[ptr727]

Summary

Implements #3616 as the maintainer decided on it: a Dependabot-managed ruff pin with no fleet canary.

• The manifest. A new python-tool-pins composite action carries requirements.txt with ruff==0.17.3, the current PyPI release and the version the hub's own code already passes. Its one step reads that pin from $GITHUB_ACTION_PATH and fails, naming the file, unless exactly one ruff==<version> line is there. It does so without mapfile, so the test also runs under macOS's stock bash 3.2.
• The validator. validate-task.yml reaches the action as $/.github/actions/python-tool-pins, so it resolves at the reusable workflow's own commit. A carrier calling the workflow at a hub pin therefore runs that pin's ruff rather than anything in its own tree. Both lint-only uvx calls, ruff check and ruff format --check, now run uvx "ruff@$RUFF_VERSION". A declared pip directory whose venv installs ruff, and a uv directory, keep their own versions as before.
• Dependabot. The hub's .github/dependabot.yml gains a pip pair, main and develop, on /.github/actions/python-tool-pins, so the next ruff release opens a hub pull request. The hub's own CI calls the workflow locally, so that bump is linted against the hub's code before it merges. It then reaches carriers at a named hub release.
• Hub-local runs. The hub's .husky/pre-commit, the OPERATIONS.md local block, and its own .vscode/tasks.json ruff tasks run uvx --with-requirements .github/actions/python-tool-pins/requirements.txt ruff .... That constrains ruff to the pin, so a local run here still matches CI. A probe with a manifest pinning ruff==0.15.22 resolved 0.15.22 that way.
• Docs and spec. spec/project-types.json python.scripts.uvx, the python-codestyle skill (SKILL.md and references/profiles.md), and docs/reusable-workflows.md now say CI's uvx ruff runs the hub's pin. mypy, pyright, and coverage still run @latest. A carrier's local tools (the catalog's VS Code and pre-commit snippets, the skill's local commands) still run ruff @latest, since ruff@latest in the Lint-Only Validator Turns Carriers Red on a Ruff Release With No Change of Their Own #3616 covers the validator only. The skill now names the skew that leaves, and says it ends when the caller's hub pin moves to a release carrying the new version.

The change adds comment lines, so it carries the comments label.

Closes on promotion: #3616

Verification

• tests/test_release_guards.py gains test_tool_pins_read_exactly_one_ruff_pin. It runs the action's step against the hub's own manifest and against constructed manifests: one with a comment, no pin, a range, and two pins. It also gains test_tool_pins_manifest_is_dependabot_tracked_on_both_branches. The existing test_ruff_prefers_a_declared_pip_directory_venv now expects uvx ruff@<pin>.
• The full unittest suite ran 3105 tests, OK (skipped=7).
• uvx ruff@0.17.3 check . and format --check . are clean on the hub. mypy, repo_gate.py (composite-actions included), spec/validate.py, build_dist.py --check, actionlint, and the prose gate with --allow-comments are clean too.
• The full unittest suite ran again on the final head: 3105 tests, OK (skipped=7). The hub's own pre-commit hook ran the pinned ruff on each commit.
• Recorded local-strict-review passes ran before each push.
  • The first raised two introduced findings: docs/reusable-workflows.md and the python-codestyle SKILL.md still described the fallback as ruff@latest. Both are fixed in ee4ed5b.
  • The second raised four, all fixed in 7180e2f. They were the mapfile read under bash 3.2, a hand-rolled step_script, the hub's hook and OPERATIONS.md claiming to match CI while running @latest, and the skill naming the wrong release as the end of the skew.
  • The third raised the redundant skipUnless(shutil.which("bash")) decorator, which Copilot raised too. It is fixed in 853ba38.
  • The passes on the fix push raised two more, both fixed. One was the hub's own VS Code ruff tasks still running @latest, fixed in b248df8. The other was the spec and profile text then misdescribing the hub, plus the hook's and OPERATIONS.md's separate sed readers, fixed in 633642c.
  • The last pass raised one design finding, declined below on evidence.

