Skip to content

Bootstrap agent-ready infrastructure#74

Open
dahlem wants to merge 1 commit intoeval-hub:mainfrom
dahlem:agentready-bootstrap
Open

Bootstrap agent-ready infrastructure#74
dahlem wants to merge 1 commit intoeval-hub:mainfrom
dahlem:agentready-bootstrap

Conversation

@dahlem
Copy link
Copy Markdown

@dahlem dahlem commented Mar 19, 2026

Summary

  • Add agent-ready assessment reports and CI workflow
  • Add GitHub templates (issues, PRs), CODEOWNERS, and dependabot config
  • Add CI workflows for tests and security scanning
  • Add pre-commit config, CODE_OF_CONDUCT, and CONTRIBUTING guide

Summary by CodeRabbit

  • Documentation

    • Added Code of Conduct establishing community standards and inclusive environment expectations.
    • Added comprehensive Contributing guidelines covering setup, development workflow, testing, and pull request process.
    • Added issue templates for bug reports and feature requests to standardize submissions.
    • Added pull request template to guide contributor descriptions and change documentation.
  • Chores

    • Configured automated dependency updates via Dependabot.
    • Established GitHub Actions workflows for testing, security scanning, and code quality assessment.
    • Updated code quality and commit message tooling configuration.
    • Added repository ownership and code review configuration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Mar 19, 2026

📝 Walkthrough

Walkthrough

This PR adds comprehensive project infrastructure including GitHub Actions CI/CD workflows for testing, security scanning, and AgentReady assessments; GitHub issue and pull request templates; community contribution guidelines; dependency and security configurations; and AgentReady assessment reports. No application code logic is modified.

Changes

Cohort / File(s) Summary
AgentReady Assessment Reports
.agentready/assessment-20260212-110201.json, .agentready/assessment-latest.json, .agentready/report-20260212-110201.md, .agentready/report-latest.md, .agentready/report-latest.html
Generated assessment artifacts with JSON metadata, Markdown reports, and HTML pointer files; includes overall score (69.0), certification level (Silver), and detailed findings across multiple attributes.
GitHub Templates & Configuration
.github/ISSUE_TEMPLATE/bug_report.md, .github/ISSUE_TEMPLATE/feature_request.md, .github/PULL_REQUEST_TEMPLATE.md, .github/CODEOWNERS, .github/dependabot.yml
Added issue templates for bug reports and feature requests with structured sections; PR template with checklist and guidelines; CODEOWNERS file for default reviewer assignment; Dependabot configuration for pip and GitHub Actions with weekly updates.
GitHub Actions Workflows
.github/workflows/agentready-assessment.yml, .github/workflows/security.yml, .github/workflows/tests.yml
Three CI/CD workflows: AgentReady assessment (runs on PR/push/dispatch, uploads reports); Security (CodeQL + Safety checks on push/PR/weekly cron); Tests (pytest with coverage matrix for Python 3.12–3.13, uploads to Codecov).
Development Configuration
.pre-commit-config.yaml
Replaced Ruff/MyPy hooks with Black and isort for formatting; added TOML/JSON/secret-key scanning; introduced Conventional Commits validation via conventional-pre-commit; removed debug-statements and YAML multi-doc checking.
Community Guidelines
CODE_OF_CONDUCT.md, CONTRIBUTING.md
Added Code of Conduct defining community standards and enforcement; comprehensive CONTRIBUTING guide covering setup, branching, PR workflow, testing, documentation, and code style expectations.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

Suggested labels

kind/chore, kind/docs

Poem

🐰 Workflows spin and templates rise,
Pre-commit hooks keep code precise,
Assessment scores guide the way,
Community standards here to stay,
Infrastructure blooms in spring array! 🌱

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description provides a summary of changes but does not follow the required template structure with 'What and why', 'Type', 'Testing', and 'Breaking changes' sections. Restructure the description to include required template sections: 'What and why' with issue links, 'Type' checkbox selection, 'Testing' confirmation, and note any breaking changes.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the main change: bootstrapping infrastructure related to agent-ready assessment and CI/CD setup.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Important

Merge conflicts detected (Beta)

  • Resolve merge conflict in branch agentready-bootstrap
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
📝 Coding Plan
  • Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Tip

You can disable the changed files summary in the walkthrough.

Disable the reviews.changed_files_summary setting to disable the changed files summary in the walkthrough.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 9

🧹 Nitpick comments (1)
CODE_OF_CONDUCT.md (1)

31-31: Add a concrete reporting contact in enforcement section

Line 31 references reporting to the project team, but there’s no explicit channel (email/form/link). Please add one so reports are actionable.

