Repository navigation
Session Handoff [auto-3616]: #3616 Dependabot-Managed ruff Pin in the Lint-Only Validator #3639
Description
Next steps, in priority order
Re-read #3616 and its maintainer comment rather than trusting this summary.
- Implement ruff@latest in the Lint-Only Validator Turns Carriers Red on a Ruff Release With No Change of Their Own #3616 as the maintainer decided on it, a Dependabot-managed ruff pin with no fleet canary.
validate-task.yml's lint-only Python branch runsuvx ruff@latestfor bothruff checkandruff format --check. Declare ruff in a manifest Dependabot watches, through a newpiporuvecosystem entry in the hub's.github/dependabot.yml. Then have the validator read the version from that manifest rather than from a literal in arun:line. Done looks like this: both lint-onlyuvxinvocations run the declared version, a carrier calling the reusable workflow resolves that version from the hub rather than from its own tree, and Dependabot would open a hub pull request on the next ruff release. The pull request intodevelopcarriesCloses on promotion: #3616.
External blockers
- None known at creation. The decision ruff@latest in the Lint-Only Validator Turns Carriers Red on a Ruff Release With No Change of Their Own #3616 needed is recorded on the issue by the maintainer, and its
decisionlabel is off.
Internal dependencies
- The manifest comes before the workflow change, since the validator reads its version from that file.
- A reusable workflow runs in the caller's checkout, so how the validator reaches the hub's manifest at the pinned workflow revision has to be settled before the
run:lines change.
State
Re-derive with git worktree list, git log origin/main..origin/develop, and gh pr list.
- Develop and main were level at creation, with no open pull request in this repository.
- No branch or worktree exists for this lane yet.
- Other repositories touched: none.
The parked decision queue
Zero open decision issues in this repository at creation, read live.
What the last round did
- Nothing yet. An unattended picker created this lane from the open backlog.
What not to repeat
- A version literal in the workflow was declined by the maintainer on ruff@latest in the Lint-Only Validator Turns Carriers Red on a Ruff Release With No Change of Their Own #3616, because Dependabot does not update it.
- A canary linting every lint-only carrier on the bump pull request was weighed and declined on ruff@latest in the Lint-Only Validator Turns Carriers Red on a Ruff Release With No Change of Their Own #3616.
New learnings
- None yet.
Activity
ptr727 commentedon Oct 30, 2026
Outcome
#3616 is implemented and merged to
developin #3640 (squash c653b2f). #3616 stays open until the develop -> main promotion carriesCloses on promotion: #3616. This run's scope wasdevelop, so no promotion was opened or merged.python-tool-pinscomposite action whoserequirements.txtpinsruff==0.17.3.validate-task.ymlreaches it through$/and runs both lint-onlyuvxruff calls at that version, so a carrier gets the version its hub pin carries. CI on Pin the Validator's uvx ruff to a Dependabot-Managed Manifest #3640 resolvedRUFF_VERSION: 0.17.3..github/dependabot.ymlgains apippair on/.github/actions/python-tool-pinsfor main and develop.OPERATIONS.mdblock, and.vscode/tasks.jsonruff tasks runuvx --with-requirements .github/actions/python-tool-pins/requirements.txt ruff ....python.scripts.uvx, the python-codestyle skill, anddocs/reusable-workflows.mdnow describe the pin. Carried local snippets incatalog/still run ruff@latest, which is out of ruff@latest in the Lint-Only Validator Turns Carriers Red on a Ruff Release With No Change of Their Own #3616's scope. The skill names that skew.pr_review.py cleanup 3640exited 0. The remote and local branch are deleted, the worktree is removed, and develop is current.