Fixed Linting issues

claude · claude · commit ab663f9551c5 · 2026-04-13T05:13:32.000+02:00
diff --git a/.claude/rules/copier/template-conventions.md b/.claude/rules/copier/template-conventions.md
@@ -133,9 +133,9 @@ Every skill SKILL.md frontmatter must include a `description:` field with these
 name: skill-name
 description: >-
   <Primary purpose in one sentence.>
-  
+
   <When to use it / trigger keywords.>
-  
+
   <What it produces or outputs.>
 ---
 ```
diff --git a/.github/CLAUDE.md b/.github/CLAUDE.md
@@ -13,8 +13,8 @@ the template itself, not the projects generated from it.
 | File | Trigger | Purpose |
 |---|---|---|
 | `tests.yml` | push/PR to main, manual | Full pytest suite across Python 3.11–3.13 matrix; uploads coverage |
-| `lint.yml` | push/PR to main | Ruff lint + format check + basedpyright type check |
-| `security.yml` | push/PR to main, weekly schedule | pip-audit dependency vulnerability scan |
+| `lint.yml` | push/PR to main | Ruff + basedpyright + root/template sync script + pre-commit (all files); docstrings via Ruff `D` in pyproject (same coverage as `just docs-check`) |
+| `security.yml` | push/PR to main, weekly schedule | CodeQL + pip-audit (same invocation as `just audit`: `uv run --with pip-audit pip-audit`) |
 | `dependency-review.yml` | PR | Review dependency changes for security issues |
 | `release.yml` | tag push (`v*`), manual (`workflow_dispatch`) | Bump version, create tag, publish GitHub Release |
 | `pre-commit-update.yml` | weekly schedule, manual | Auto-update pre-commit hook versions via PR |
@@ -55,8 +55,8 @@ before pushing a tag.
 
 | Meta-repo (here) | Generated projects (`template/.github/workflows/`) |
 |---|---|
-| `tests.yml` — tests the template rendering | `ci.yml` — tests the generated project's code |
-| `lint.yml` — lints meta-repo Python/tests | `lint.yml` — lints generated project code |
+| `tests.yml` — tests the template rendering | `ci.yml` — lint, typecheck, pre-commit, and pytest matrix for generated projects (aligns with `just ci`) |
+| `lint.yml` — lints meta-repo Python/tests | `lint.yml` — fast Ruff-only check; full gate is `ci.yml` (lint, types, pre-commit, tests) |
 | `security.yml` — audits meta-repo deps | `security.yml` — audits generated project deps (conditional) |
 | `release.yml` — releases the template | `release.yml` — releases the generated project (conditional) |
 | `file-freshness.yml` — tracks template file age | _(no equivalent)_ |
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -1,6 +1,10 @@
 # Lint workflow — runs ruff (format + lint), basedpyright (type checking), and pre-commit
 # hooks on every push and PR.
 #
+# Docstring rules (D) are enforced by `ruff check` via pyproject `select`. The separate
+# `just docs-check` recipe is the same D-only pass for clearer local output; no extra
+# GitHub step is required for docstrings beyond this workflow's Ruff step.
+#
 # References:
 #   Ruff documentation:         https://docs.astral.sh/ruff/
 #   BasedPyright:               https://docs.basedpyright.com/
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
@@ -70,4 +70,4 @@ jobs:
         run: uv sync --frozen --extra dev
 
       - name: Run pip-audit
-        run: uv export --frozen --format requirements-txt --extra dev | uvx pip-audit --requirement /dev/stdin
+        run: uv export --frozen --format requirements-txt --extra dev | uv run --with pip-audit pip-audit --requirement /dev/stdin
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -87,12 +87,14 @@ the justfile handles the correct flags and order.
 just ci
 ```
 
-This runs: `fix` → `fmt` → `ci-check`.
+This runs: `fix` → `ci-check`.
 
 `ci-check` bundles: `uv sync --frozen`, `fmt-check`, `ruff check`, `basedpyright`,
-`docs-check`, `test-ci` (pytest + coverage XML), `pre-commit --all-files`, `audit` (pip-audit).
+`sync-check`, `docs-check` (D-only; redundant with `ruff check` for enforcement), `test-ci`
+(pytest + coverage XML), `pre-commit run --all-files --verbose`, `audit` (pip-audit).
 
