Introduce CI with Forgejo Actions #7

New issue

Closed

opened 2026-09-10 03:37:43 +00:00 by agent-pi · 2 comments

agent-pi commented 2026-09-10 03:37:43 +00:00

Collaborator

Copy link

Problem

Validation on this repo is local-only: nothing runs ruff, ty, or pytest on pushes or pull requests, so regressions and lint/type drift can reach main unnoticed. The agent workflow also relies on CI (ci-watch) after opening PRs, which currently has nothing to poll.

Goal

A Forgejo Actions workflow that runs the project's validation suite on pull requests and pushes.

## Problem Validation on this repo is local-only: nothing runs `ruff`, `ty`, or `pytest` on pushes or pull requests, so regressions and lint/type drift can reach `main` unnoticed. The agent workflow also relies on CI (ci-watch) after opening PRs, which currently has nothing to poll. ## Goal A Forgejo Actions workflow that runs the project's validation suite on pull requests and pushes.

agent-pi commented 2026-09-10 03:38:45 +00:00

Author

Collaborator

Copy link

Findings

• Forgejo Actions works on this instance: marvin8/kokopelli (same forge) executes workflows on push/PR/release — observed run history with a realistic mix of success/failure — using the runner label zhuiri.
• In-house template exists: kokopelli's .forgejo/workflows/ci.yml uses actions/checkout@v4, astral-sh/setup-uv@v5, and uv sync --all-groups (with UV_LINK_MODE=copy) before running checks — the same pattern applies here unchanged.
• kokopelli's workflow also includes optional extras available to copy later: a WuMing AI PR-review job (marvin8/wuming@main, DeepSeek-backed) and a gitleaks job (checksum-verified curl | tar install — the sanctioned zhuiri pattern).
• yunjin has no noxfile.py (despite the nox dependency group) and no .gitleaks.toml — so v1 CI should invoke the tools directly rather than via nox.

Plan of attack

1. Add .forgejo/workflows/ci.yml: triggers pull_request, push, workflow_dispatch; single checks job on zhuiri.
2. Steps: checkout → setup-uv@v5 → uv sync --all-groups → uv run ruff check → uv run ruff format --check → uv run ty check → uv run pytest.
3. When it lands: update the "No CI is configured" note in AGENTS.md — ci-watch then becomes meaningful for this repo's PRs.
4. Deliberately out of scope for v1 (separate issues if wanted): WuMing AI review job, gitleaks job, a noxfile.py to unify local/CI entry points.

## Findings - **Forgejo Actions works on this instance**: `marvin8/kokopelli` (same forge) executes workflows on push/PR/release — observed run history with a realistic mix of success/failure — using the runner label `zhuiri`. - In-house template exists: kokopelli's `.forgejo/workflows/ci.yml` uses `actions/checkout@v4`, `astral-sh/setup-uv@v5`, and `uv sync --all-groups` (with `UV_LINK_MODE=copy`) before running checks — the same pattern applies here unchanged. - kokopelli's workflow also includes optional extras available to copy later: a WuMing AI PR-review job (`marvin8/wuming@main`, DeepSeek-backed) and a gitleaks job (checksum-verified `curl | tar` install — the sanctioned zhuiri pattern). - **yunjin has no `noxfile.py`** (despite the `nox` dependency group) and no `.gitleaks.toml` — so v1 CI should invoke the tools directly rather than via nox. ## Plan of attack 1. Add `.forgejo/workflows/ci.yml`: triggers `pull_request`, `push`, `workflow_dispatch`; single `checks` job on `zhuiri`. 2. Steps: checkout → setup-uv@v5 → `uv sync --all-groups` → `uv run ruff check` → `uv run ruff format --check` → `uv run ty check` → `uv run pytest`. 3. When it lands: update the "No CI is configured" note in `AGENTS.md` — ci-watch then becomes meaningful for this repo's PRs. 4. Deliberately out of scope for v1 (separate issues if wanted): WuMing AI review job, gitleaks job, a noxfile.py to unify local/CI entry points.

agent-pi commented 2026-09-10 06:15:30 +00:00

Author

Collaborator

Copy link

Scope settled with Marvin8

Confirmed decisions:

1. WuMing pr-review job in v1 (needs wuming_deepseek_key repo secret — Marvin8 to set).
2. Checks job runs via nox, following the cang template: a new noxfile.py (nox-uv sessions; default session list ty, ruff, complexipy, pytest), with pytest parameterised over Python 3.12 + 3.13 (yunjin's requires-python is >=3.12,<3.14), plus uv build to validate packaging.
3. No separate Python matrix in the workflow — nox owns multi-version testing.
4. Gitleaks job follows cang's pattern, which pins the version by grepping .pre-commit-config.yaml — so this PR also adds a gitleaks entry to .pre-commit-config.yaml as the single version source (local scanning benefit too).
5. Triggers: pull_request, push (main only), workflow_dispatch; concurrency cancel-in-progress; timeout-minutes; runner zhuiri; UV_LINK_MODE=copy.

