Refactor workflows for dependency management and update documentation#107
Refactor workflows for dependency management and update documentation#107GabrielBG0 wants to merge 6 commits into
Conversation
… update installation instructions in documentation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR standardizes the Minerva project's build and development tooling on uv, a modern Python package manager. Four GitHub Actions workflows are updated to use pinned action versions and uv-based tool execution. User and contributor documentation are rewritten to reflect the new workflow. The Sphinx theme switches from sphinx_rtd_theme to furo with corresponding dependency updates. Changesuv Toolchain Standardization
🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/docs.yaml (1)
29-36:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRun the docs build through
uv runto ensure dependencies are available.The workflow installs docs dependencies via
uv sync --extra docs, but then runsmake htmlin a plain shell without activating that environment. The Sphinx build tool (sphinx-build) is a Python dependency installed byuv sync, and withoutuv run, it may not be available on the PATH. Per uv's documentation, commands that depend on the synced environment should be executed throughuv run.Suggested change
- - name: Build docs - run: | - cd docs - make clean - make html + - name: Build docs + run: uv run -- make -C docs clean html🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/docs.yaml around lines 29 - 36, The docs build step runs "make html" outside the uv-managed environment, so sphinx may not be on PATH; modify the "Build docs" step to execute the make commands through uv (e.g., use "uv run -- make -C docs clean html" or "uv run -- sh -c 'cd docs && make clean && make html'") so the Sphinx dependency installed by the "Install project with docs dependencies" (uv sync --extra docs) is available; update the "Build docs" step to call uv run instead of a plain shell invocation.
🧹 Nitpick comments (1)
.github/workflows/continuous-testing.yml (1)
42-42: ⚡ Quick winUse frozen sync in CI for lockfile enforcement.
Line 42 should use
--frozenso CI doesn’t silently re-resolve dependencies.Suggested change
- run: uv sync --extra dev + run: uv sync --extra dev --frozen🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/continuous-testing.yml at line 42, Replace the existing CI sync invocation to enforce lockfile usage: update the command that currently runs "uv sync --extra dev" to include the --frozen flag (e.g., change the invocation in the workflow step that runs the uv sync command to use --frozen so CI fails if the lockfile would be changed).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/auto-format.yml:
- Around line 28-38: Replace the direct invocation "uvx black minerva tests" in
the "Run black formatter" step with a lockfile-backed invocation so CI uses the
pinned Black from the repo lockfile (project dev deps in pyproject.toml);
specifically change the command run by the "Run black formatter" step (currently
using "uvx black minerva tests") to call uvx with the lockfile (e.g. "uvx run
--lockfile=<lockfile> black minerva tests") so the workflow consistently uses
the pinned Black (26.5.0) rather than the latest PyPI release.
In @.github/workflows/continuous-testing.yml:
- Around line 35-36: The workflow still references the mutable tag "uses:
astral-sh/setup-uv@v5"; replace that with a pinned full commit SHA (e.g., "uses:
astral-sh/setup-uv@<COMMIT_SHA>") to match the hardening applied
elsewhere—locate the "uses: astral-sh/setup-uv@v5" entry in the workflow and
update it to the exact commit SHA, ensuring any other occurrences are similarly
pinned and that the chosen SHA is verified for compatibility.
In `@docs/conf.py`:
- Line 65: The line concatenates two assignments into invalid Python; split the
single line into two separate assignments so htmlhelp_basename = "minerva_docs"
and source_encoding = "utf-8" are on their own lines (locate the assignments by
the symbols htmlhelp_basename and source_encoding in conf.py and place a line
break between them).
---
Outside diff comments:
In @.github/workflows/docs.yaml:
- Around line 29-36: The docs build step runs "make html" outside the uv-managed
environment, so sphinx may not be on PATH; modify the "Build docs" step to
execute the make commands through uv (e.g., use "uv run -- make -C docs clean
html" or "uv run -- sh -c 'cd docs && make clean && make html'") so the Sphinx
dependency installed by the "Install project with docs dependencies" (uv sync
--extra docs) is available; update the "Build docs" step to call uv run instead
of a plain shell invocation.
---
Nitpick comments:
In @.github/workflows/continuous-testing.yml:
- Line 42: Replace the existing CI sync invocation to enforce lockfile usage:
update the command that currently runs "uv sync --extra dev" to include the
--frozen flag (e.g., change the invocation in the workflow step that runs the uv
sync command to use --frozen so CI fails if the lockfile would be changed).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 05bb1165-74a3-461f-b4b3-8eb34ac185ad
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (9)
.github/workflows/auto-format.yml.github/workflows/continuous-testing.yml.github/workflows/docs.yaml.github/workflows/release_to_pypi.ymlCONTRIBUTING.mdREADME.mddocs/conf.pydocs/installation.mdpyproject.toml
1 participant
Describe your changes
Migrate all CI workflows from pip to uv, harden them against supply chain attacks by pinning actions to immutable commit SHAs, and migrate PyPI publishing to OIDC Trusted Publishing.
CI tooling migration (pip → uv):
auto-format,continuous-testing,docs,release_to_pypi) now useastral-sh/setup-uvinstead ofactions/setup-python+ pip. Python invocations are replaced withuvx/uv run/uv sync --extra <group>.uv.lockto the repository.Supply chain hardening (Mini Shai-Hulud response):
# vX.Y.Zcomment for readability. No mutable version tags (@v4,@v5, etc.) remain.peaceiris/actions-gh-pagesupgraded from v3 → v4.1.0 (SHA-pinned) in the docs workflow.permissionsscopes added to each workflow/job — no workflow relies on the default broad token permissions.PyPI Trusted Publishing (OIDC — no stored token):
release_to_pypi.ymlmigrated fromuv publish+PYPI_API_TOKEN_MINERVAsecret topypa/gh-action-pypi-publishwithid-token: write. No API token is stored or used.pypiprotected GitHub environment (requires reviewer approval before publishing).Docs fixes:
html_themeassignment indocs/conf.py.html_theme = "furo") for improved documentation styling.docs/installation.mdandREADME.mdto reflect uv-based setup instructions.Issue ticket number and link (If apply)
N/A
Checklist before requesting a review
Summary by CodeRabbit
New Features
Documentation