chore: hygiene + CI gate (PR3 of bug-audit-v2)#110
Merged
Conversation
Per-task TDD steps for UX-4 (dual warn+log), UX-5 (CLAUDE.md from_object doc), TEST-NEW-7 (pytest filterwarnings), and SEC-5 (pip-audit CI workflow). Pure chore PR — no production code paths change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The two BaseConfig constructors behave differently on explicit None: from_dict accepts None as an explicit override of the default, while from_object filters None attributes and lets the default take over. Documented in method docstrings; add a CLAUDE.md note for contributor visibility. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
BaseBootstrapper.__init__ now logs the missing-dependency event via stdlib logging in addition to the existing warnings.warn. Users who suppress one channel (python -W ignore, PYTHONWARNINGS=ignore) still see the other. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add pytest_configure hook in tests/conftest.py (not pyproject.toml filterwarnings) so any unexpected InstrumentSkippedWarning (or subclass) fails the test. The conftest hook approach is required because pyproject.toml filterwarnings causes pytest to resolve the warning class via __import__ inside the _pytest.warnings hook wrapper for pytest_load_initial_conftests — which fires before pytest-cov installs coverage, causing all lite_bootstrap module-level statements to be missed and total coverage to drop from 100% to 79%. Tests that intentionally trigger the warning use pytest.warns(...) and continue to pass; future regressions that emit the warning silently from unrelated code paths now fail. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
New workflow runs pip-audit against the locked dependency set on every PR and weekly via cron. Mirrors the conventions of the existing ci.yml (setup-uv with cache, Python 3.10, concurrency group). --no-deps --disable-pip avoids pip's ensurepip path which has known issues on uv-managed cpython 3.14. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
lesnik512
added a commit
that referenced
this pull request
Jun 5, 2026
Three PRs (#108, #109, #110), 26 findings closed, 153 → 187 tests, 100% coverage throughout. Captures what went well (per-PR sequencing, two-stage review catching three real bugs), what didn't (three implementer-hallucination incidents, cross-task __post_init__ cascade missed in PR2 plan, OTel API misread in audit, SEC-2 host parser untested against canonical localhost:4317 form), and six action items to harden the pipeline for the next audit. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR3 of the 2026-06-05 bug-audit-v2 plan. Closes the four remaining hygiene/CI findings — pure chore PR, no production code paths change. Final PR of the audit; closes the loop on all 26 findings.
Findings closed
BaseBootstrapper.__init__now emits alogger.warning(...)alongside the existingwarnings.warn(InstrumentDependencyMissingWarning, ...)when a configured instrument is missing its optional dependency. Users who suppress one channel (python -W ignore,PYTHONWARNINGS=ignore) still see the other.CLAUDE.mdunder "Conventions" documenting the asymmetry betweenBaseConfig.from_dict(accepts explicitNoneas an override) andBaseConfig.from_object(filtersNoneattributes, default takes over). Both methods already have docstrings; CLAUDE.md surfaces the asymmetry to contributors.InstrumentSkippedWarning(and its subclassInstrumentDependencyMissingWarning) to error during tests. Any unexpected emission outside apytest.warns(...)block now fails the test..github/workflows/security-audit.ymlrunspip-auditagainst the locked dependency set on every PR and weekly via cron. Mirrorsci.ymlconventions (setup-uv@v3with cache, Python 3.10 install, concurrency group).--no-deps --disable-pipavoids pip'sensurepippath which fails on uv-managed cpython 3.14.Implementation notes
filterwarnings = [...]in[tool.pytest.ini_options]ofpyproject.toml. That triggers pytest'spytest_load_initial_conftestshook to resolvelite_bootstrap.exceptions.InstrumentSkippedWarningvia__import__BEFOREpytest-covinstalls coverage tracing, causing lite_bootstrap module-level statements to execute outside coverage measurement (verified: drops total from 100% → 78.78%). Reviewer reproduced the drop locally. Workaround: register the filter via apytest_configure()hook intests/conftest.py, which runs after coverage is active. Functionally equivalent.test_config.py) are intentional — they're emitted by tests that don't wrap inpytest.warns()and represent the SEC-2/SEC-3 warnings being correctly triggered. Distinct from the filter's purpose, which targetsInstrumentSkippedWarningspecifically.Test plan
just test— 187 passed (186 baseline + 1 new from UX-4 test), 100% coverage.just lint-ci— clean (ruff, eof-fixer, ty).pip-audit --no-deps --disable-piplocally —No known vulnerabilities foundacross 133 resolved packages.Audit status
With PR3 merged, all 26 findings from the 2026-06-05 audit are resolved:
🤖 Generated with Claude Code