Bring project scaffolding and CI in line with feed2fedi/zaojun/sub2pod standards

coding-agent-marvin8 commented

2026-07-20 00:10:25 +00:00

(Migrated from codeberg.org)

Closes #27

Aligns longwei's project scaffolding, CI workflows, and documentation with the patterns established in feed2fedi, zaojun, and sub2pod.

Changes

AGENTS.md: Created with project instructions for all AI agents; CLAUDE.md is now a symlink. Updated Definition of Done to include ruff format --check ., commit style references gitmoji.dev.
AI-DECLARATION.md: Added v0.1.2 declaration with level: copilot, deployment: none, review: assist. Badge added to README.
Scaffolding: ruff.toml target-version bumped to py311, TID252 (ban-relative-imports) enabled, StrEnum migration applied. .gitleaks.toml simplified to standard form. .editorconfig JSON insert_final_newline removed. pre-commit hooks: ruff → ruff-check, ty bumped to v0.0.61.
CI: All jobs now use uses: astral-sh/setup-uv@v5 instead of curl|sh. Gitleaks now verifies checksums and reads version from .pre-commit-config.yaml.
justfile: fediverse-post no longer commits/pushes the Release-Notes.md reset.
Dependencies: Added [tool.deptry.per_rule_ignores] DEP002 entries for constraint dependencies.

Closes #27 Aligns longwei's project scaffolding, CI workflows, and documentation with the patterns established in feed2fedi, zaojun, and sub2pod. ### Changes - **AGENTS.md**: Created with project instructions for all AI agents; CLAUDE.md is now a symlink. Updated Definition of Done to include `ruff format --check .`, commit style references gitmoji.dev. - **AI-DECLARATION.md**: Added v0.1.2 declaration with level: copilot, deployment: none, review: assist. Badge added to README. - **Scaffolding**: ruff.toml target-version bumped to py311, TID252 (ban-relative-imports) enabled, StrEnum migration applied. .gitleaks.toml simplified to standard form. .editorconfig JSON insert_final_newline removed. pre-commit hooks: ruff → ruff-check, ty bumped to v0.0.61. - **CI**: All jobs now use `uses: astral-sh/setup-uv@v5` instead of curl|sh. Gitleaks now verifies checksums and reads version from .pre-commit-config.yaml. - **justfile**: fediverse-post no longer commits/pushes the Release-Notes.md reset. - **Dependencies**: Added `[tool.deptry.per_rule_ignores]` DEP002 entries for constraint dependencies.

coding-agent-marvin8 commented

2026-07-20 00:21:11 +00:00

(Migrated from codeberg.org)

.forgejo/workflows/ci.yml line 0

security [MEDIUM]

🔴 Declined — @v5 is the standard version tag for astral-sh/setup-uv across all marvin8 projects (feed2fedi, zaojun, sub2pod). It follows astral-sh's official install recommendation and ensures the action stays current with security fixes.

[`.forgejo/workflows/ci.yml` line 0](https://codeberg.org/marvinsmastodontools/longwei/pulls/28#issuecomment-19685842) > **security** [MEDIUM] 🔴 Declined — `@v5` is the standard version tag for `astral-sh/setup-uv` across all marvin8 projects (feed2fedi, zaojun, sub2pod). It follows astral-sh's official install recommendation and ensures the action stays current with security fixes.

coding-agent-marvin8 commented

2026-07-20 00:21:18 +00:00

(Migrated from codeberg.org)

.forgejo/workflows/ci.yml line 0

security [MEDIUM]

🔴 Declined — @v5 is the standard version tag for astral-sh/setup-uv across all marvin8 projects (feed2fedi, zaojun, sub2pod). It follows astral-sh's official install recommendation and ensures the action stays current with security fixes.

[`.forgejo/workflows/ci.yml` line 0](https://codeberg.org/marvinsmastodontools/longwei/pulls/28#issuecomment-19685845) > **security** [MEDIUM] 🔴 Declined — `@v5` is the standard version tag for `astral-sh/setup-uv` across all marvin8 projects (feed2fedi, zaojun, sub2pod). It follows astral-sh's official install recommendation and ensures the action stays current with security fixes.

coding-agent-marvin8 commented

2026-07-20 00:21:24 +00:00

(Migrated from codeberg.org)

.forgejo/workflows/ci.yml line 0

security [MEDIUM]

🔴 Declined — @v5 is the standard version tag for astral-sh/setup-uv across all marvin8 projects (feed2fedi, zaojun, sub2pod). It follows astral-sh's official install recommendation and ensures the action stays current with security fixes.

[`.forgejo/workflows/ci.yml` line 0](https://codeberg.org/marvinsmastodontools/longwei/pulls/28#issuecomment-19685851) > **security** [MEDIUM] 🔴 Declined — `@v5` is the standard version tag for `astral-sh/setup-uv` across all marvin8 projects (feed2fedi, zaojun, sub2pod). It follows astral-sh's official install recommendation and ensures the action stays current with security fixes.

coding-agent-marvin8 commented

2026-07-20 00:21:31 +00:00

(Migrated from codeberg.org)

.forgejo/workflows/weekly-checks.yml line 0

security [MEDIUM]

🔴 Declined — @v5 is the standard version tag for astral-sh/setup-uv across all marvin8 projects (feed2fedi, zaojun, sub2pod). It follows astral-sh's official install recommendation and ensures the action stays current with security fixes.

[`.forgejo/workflows/weekly-checks.yml` line 0](https://codeberg.org/marvinsmastodontools/longwei/pulls/28#issuecomment-19685854) > **security** [MEDIUM] 🔴 Declined — `@v5` is the standard version tag for `astral-sh/setup-uv` across all marvin8 projects (feed2fedi, zaojun, sub2pod). It follows astral-sh's official install recommendation and ensures the action stays current with security fixes.

coding-agent-marvin8 commented

2026-07-20 00:21:38 +00:00

(Migrated from codeberg.org)

src/longwei/enums.py line 0

tests [LOW]

🔴 Declined — StrEnum is a drop-in replacement for (str, Enum) with identical behavior. All existing enum tests pass without changes. No new logic was introduced.

[`src/longwei/enums.py` line 0](https://codeberg.org/marvinsmastodontools/longwei/pulls/28#issuecomment-19685857) > **tests** [LOW] 🔴 Declined — StrEnum is a drop-in replacement for `(str, Enum)` with identical behavior. All existing enum tests pass without changes. No new logic was introduced.

coding-agent-marvin8 commented

2026-07-20 00:38:08 +00:00

(Migrated from codeberg.org)

.forgejo/workflows/ci.yml line 0

config [MEDIUM]

🔴 Declined — downloading checksums alongside the binary from the same source is the accepted pattern for gitleaks on zhuiri across all marvin8 projects. The checksum verification adds defense-in-depth: an attacker would need to compromise both the binary and checksums file on the same HTTPS connection, which is strictly harder than compromising either in isolation. This is the established curl | tar exception documented in the global AGENTS.md.

[`.forgejo/workflows/ci.yml` line 0](https://codeberg.org/marvinsmastodontools/longwei/pulls/28#issuecomment-19686697) > **config** [MEDIUM] 🔴 Declined — downloading checksums alongside the binary from the same source is the accepted pattern for gitleaks on zhuiri across all marvin8 projects. The checksum verification adds defense-in-depth: an attacker would need to compromise both the binary and checksums file on the same HTTPS connection, which is strictly harder than compromising either in isolation. This is the established `curl | tar` exception documented in the global AGENTS.md.

Rows
Columns

Bring project scaffolding and CI in line with feed2fedi/zaojun/sub2pod standards #28

Changes