Declined findings

• .github/actions/python-tool-pins/action.yml read step, introduced, design: the finding says the multi-line half of the one-pin check guards a failure that is already loud, since a second unkeyed line in $GITHUB_OUTPUT fails the step. Declined. It is one more condition in the if the empty-pin check needs anyway, and the finding itself says that check stays. Its error names the manifest and the expected ruff==<version> shape, which a runner refusal of a malformed output line does not. The two pins subtest of test_tool_pins_read_exactly_one_ruff_pin pins that message. The finding's alternative, uvx --with-requirements in the validator, would float silently to latest if the manifest lost its ruff line. So it would need the same presence check.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: ptr727/ProjectTemplate
• Branch: feature/auto-3616
• File: .coderabbit.yaml
• Commit: 633642c
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4b203562-07dc-48a4-bb25-ce1798799dbe

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ptr727]

A recorded local strict-review pass covers head 7180e2ffc6cc8dfe315cd5e24480c1f0e0f7bb58, the content this pull request carries at that commit against develop, and it recorded 1 finding.

[Copilot]

🟡 Changes recommended

An active cross-platform test issue remains because the test uses a redundant bash check that can accept a non-runnable shim instead of the repository’s shared capability probe.

1 open issue

• Use shared bash capability probe instead of redundant decorator · New

What changed in this PR

This pull request makes the validator’s fallback Ruff version reproducible through a Dependabot-managed composite-action manifest, while preserving project-local Ruff versions where applicable.

Changes:

• Adds the python-tool-pins action with ruff==0.17.3.
• Updates validator workflows, local hooks, operations guidance, specifications, and documentation to use the managed pin.
• Adds Dependabot tracking and tests for manifest parsing, workflow behavior, and hook fixtures.
• Regenerates the relevant Python codestyle skill distributions.
• Review note: tests/test_release_guards.py has a [P2] nit for a redundant shutil.which("bash") decorator; the test already uses the shared bash_or_skip() probe.

File	Summary
tests/​test_release_guards.py	Tests Ruff pin resolution, manifest validation, Dependabot coverage, and validator command selection.
tests/​test_pre_commit_hook.py	Includes the Ruff pin manifest in hook test fixtures.
spec/​project-types.json	Updates the Python lint-only profile contract.
OPERATIONS.md	Uses the shared Ruff pin for local validation.
docs/​reusable-workflows.md	Documents the validator’s pinned Ruff behavior.
.husky/​pre-commit	Runs Ruff using the manifest pin.
.github/​workflows/​validate-task.yml	Reads the pin action output and applies it to fallback Ruff calls.
.github/​skills/​python-codestyle/​SKILL.md	Documents CI pinning and local/CI Ruff version skew.
.github/​skills/​python-codestyle/​references/​profiles.md	Updates Python profile toolchain guidance.
.github/​dependabot.yml	Tracks the pin manifest on main and develop.
.github/​actions/​python-tool-pins/​requirements.txt	Defines the Dependabot-managed Ruff version.
.github/​actions/​python-tool-pins/​action.yml	Validates and exports exactly one Ruff pin.
.claude-plugin/​fleet-skills/​skills/​python-codestyle/​SKILL.md	Regenerated Claude skill documentation.
.claude-plugin/​fleet-skills/​skills/​python-codestyle/​references/​profiles.md	Regenerated Claude profile reference.
.claude-plugin/​fleet-skills/​.source-digests/​python-codestyle	Updates the generated skill source digest.
.agents/​skills/​python-codestyle/​SKILL.md	Updates the authored Python style guidance.
.agents/​skills/​python-codestyle/​references/​profiles.md	Updates the authored Python profile guidance.

_{Review effort: Lite}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.69%. Comparing base (19548f4) to head (633642c).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #3640   +/-   ##
========================================
  Coverage    81.69%   81.69%           
========================================
  Files           26       26           
  Lines         9111     9111           
========================================
  Hits          7443     7443           
  Misses        1668     1668           

Flag	Coverage Δ
python-3.13	81.69% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ptr727]

A recorded local strict-review pass covers head 633642ce793c5054e0e3ae04d23885aa5d60664a, the content this pull request carries at that commit against develop, and it recorded 1 finding.