[lelia]

Ruff linting and formatting now block pull requests, with matching pre-commit hooks and Make targets. The maintained Python tree is clean under the expanded rule set, while retaining Python 3.10 support.

Changes

• Add an unconditional Lint workflow for every PR and push to main. CI, make lint, and pre-commit use Ruff 0.17.4 from the project extra and lockfile. Hooks apply safe lint fixes and formatting for review.
• Enforce complexity 12 and eight arguments, with nine explicit exceptions for existing functions. RUF100 rejects obsolete suppressions. Keep package-relative imports and intentional upload-handle ownership documented locally.
• Normalize formatting, imports, annotations, exception chaining, and subprocess handling. Move full-scan parameter diagnostics from stdout to debug logging.
• Fix repository updates to serialize keyword arguments correctly, and close files opened for report uploads on both success and failure. Caller-provided streams retain their ownership. Add regression coverage for these behaviors.
• Refresh six stale mocked endpoint tests and run that mocked suite alongside unit tests in local and package CI checks. Live API tests remain opt-in.
• Prepare 3.6.3 with changelog entries and contributor instructions, including the correct Python minimum and locked development setup.

Validation

• 239 tests passed, one skipped, on each of Python 3.10 and 3.12.
• Ruff lint and format checks, pre-commit hooks, lockfile validation, and actionlint.
• Wheel and sdist builds and twine check.
• All GitHub checks pass, including the new Ruff gate, package or unit tests, dependency review, and CodeQL.
• Fourth wall review of added comments/docstrings, configuration policy, release notes, and this description.

This is the SDK rollout. Shared workflow extraction and the cross-repository policy floor remain separate work.

Refs CE-451

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pre-commit@​4.6.2
	ruff@​0.17.3 ⏵ 0.17.4	+1

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pre-commit@​4.6.2
	pypi/​ruff@​0.17.3 ⏵ 0.17.4	+1

View full report

[cursor]

PR Summary

Medium Risk
Wide SDK surface touched for lint, but functional risk concentrates on repository updates, report uploads, and full-scan logging—areas worth extra review despite strong test coverage.

Overview
This release 3.6.3 adds mandatory Ruff lint and format via a new CI workflow, pre-commit hooks, and Makefile targets, all pinned to Ruff 0.17.4 through uv.lock. The Ruff configuration is expanded (complexity 12, 8 args, broader rule sets) with documented suppressions for legacy hot spots.

CI and contributor workflow shifts to uv sync, make lint / make test, and package check now runs mocked endpoint tests alongside unit tests.

Behavior fixes (not just style): Repos.update and Repos.post correctly serialize **kwargs into the JSON body; Report.create closes path-opened files with ExitStack after upload (including failures); full-scan parameter cleanup messages move from print to debug logging; lazy file I/O hardens error handling so validation stays effective under python -O.

The bulk of the diff is mechanical normalization (PEP 604 types, imports, formatting) across the SDK plus changelog and docs updates.

^{Reviewed by Cursor Bugbot for commit 1062f55. Configure here.}

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1062f55. Configure here.}