mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
Alberto Schiabel
15a03c10fb
## What Adds a **report-only** `Dead Code` CI workflow that surfaces likely-orphaned code on every PR, across all three surfaces — TypeScript, Python, and GitHub Actions. Follow-up to the root `Dockerfile` cleanup (#3783) and the dead-code sweep in #3786: instead of finding this stuff by hand, catch it automatically. | Surface | Tool | Wiring | |---|---|---| | TypeScript | [**knip**](https://knip.dev) | `knip.json`; runs via `pnpm dlx knip@5`. Finds unused files, exports, types, and dependencies. | | Python | [**vulture**](https://github.com/jendrikseipp/vulture) | `dead_code` nox session + `make dead-code`; allowlist at `python/config/vulture_allowlist.py`. Finds unused functions/classes/variables (complements Ruff's F401/F841). | | GitHub Actions | small bash script | `.github/scripts/check-orphan-ci.sh` — flags reusable workflows and composite actions with no callers. | ## Why report-only (not blocking) Every job writes findings to the run's **Step Summary** and **never fails the build**. These tools carry unavoidable false positives on a library monorepo — public API surface, dynamic imports, import-map targets (e.g. core's `#platform`), framework entry points. A red ❌ on false positives would just train everyone to ignore the check. Once a job's config is refined enough that a clean run is the steady state, it can be flipped to blocking. ## Validation (ran each locally) - **knip**: 0 unused *files* after scoping out the e2e-test workspaces (knip crashes traversing `ts/e2e-tests/**` — pre-existing knip bug, filed via `ignoreWorkspaces`) and build/docs artifacts. Export/dep categories surface advisory items. - **vulture**: clean run (report-only); allowlist suppresses the 3 `TYPE_CHECKING` re-exports in `custom_tool.py`; `build/`/`dist/` excluded. Surfaces 4 genuine minor items (`bases`, `desc`×3). - **orphan-CI script**: finds none — the repo has no orphaned CI plumbing today. - **Pinning**: `jk actions check` clean for this workflow; `actions/checkout` is SHA-pinned, the two local composite actions need no pin. Local usage is documented under **Dead code detection** in `CONTRIBUTING.md`. ## Note on scope These cover TS/Python/GHA — they would *not* have caught the root `Dockerfile` itself (an arbitrary root file no tool tracks). That class stays a manual-review concern; the orphan-CI script is the closest analogue for the CI surface.
18 lines
944 B
Python
18 lines
944 B
Python
# Vulture allowlist — confirmed false positives.
|
|
#
|
|
# Vulture (see the `dead_code` nox session) cannot see some usages: symbols
|
|
# referenced only through `__all__`, dynamic attribute access, framework entry
|
|
# points, or `TYPE_CHECKING`-only re-exports look "unused" to it. List such
|
|
# confirmed-intentional names here so they stop showing up in the report.
|
|
#
|
|
# The idiom is a *bare reference* to the name (a load), one per line — that is
|
|
# what marks it "used". Keep a comment explaining why each entry is a false
|
|
# positive, and prune entries when the underlying symbol is deleted.
|
|
|
|
# Re-exported for downstream typing via `__all__` in
|
|
# composio/core/models/custom_tool.py (TYPE_CHECKING-only imports, so vulture
|
|
# does not connect the __all__ string to the import binding).
|
|
SessionAttachResponseExperimental # noqa: B018, F821
|
|
SessionCreateResponseExperimental # noqa: B018, F821
|
|
SessionRetrieveResponseExperimental # noqa: B018, F821
|