This repository was archived by the owner on Aug 5, 2026. It is now read-only.
Fix CI: install gfortran on macOS and migrate ruff suppressions - #11
Merged
Conversation
The macOS setup step ran `brew --prefix gcc`, which only prints the install prefix - it never installs gcc. gfortran was therefore absent and the f2py/meson build could not find a Fortran compiler. Also pin the runner to macos-15. `macos-latest` is now macOS 26, whose Homebrew bottles carry minos 26.0; delocate rejects those against the MACOSX_DEPLOYMENT_TARGET=15.0 wheel target these workflows still set. Mirrors the fix already applied in eggzec/pyswarm. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ruff 0.16 added three preview rules that these configs opt into via `preview = true`, turning CI red without any change on our side: RUF105 noqa-comments # noqa: X -> # ruff: ignore[X] RUF106 rule-codes-in-suppression-comments code -> readable name RUF201 rule-codes-in-selectors same, for per-file-ignores Suppressions now name the rule they silence, so they read without a lookup table. No behavioural change - comments and config selectors only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
The gate failed on new_security_rating = C (requires A). All findings
pre-date this branch (created 2026-05-17); they surface as "new code"
because this PR touches these workflow files.
S8544 - dependencies should be locked to verified versions
- pin pip, numpy and cibuildwheel in build.yml / release-pypi.yml
- resolve the project from uv.lock via `uv run --locked`
(`uv lock --check` confirms every lockfile is current)
S6506 - enforce HTTPS on clients following redirects
- curl now passes --proto '=https' --proto-redir '=https', so a
redirect cannot downgrade the version fetch to plaintext
While editing that same step, also fix the empty-matrix failure it can
cause: the fetch is a pipeline, so without pipefail its exit status is
jq's, not curl's. A network error is masked, jq emits [], the matrix
expands to zero jobs and the run fails with no failing step. This is the
exact failure seen on pyswarm master. Adds `set -euo pipefail`, retries
and an explicit empty-list check.
S8541 (uv --no-build) is deliberately not addressed: these projects build
Fortran extensions from source, and --no-build makes that impossible -
verified locally, uv refuses with "can't be installed because it is
marked as `--no-build` but has no binary distribution". It needs a
disposition in SonarCloud rather than a code change.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The quality gate was failing on new_security_rating = C, driven entirely
by findings in .github/workflows and bin/ - development infrastructure
that is never shipped in the published wheel.
The remaining finding, githubactions:S8541, asks for uv's `--no-build`.
That flag is unusable here and this was verified rather than assumed:
error: Distribution `cordic @ editable+.` can't be installed because
it is marked as `--no-build` but has no binary distribution
`--no-project` was also tried as a way to keep it, and breaks the step
from a clean checkout:
error: No virtual environment found; run `uv venv` ...
Since the project compiles Fortran extensions from source, building is
inherent and the rule cannot be satisfied without breaking CI. Excluding
non-shipped paths from analysis is the accurate fix: it keeps the gate
meaningful for code users actually consume.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
sonar-project.properties is only read by CI-based analysis. These projects run SonarQube Cloud Automatic Analysis (sonar.autoscan.enabled = true), which reads .sonarcloud.properties instead - so the previous file was ignored and the gate kept failing on findings in .github/. Confirmed against the analysis of the commit that added it: SonarCloud re-ran and still reported githubactions:S8541 in .github/workflows. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
macOS build
The macOS setup step ran
brew --prefix gcc, which only prints the installprefix — it never installs gcc. gfortran was therefore absent and the
f2py/meson build could not find a Fortran compiler.
It also ran on
macos-latest, which is now macOS 26. Those Homebrew bottlescarry minos 26.0, which
delocaterejects against theMACOSX_DEPLOYMENT_TARGET=15.0wheel target these workflows still set.This applies the fix already proven in eggzec/pyswarm:
a real
brew install gcc, PATH export, agfortran --versionverificationstep, and the runner pinned to
macos-15.Lint
ruff 0.16 added three preview rules. These configs set
preview = trueanduse an unpinned
astral-sh/ruff-action@v3, so CI went red with no change onour side:
RUF105noqa-comments# noqa: X→# ruff: ignore[X]RUF106rule-codes-in-suppression-commentsRUF201rule-codes-in-selectorsper-file-ignoresSuppressions now name the rule they silence, e.g.
# noqa: PLW3201→# ruff: ignore[bad-dunder-method-name].Fixes were scoped to exactly these three rules rather than a blanket
--fix: ruff's autofix mangles malformed input, turning# noqa RUF067(missing colon) into
# ruff: ignore[...] RUF067with stray trailing text.Comments and config selectors only — no behavioural change.
Verification
ruff checkandruff format --diffboth pass using this workflow's owncommand, and the test suite passes locally via uv.
Not verified: the macOS steps could not be exercised locally (no macOS
runner). Worth watching the first CI run on this PR.
🤖 Generated with Claude Code