* Commit plugin lockfiles so Dependabot can do something useful
The uv ecosystem config added in #206 pointed at four directories that declare
PEP 621 ranges and carry no lockfile. With nothing to pin, Dependabot's only
available action is raising the lower bound of an already-open range — which
changes nothing about what installs and only drops support for older versions.
It opened five such PRs within a minute of #206 merging (#208-#212), all no-ops:
the existing ranges already resolved to exactly the versions being proposed as
new floors. The one directory that did have a lockfile, constant-time-analysis,
produced no PR at all, because there was genuinely nothing to update. That is
the whole diagnosis.
Lockfiles committed for the other four. .gitignore ignored uv.lock globally,
which is why they were missing; constant-time-analysis's was tracked only
because it predates the rule. Now scoped to the root file (ephemeral — there is
no root pyproject.toml) with plugin lockfiles explicitly allowed, matching the
pattern already used for .mcp.json.
Also fixes two bugs #206 introduced:
- The version-increment check failed all five Dependabot PRs, and Dependabot can
neither bump a plugin version nor label its own PR, so every future dependency
PR would have been permanently red. Exempted by actor.
- The 'no-version-bump' label was documented in AGENTS.md and wired into
validate.yml but never created, so the escape hatch did not exist. Created.
* Re-run CI with the no-version-bump label applied
The version-increment check fired on this PR: adding uv.lock under plugins/<name>/
counts as touching those plugins. Correct behaviour — the lockfiles pin exactly
what the existing ranges already resolve to, so nothing changes for anyone
installing these plugins, which is what the label is for. First real use of the
escape hatch created in this same PR.
* Fix the three findings from this PR's review
A local uv setting leaked into all four new lockfiles. /etc/uv/uv.toml on ToB
machine images sets exclude-newer = "1 week", so every lock carried an
[options] block with exclude-newer-span = "P1W" and pinned versions resolved a
week stale — diverging from constant-time-analysis/uv.lock, which predates this
PR and has no such block. Regenerated with UV_NO_CONFIG=1. That cooldown is the
org's supply-chain posture and it belongs in dependabot.yml's
'cooldown: default-days: 7', where it already is; baking it into committed
lockfiles was my environment leaking, not a decision.
"EVERY directory here must carry a committed uv.lock" was enforced by a comment,
which is precisely the anti-pattern AGENTS.md tells people to avoid. Now a
validator check: it parses the uv ecosystem block out of dependabot.yml and
asserts a uv.lock beside each listed directory. Scoped to that block rather than
grepping for '- /plugins/...' so a future ecosystem's paths are not swept in,
and it errors if the block exists but no directories parse out — otherwise the
checker could inspect zero items and report clean, which is the exact failure it
exists to prevent. Three self-test fixtures, and verified by deleting a real
lockfile and confirming CI would go red.
The Dependabot exemption keyed on github.actor, which on a synchronize event is
whoever pushed. A human adding one commit to a Dependabot branch would re-arm
the version check and turn the PR red — making the follow-up bump mandatory
exactly where the comment says it is discretionary. Keyed on PR authorship now.
* ci: add lint enforcement with ruff, shellcheck, and shfmt
Add pre-commit hooks (prek) and GitHub Actions CI to enforce Python and
shell linting across the repository.
- Add root pyproject.toml with ruff configuration (line-length=100, py311)
- Add .pre-commit-config.yaml with ruff, shellcheck, shfmt, and standard hooks
- Add .github/workflows/lint.yml with SHA-pinned actions
- Update .github/dependabot.yml with root pip ecosystem entry
- Fix existing lint violations:
- Auto-fix imports and formatting with ruff
- Fix duplicate dict key in ct_analyzer (contentequals -> arrays.contentequals)
- Add noqa comment for required sys.path manipulation in extract_pdf.py
- Format shell scripts with shfmt (case statement indentation)
- Add per-file-ignores for ct_analyzer's long opcode tables and style patterns
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use 2-space indentation for shell scripts
Change shfmt configuration from 4-space to 2-space indentation
to match CLAUDE.md standards.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Dan Guido