Commit Graph

9 Commits

Author SHA1 Message Date
Trevin Chow bd7e46fbfd Merge remote-tracking branch 'origin/main' into pr-628-fix-621-mcp-go-tests
# Conflicts:
#	CHANGELOG.md
#	CONTRIBUTORS.md
2026-06-24 18:40:56 -07:00
dependabot[bot] db8a2ad5ab chore(deps): bump actions/checkout from 6.0.3 to 7.0.0
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-06-25 01:33:02 +00:00
23241a6749 64ed8aaf29 fix: correct setup-go hash pin, pin Go to exact patch, add -race flag
Greptile P2: use exact Go version 1.25.5 matching go.mod instead of
minor-version alias 1.25; add -race flag to catch data races in CI.

zizmor: fix setup-go hash pin to the actual v5.5.0 commit.
2026-06-21 16:58:57 +00:00
23241a6749 22a21e8f2f ci: run MCP Go tests in Validate workflow
The repo ships a Go MCP server with package-level tests (4 test files)
but the Validate CI only ran the Python pytest suite. Add a separate
mcp-tests job that runs go test ./... on every push/PR.

Closes #621.
2026-06-21 16:58:56 +00:00
dependabot[bot] d31f26eb17 chore(deps): bump actions/checkout from 4 to 6 (#587)
* chore(deps): bump actions/checkout from 4 to 6

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(ci): pin actions/checkout in scorecard workflow to v6.0.3 SHA

Resolves the zizmor unpinned-action security alert on PR #587 by matching
the hash-pinned reference used in the other workflow files.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Trevin Chow <trevin@trevinchow.com>
2026-06-17 15:38:21 -07:00
dependabot[bot] 0283cf2d25 chore(deps): bump astral-sh/setup-uv from 5.4.2 to 8.2.0 (#583)
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 5.4.2 to 8.2.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86...fac544c07dec837d0ccb6301d7b5580bf5edae39)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-17 15:26:25 -07:00
Shaan Majid b7e92d49c0 ci: harden GitHub Actions supply chain (#472)
* ci: harden existing workflows

* ci: add zizmor workflow

* ci: create releases with gh cli

---------

Co-authored-by: Trevin Chow <trevin@trevinchow.com>
2026-06-17 12:45:33 -07:00
Trevin Chow eb2d7a0f37 fix(ci): run full pytest suite, repair 13 rotted tests
CI was running only test_plugin_contract.py and test_version_consistency.py
(2 of 84 test files), masking 13 rotted tests across 4 clusters. The suite is
fully offline-safe (1402 tests in ~7s without network), so the narrow scope
wasn't gating integration flakiness; it was just stale. validate.yml now runs
`uv run pytest` against the full suite.

Engine fix: store.findings_from_report is rerank-first. ranked_candidates is
the primary persistence path; hackernews/polymarket are unconditionally
supplemented from items_by_source because they rank poorly but matter for
watchlists. When ranked_candidates was empty (rerank failed or skipped),
reddit, x, and every other source were silently dropped. The supplement loop
now falls back to all sources only when ranked_candidates is empty; the normal
path is unchanged.

Test repairs:
- test_store.py (6) + test_watchlist_commands.py (2): cascade from the engine fix
- test_get_new_findings_filters_by_date (latent): local-time vs SQLite UTC
  flake — switched to datetime.now(timezone.utc)
- TestPollDeviceAuth (3): mock_time.time side_effect lists too short after
  impl added a last_reminder call — padded timeout test, pinned others to
  return_value=0 (loops terminate via urlopen, not the clock)
- test_bare_run_emits_web_promo: engine reads ~/.config/last30days/.env, so
  a contributor's saved EXA/PARALLEL key made grounding "available" and
  suppressed the web promo. Also missing X made the "x" promo preempt "web".
  Set LAST30DAYS_CONFIG_DIR="", subprocess cwd=tmpdir, XAI_API_KEY stub.
2026-05-16 21:34:22 -07:00
Claire Novotny 17caa0526d ci: validate plugin contract on pull requests 2026-04-24 12:05:39 -04:00