependabot/pip/ruff-gte-0.13.0-and-lt-0.17.0
git checkout a78fa22 -- pyproject.toml # undo the partial suggestion: <0.17.0 in both places again
hatch env prune && hatch fmt --formatter # the reformat (verified byte-identical to my diff)Or apply directly: diff --git a/pyproject.toml b/pyproject.toml
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -70,7 +70,7 @@ dev = [
"mypy>=0.981,<1.0.0",
"pre-commit>=3.2.0,<4.2.0",
"pytest>=8.0.0,<10.0.0",
- "ruff>=0.13.0,<0.15.0",
+ "ruff>=0.13.0,<0.17.0",
"responses>=0.6.1,<1.0.0",
"mem0ai>=0.1.104,<1.0.0",
"opensearch-py>=2.8.0,<3.0.0",
diff --git a/tests/test_agent_core_memory.py b/tests/test_agent_core_memory.py
--- a/tests/test_agent_core_memory.py
+++ b/tests/test_agent_core_memory.py
@@ -20,8 +20,8 @@ def mock_boto3_client():
mock_bedrock_agent_core = mock.MagicMock()
# Configure boto3.client to return our mock
- mock_client.side_effect = (
- lambda service, **kwargs: mock_bedrock_agent_core if service == "bedrock-agentcore" else None
+ mock_client.side_effect = lambda service, **kwargs: (
+ mock_bedrock_agent_core if service == "bedrock-agentcore" else None
)
yield {
diff --git a/tests/utils/test_generate_schema_util.py b/tests/utils/test_generate_schema_util.py
--- a/tests/utils/test_generate_schema_util.py
+++ b/tests/utils/test_generate_schema_util.py
@@ -207,7 +207,7 @@ class TestCheckBoto3Validity:
# Patch hasattr to return False for the operation
with patch(
"strands_tools.utils.generate_schema_util.hasattr",
- side_effect=lambda obj, name: (False if name in ["invalid_operation", "InvalidOperation"] else True),
+ side_effect=lambda obj, name: False if name in ["invalid_operation", "InvalidOperation"] else True,
):
# Mock the conversion functions
with patch(Verified on the result:
The thing I got wrong in my first review, in your favour: I expected this to trade the skew for its mirror image (old ruff rejecting the new style). It doesn't — the new form is what 0.15+ requires and what every earlier version tolerates, so the tree is a fixed point across the entire allowed range. No floor bump needed. Patch B — the CI gate, and why I'd hold it (43/68 open PRs go red)diff --git a/.github/workflows/test-lint.yml b/.github/workflows/test-lint.yml
--- a/.github/workflows/test-lint.yml
+++ b/.github/workflows/test-lint.yml
@@ -119,4 +119,10 @@ jobs:
- name: Run lint
id: lint
run: hatch run test-lint
+ continue-on-error: false
+
+ - name: Run format check
+ id: format
+ if: ${{ !cancelled() }}
+ run: hatch run test-format
continue-on-error: false( Measured blast radius. For each of the 79 other open PRs I archived its head and ran The collateral files are the same handful over and over: It's the checkout, not the code. These heads fail under ruff 0.13.3 — already allowed today — so this is pre-existing drift, unrelated to the version bump. The composition that bites: for a 5/5 flip. The gate would be measuring branch staleness, not the contributor's work — and then the fix-mode Three ways forward, your call:
Commit messages, if you want themThree commits, Two pre-existing things this does not fix, so nobody over-reads "CI now enforces formatting" — happy to file either as an issue:
Work by |
GitHub Actions
Waiting
GitHub Actions
Waiting
3 participants
Updates the requirements on ruff to permit the latest version.
Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
... (truncated)
Commits
80790b3Bump 0.16.1 (#27330)63830f3[ty] Borrow from constraint set storage less often (#27328)f40dca9[ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)0d80497Lint TOML files in the LSP (#26862)d91586bUpdate prek dependencies (#27293)7da4b8b[ty] Respect bounds and constraints in generic materializations (#27228)b20daf7[ty] refactor: add helper function to send partial results (#27249)4d4c8fa[ty] Emit diagnostic when specializing a non-generic class (#26883)7c3e2db[ty] Fix enum class container assignability (#27318)d5ef97f[flake8-return] Fix false positive when variable is read infinallyclaus...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)