| 1 | # Ruff lint — Phase C (blocking / enforced) |
| 2 | # |
| 3 | # DevSecOps Guardrails epic (jmservera/SquadScope-Coordinator#33), issues #540 |
| 4 | # (baseline), #543 (Phase B fixes), #545 (Phase C enforcement). The Phase B |
| 5 | # baseline is clean, so this job is now BLOCKING: it fails the build on any new |
| 6 | # lint violation or unformatted code. Mark "Lint / Ruff" as a required check. |
| 7 | |
| 8 | name: Lint |
| 9 | |
| 10 | on: |
| 11 | push: |
| 12 | branches: |
| 13 | - main |
| 14 | pull_request: |
| 15 | branches: |
| 16 | - main |
| 17 | |
| 18 | permissions: |
| 19 | contents: read |
| 20 | |
| 21 | concurrency: |
| 22 | group: ${{ github.workflow }}-${{ github.ref }} |
| 23 | cancel-in-progress: true |
| 24 | |
| 25 | jobs: |
| 26 | ruff: |
| 27 | name: Ruff |
| 28 | runs-on: ubuntu-latest |
| 29 | steps: |
| 30 | - name: Checkout code |
| 31 | uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
| 32 | with: |
| 33 | persist-credentials: false |
| 34 | |
| 35 | - name: Set up Python |
| 36 | uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 |
| 37 | with: |
| 38 | python-version: "3.12" |
| 39 | |
| 40 | - name: Install Ruff (pinned) |
| 41 | run: python -m pip install ruff==0.15.7 |
| 42 | |
| 43 | - name: Ruff check (GitHub annotations) |
| 44 | # Phase C: blocking. Fails the build on any lint violation. |
| 45 | run: ruff check . --output-format=github |
| 46 | |
| 47 | - name: Ruff format check |
| 48 | # Line length is owned by the formatter; enforce it here (blocking). |
| 49 | run: ruff format --check . |
| 50 | |
| 51 | - name: Ruff statistics (summary) |
| 52 | if: always() |
| 53 | run: | |
| 54 | { |
| 55 | echo "### Ruff statistics" |
| 56 | echo "" |
| 57 | echo '```' |
| 58 | ruff check . --statistics || true |
| 59 | echo '```' |
| 60 | } >> "$GITHUB_STEP_SUMMARY" |