-All steps must pass before a PR is mergeable.
+Together, `lint.yml` + `tests.yml` + `security.yml` mirror these checks on GitHub (CodeQL is
+GHA-only). All steps must pass before a PR is mergeable.
 
 ## Generating a test project from the template
 
diff --git a/justfile b/justfile
@@ -64,7 +64,7 @@ type:
 
 # -------------------------------------------------------------------------
 # Testing
-# 
+#
 # Default: Minimal logging (quiet mode, dots only, warnings/errors only)
 # For verbose output with test names, use: just test-verbose
 # For full debug output, use: just test-debug
diff --git a/template/.github/workflows/ci.yml.jinja b/template/.github/workflows/ci.yml.jinja
@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8
+        uses: astral-sh/setup-uv@v8.0.0
         with:
           enable-cache: true
 
@@ -46,10 +46,10 @@ jobs:
         run: uv sync --frozen --extra dev --extra test{% if include_docs %} --extra docs{% endif %}
 
       - name: Run Ruff (format check)
-        run: uv run ruff format --check .
+        run: uv run ruff format --check src tests
 
       - name: Run Ruff (lint)
-        run: uv run ruff check .
+        run: uv run ruff check src tests
 
   typecheck:
     name: Type Check
@@ -58,7 +58,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8
+        uses: astral-sh/setup-uv@v8.0.0
         with:
           enable-cache: true
 
@@ -71,6 +71,26 @@ jobs:
       - name: Run BasedPyright
         run: uv run basedpyright
 
+  precommit:
+    name: Pre-commit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.0.0
+        with:
+          enable-cache: true
+
+      - name: Set up Python
+        run: uv python install {{ python_min_version }}
+
+      - name: Install dependencies
+        run: uv sync --frozen --extra dev --extra test{% if include_docs %} --extra docs{% endif %}
+
+      - name: Pre-commit (all files)
+        run: uv run pre-commit run --all-files --verbose
+
   test:
     name: Test (Python {% raw %}${{ matrix.python-version }}{% endraw %})
     runs-on: ubuntu-latest
@@ -83,7 +103,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8
+        uses: astral-sh/setup-uv@v8.0.0
         with:
           enable-cache: true
 
@@ -107,13 +127,13 @@ jobs:
 
   check:
     name: All Checks Passed
-    needs: [lint, typecheck, test]
+    needs: [lint, typecheck, precommit, test]
     runs-on: ubuntu-latest
     if: always()
     steps:
       - name: Check results
         run: |
-          if {% raw %}[[ "${{ needs.lint.result }}" != "success" || "${{ needs.typecheck.result }}" != "success" || "${{ needs.test.result }}" != "success" ]]{% endraw %}; then
+          if {% raw %}[[ "${{ needs.lint.result }}" != "success" || "${{ needs.typecheck.result }}" != "success" || "${{ needs.precommit.result }}" != "success" || "${{ needs.test.result }}" != "success" ]]{% endraw %}; then
             echo "One or more checks failed"
             exit 1
           fi
diff --git a/template/.github/workflows/lint.yml.jinja b/template/.github/workflows/lint.yml.jinja
@@ -42,7 +42,7 @@ jobs:
         run: uv sync --frozen --extra dev --extra test{% if include_docs %} --extra docs{% endif %}
 
       - name: Ruff format (check)
-        run: uv run ruff format --check .
+        run: uv run ruff format --check src tests
 
       - name: Ruff lint
-        run: uv run ruff check .
+        run: uv run ruff check src tests
diff --git a/template/.github/workflows/security.yml.jinja b/template/.github/workflows/security.yml.jinja
@@ -82,4 +82,4 @@ jobs:
         run: uv sync --frozen --extra dev
 
       - name: Run pip-audit
-        run: uv export --frozen --format requirements-txt --extra dev | uvx pip-audit --requirement /dev/stdin
+        run: uv export --frozen --format requirements-txt --extra dev | uv run --with pip-audit pip-audit --requirement /dev/stdin
diff --git a/template/CLAUDE.md.jinja b/template/CLAUDE.md.jinja
@@ -131,7 +131,7 @@ Load a skill by reading its `SKILL.md`: e.g. `.claude/skills/tdd-workflow/SKILL.
 