Out of scope (unchanged): release/publish jobs, docs deploy, no Release-Notes.md validation (no taibai thread yet in this repo).

Observation worth noting: nox test sessions install into ephemeral venvs, so first CI run downloads the full dependency tree (sentence-transformers → torch). uv's wheel cache on zhuiri should make subsequent runs cheap.

Implementation: branch feat/issue-7-forgejo-actions-ci.

Plan of attack (supersedes the original plan above)

1. noxfile.py — sessions ty, ruff (format --check + check, src/), complexipy (repo root), pytest (PYTHONS ["3.12", "3.13"], installing pytest, pytest-asyncio, pytest-cov, freezegun + -e .).
2. .forgejo/workflows/ci.yml — jobs pr-review (wuming, max_diff_lines 2000), gitleaks (cang pattern), checks (checkout → setup-uv@v5 → uv sync --all-groups → uv run nox → uv build).
3. gitleaks entry in .pre-commit-config.yaml (version pinned, same as job greps).
4. Update AGENTS.md: drop the "No CI" note; tooling table gains the nox line (CI + local parity), prek stays human-only.

## Scope settled with Marvin8 Confirmed decisions: 1. **WuMing `pr-review` job in v1** (needs `wuming_deepseek_key` repo secret — Marvin8 to set). 2. **Checks job runs via `nox`**, following the `cang` template: a new `noxfile.py` (nox-uv sessions; default session list `ty`, `ruff`, `complexipy`, `pytest`), with `pytest` parameterised over Python 3.12 + 3.13 (yunjin's `requires-python` is `>=3.12,<3.14`), plus `uv build` to validate packaging. 3. No separate Python matrix in the workflow — nox owns multi-version testing. 4. Gitleaks job follows `cang`'s pattern, which pins the version by grepping `.pre-commit-config.yaml` — so this PR also adds a gitleaks entry to `.pre-commit-config.yaml` as the single version source (local scanning benefit too). 5. Triggers: `pull_request`, `push` (main only), `workflow_dispatch`; `concurrency` cancel-in-progress; `timeout-minutes`; runner `zhuiri`; `UV_LINK_MODE=copy`. Out of scope (unchanged): release/publish jobs, docs deploy, no `Release-Notes.md` validation (no taibai thread yet in this repo). Observation worth noting: `nox` test sessions install into ephemeral venvs, so first CI run downloads the full dependency tree (sentence-transformers → torch). uv's wheel cache on zhuiri should make subsequent runs cheap. Implementation: branch `feat/issue-7-forgejo-actions-ci`. ## Plan of attack (supersedes the original plan above) 1. `noxfile.py` — sessions `ty`, `ruff` (format --check + check, `src/`), `complexipy` (repo root), `pytest` (PYTHONS `["3.12", "3.13"]`, installing `pytest`, `pytest-asyncio`, `pytest-cov`, `freezegun` + `-e .`). 2. `.forgejo/workflows/ci.yml` — jobs `pr-review` (wuming, max_diff_lines 2000), `gitleaks` (cang pattern), `checks` (checkout → setup-uv@v5 → `uv sync --all-groups` → `uv run nox` → `uv build`). 3. gitleaks entry in `.pre-commit-config.yaml` (version pinned, same as job greps). 4. Update `AGENTS.md`: drop the "No CI" note; tooling table gains the nox line (CI + local parity), prek stays human-only.

agent-pi referenced this issue from a commit 2026-09-10 07:46:14 +00:00

:recycle: Refactor reader index to fix type and complexity errors

agent-pi referenced this issue from a commit 2026-09-10 07:46:14 +00:00

:wrench: Add noxfile.py with ty, ruff, complexipy, and pytest sessions

agent-pi referenced this issue from a commit 2026-09-10 07:46:14 +00:00

:construction_worker: Add Forgejo Actions CI with checks, gitleaks, and WuMing review

agent-pi referenced this issue from a pull request that will close it, 2026-09-10 07:46:21 +00:00

Add Forgejo Actions CI (nox checks, gitleaks, WuMing review) #11

agent-pi referenced this issue from a commit 2026-09-10 08:15:20 +00:00

:memo: Address WuMing review: clarify CI docs, add reader row-builder test

agent-pi referenced this issue from a commit 2026-09-10 08:39:10 +00:00

:bug: Fix gitleaks job scanning /tmp instead of repo, split install step

agent-pi referenced this issue from a commit 2026-09-10 08:40:59 +00:00

:wrench: Allowlist detect-secrets baseline from gitleaks scan

agent-pi referenced this issue from a commit 2026-09-10 09:04:35 +00:00

:memo: Migrate to gitleaks git subcommand, clarify CI docs

agent-pi closed this issue 2026-09-11 01:30:12 +00:00

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

0.4.0

0.3.0

0.2.0

0.1.0

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference

marvin8/yunjin#7

No description provided.