Suggested fix
- Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project team. All complaints will be reviewed and investigated promptly and fairly.
+ Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project team at conduct@your-project.org. All complaints will be reviewed and investigated promptly and fairly.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@CODE_OF_CONDUCT.md` at line 31, Replace the vague "reported to the project
team" sentence in CODE_OF_CONDUCT.md with a concrete reporting channel: specify
a direct contact (e.g., reporting@yourproject.org) and/or a URL to a reporting
form, note expected response timeframe, and include an alternative contact
(e.g., private GitHub issue or trusted maintainer) and confidentiality assurance
so reporters know how and where to submit complaints and what to expect.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.agentready/report-20260212-110201.md:
- Around line 4-9: The report contains machine-identifying metadata (e.g., the
"Path:", "Run by:", and similar fields) and must be sanitized before commit: add
or modify a sanitizeReportMetadata(reportText) helper used by
generateAgentReadyReport (or the report writer) to strip or replace absolute
filesystem paths, hostnames, usernames, and other local identifiers with stable
placeholders (e.g., [REDACTED_PATH], [REDACTED_USER]) for the "Path", "Run by",
"Assessed" and similar lines and apply it across the whole report (including
lines ~666-671); ensure the sanitizer runs prior to writing/committing the
.agentready report and include tests that verify sensitive fields are replaced.

In @.github/CODEOWNERS:
- Line 13: The CODEOWNERS entry currently uses a placeholder handle "@owner"
which prevents automatic reviewer assignment; update the CODEOWNERS file by
replacing "@owner" with the correct GitHub user or team handle (e.g.,
"@your-org/your-team" or "@valid-username") so that the entry under the pattern
"*" points to a real, valid owner; verify the handle exists in the org and
commit the change.

In @.github/workflows/agentready-assessment.yml:
- Around line 48-56: The PR comment currently posts the filename stored in
reportPath instead of the assessment body; change the code where the comment is
assembled to use the file contents read into the report variable (from
fs.readFileSync(reportPath, 'utf8')) rather than reportPath. Locate the
reportPath and report variables and ensure the value passed to the PR
comment/posting function is report (the string from fs.readFileSync) so the
actual assessment markdown is posted.

In @.github/workflows/security.yml:
- Around line 51-53: The security step named "Run safety check" currently
appends "|| true" to the command "safety check --json || true", which masks
non‑zero exits; remove the "|| true" so the step fails when safety finds
vulnerabilities (or alternatively set the job step attribute to not
continue-on-error), ensuring the workflow gates on dependency security by
letting "safety check --json" exit non‑zero on issues.

In @.github/workflows/tests.yml:
- Around line 42-44: The workflow step named "Run pytest" currently invokes
pytest with explicit coverage flags that override pyproject.toml; change the
step so it runs plain "pytest" (remove "--cov=src --cov-report=xml
--cov-report=term") so pytest will pick up addopts from pyproject.toml (which
contains the intended --cov=src/evalhub, --cov-report=term-missing, and
--cov-report=html settings); update the command in the "Run pytest" step to
simply run pytest with no extra flags.
- Around line 25-37: The CI runs black and isort but they are not installed by
the dev extras, so either add "black" and "isort" to the dev optional
dependencies in pyproject.toml under the "dev" extras (preferred) or modify the
workflow step that installs dependencies to explicitly pip install black and
isort (e.g., ensure the Install dependencies step installs black and isort after
pip install -e ".[dev]"); update the pyproject.toml "dev" extras entry or the
Install dependencies step in .github/workflows/tests.yml accordingly so the Run
black and Run isort steps succeed.
- Around line 46-50: Fix the invalid YAML in the "Upload coverage to Codecov"
step by moving the if: guard onto its own line (not on the same line as with:)
and properly indenting it as a step-level key, and correct the Python version
check from '3.11' to a value that matches the matrix (e.g., change
matrix.python-version == '3.11' to matrix.python-version == '3.12' or another
desired version); identify the step by its name "Upload coverage to Codecov" and
the action uses: codecov/codecov-action@v4 when applying the changes.

In @.pre-commit-config.yaml:
- Around line 26-30: The pre-commit config pins ruff-pre-commit at rev: v0.1.14
while pyproject.toml lists ruff at 0.1.6, causing inconsistent linting; update
the ruff version in pyproject.toml to match the pre-commit pin (change the ruff
= "0.1.6" / tool.ruff version entry to 0.1.14 or otherwise align it with rev:
v0.1.14) so local/CI/pre-commit use the same ruff release.

In `@CONTRIBUTING.md`:
- Around line 95-101: Two unlabeled fenced code blocks containing the commit
message template (the block with "<type>(<scope>): <subject>" and the example
block with "feat(api): add user authentication endpoint ...") violate
markdownlint MD040; fix both by adding a language identifier (e.g., text) to
each opening fence so they read "```text" instead of "```" to silence the linter
and preserve formatting for the template and examples.

---

Nitpick comments:
In `@CODE_OF_CONDUCT.md`:
- Line 31: Replace the vague "reported to the project team" sentence in
CODE_OF_CONDUCT.md with a concrete reporting channel: specify a direct contact
(e.g., reporting@yourproject.org) and/or a URL to a reporting form, note
expected response timeframe, and include an alternative contact (e.g., private
GitHub issue or trusted maintainer) and confidentiality assurance so reporters
know how and where to submit complaints and what to expect.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2c7482b7-2f7f-4a2e-8db8-9a449a68acb7

📥 Commits

Reviewing files that changed from the base of the PR and between cf409a7 and 98ce8d5.