 A feature or fix is **done** when all of the following are true:
 
-1. `just ci` passes with zero errors (lint → types → docstrings → tests → pre-commit).
+1. `just ci` passes with zero errors (lint → types → docstrings → `test-ci` → pre-commit; matches `.github/workflows/ci.yml`).
 2. Every new public function/class/method has a Google-style docstring (Args/Returns/Raises where applicable).
 3. Every new function/method has complete type annotations (parameters + return type).
 4. At least one test case covers each new public symbol.
diff --git a/template/justfile.jinja b/template/justfile.jinja
@@ -102,6 +102,10 @@ coverage:
         --cov-report=html \
         --cov-report=xml
 
+# Test command matching GitHub CI (.github/workflows/ci.yml test job)
+test-ci:
+    @uv run pytest -n auto --cov --cov-report=xml --cov-report=term
+
 # -------------------------------------------------------------------------
 # Pre-commit
 # -------------------------------------------------------------------------
@@ -210,7 +214,7 @@ ci:
     @just lint
     @just type
     @just docs-check
-    @just test
+    @just test-ci
     @just precommit
 
 # -------------------------------------------------------------------------
diff --git a/tests/test_template.py b/tests/test_template.py
@@ -1240,7 +1240,8 @@ def test_pypi_publish_absent_by_default(tmp_path: Path) -> None:
 def test_security_workflow_generated_by_default(tmp_path: Path) -> None:
     """security.yml must be generated with jobs enabled when include_security_scanning=true."""
     test_dir = tmp_path / "security_default"
-    copy_with_data(
+    # Worktree render: assert on template edits (e.g. pip-audit invocation) before they are committed.
+    copy_with_data_from_worktree(
         test_dir,
         {
             "project_name": "Security Default",
@@ -1263,6 +1264,9 @@ def test_security_workflow_generated_by_default(tmp_path: Path) -> None:
     assert "--requirement /dev/stdin" in content, (
         "pip-audit must read exported requirements via --requirement /dev/stdin (not removed --stdin)"
     )
+    assert "uv run --with pip-audit pip-audit" in content, (
+        "pip-audit must match `just audit` (project interpreter via uv run --with)"
+    )
 
 
 def test_security_workflow_disabled(tmp_path: Path) -> None:
@@ -1322,6 +1326,38 @@ def test_pre_commit_update_workflow_generated(tmp_path: Path) -> None:
     assert "create-pull-request" in content
 
 
+def test_ci_workflow_aligns_with_just_ci(tmp_path: Path) -> None:
+    """``ci.yml`` and ``just ci`` must stay aligned (pre-commit job, ruff paths, pytest flags)."""
+    test_dir = tmp_path / "ci_just_align"
+    # Worktree render: ``copy_with_data`` uses ``git+file`` at HEAD, which omits uncommitted template edits.
+    copy_with_data_from_worktree(
+        test_dir,
+        {
+            "project_name": "CI Just Align",
+            "include_docs": False,
+        },
+    )
+    ci_yml = test_dir / ".github" / "workflows" / "ci.yml"
+    assert ci_yml.is_file(), "ci.yml must be generated"
+    workflow = ci_yml.read_text(encoding="utf-8")
+    assert "needs: [lint, typecheck, precommit, test]" in workflow, (
+        "Aggregate check must gate on pre-commit alongside lint, typecheck, and tests"
+    )
+    assert "uv run pre-commit run --all-files --verbose" in workflow
+    assert "uv run ruff format --check src tests" in workflow
+    assert "uv run ruff check src tests" in workflow
+    assert "uv run pytest -n auto --cov --cov-report=xml --cov-report=term" in workflow
+
+    justfile = (test_dir / "justfile").read_text(encoding="utf-8")
+    assert "test-ci:" in justfile
+    assert "pytest -n auto --cov --cov-report=xml --cov-report=term" in justfile
+    assert "@just test-ci" in justfile
+
+    lint_yml = (test_dir / ".github" / "workflows" / "lint.yml").read_text(encoding="utf-8")
+    assert "uv run ruff format --check src tests" in lint_yml
+    assert "uv run ruff check src tests" in lint_yml
+
+
 def test_common_bump_version_generated(tmp_path: Path) -> None:
     """``src/<package>/common/bump_version.py`` must exist in the generated project."""
     test_dir = tmp_path / "bump_version"