📒 Files selected for processing (17)
  • .agentready/assessment-20260212-110201.json
  • .agentready/assessment-latest.json
  • .agentready/report-20260212-110201.html
  • .agentready/report-20260212-110201.md
  • .agentready/report-latest.html
  • .agentready/report-latest.md
  • .github/CODEOWNERS
  • .github/ISSUE_TEMPLATE/bug_report.md
  • .github/ISSUE_TEMPLATE/feature_request.md
  • .github/PULL_REQUEST_TEMPLATE.md
  • .github/dependabot.yml
  • .github/workflows/agentready-assessment.yml
  • .github/workflows/security.yml
  • .github/workflows/tests.yml
  • .pre-commit-config.yaml
  • CODE_OF_CONDUCT.md
  • CONTRIBUTING.md

Comment on lines +4 to +9
**Path**: `/Users/ddahlem/Documents/repos/trusty/eval-hub/eval-hub-sdk`
**Branch**: `main` | **Commit**: `7189badb`
**Assessed**: February 12, 2026 at 11:02 AM
**AgentReady Version**: 2.27.0
**Run by**: ddahlem@ddahlem-mac

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Redact machine-identifying metadata from committed reports.

Line 4, Line 8, Line 670, and related fields expose local filesystem paths and host/user identifiers. These artifacts should be sanitized before commit.

Proposed fix
-**Path**: `/Users/ddahlem/Documents/repos/trusty/eval-hub/eval-hub-sdk`
+**Path**: `[REDACTED_LOCAL_PATH]`
@@
-**Run by**: ddahlem@ddahlem-mac
+**Run by**: `[REDACTED_EXECUTOR]`
@@
-- **Assessed By**: ddahlem@ddahlem-mac
+- **Assessed By**: [REDACTED_EXECUTOR]

Also applies to: 666-671

🧰 Tools
🪛 LanguageTool

[style] ~6-~6: Some style guides suggest that commas should set off the year in a month-day-year date.
Context: ...: 7189badb Assessed: February 12, 2026 at 11:02 AM AgentReady Version: 2.2...

(MISSING_COMMA_AFTER_YEAR)

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.agentready/report-20260212-110201.md around lines 4 - 9, The report
contains machine-identifying metadata (e.g., the "Path:", "Run by:", and similar
fields) and must be sanitized before commit: add or modify a
sanitizeReportMetadata(reportText) helper used by generateAgentReadyReport (or
the report writer) to strip or replace absolute filesystem paths, hostnames,
usernames, and other local identifiers with stable placeholders (e.g.,
[REDACTED_PATH], [REDACTED_USER]) for the "Path", "Run by", "Assessed" and
similar lines and apply it across the whole report (including lines ~666-671);
ensure the sanitizer runs prior to writing/committing the .agentready report and
include tests that verify sensitive fields are replaced.

# /.github/ @devops-team

# Default: assign to repository owner
* @owner No newline at end of file
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Replace placeholder CODEOWNER with a real user/team handle

Line 13 uses @owner, which looks like a placeholder. If it isn’t a valid GitHub user/team in this repo, automatic reviewer assignment won’t work.

Suggested fix
- *       `@owner`
+ *       `@your-org/maintainers`
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
* @owner
* `@your-org/maintainers`
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/CODEOWNERS at line 13, The CODEOWNERS entry currently uses a
placeholder handle "@owner" which prevents automatic reviewer assignment; update
the CODEOWNERS file by replacing "@owner" with the correct GitHub user or team
handle (e.g., "@your-org/your-team" or "@valid-username") so that the entry
under the pattern "*" points to a real, valid owner; verify the handle exists in
the org and commit the change.

Comment on lines +48 to +56
const reportPath = '.agentready/report-latest.md';

if (!fs.existsSync(reportPath)) {
console.log('No report found');
return;
}

const report = fs.readFileSync(reportPath, 'utf8');

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

PR comment step posts the pointer filename, not the report body.

Line 55 currently reads .agentready/report-latest.md directly, so the PR comment will be report-*.md text instead of the assessment content.

Proposed fix
-            const reportPath = '.agentready/report-latest.md';
+            const reportPointerPath = '.agentready/report-latest.md';
 
-            if (!fs.existsSync(reportPath)) {
+            if (!fs.existsSync(reportPointerPath)) {
               console.log('No report found');
               return;
             }
 
-            const report = fs.readFileSync(reportPath, 'utf8');
+            const reportFile = fs.readFileSync(reportPointerPath, 'utf8').trim();
+            const reportPath = `.agentready/${reportFile}`;
+            if (!reportFile || !fs.existsSync(reportPath)) {
+              console.log('Resolved report file not found');
+              return;
+            }
+            const report = fs.readFileSync(reportPath, 'utf8');
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
const reportPath = '.agentready/report-latest.md';
if (!fs.existsSync(reportPath)) {
console.log('No report found');
return;
}
const report = fs.readFileSync(reportPath, 'utf8');
const reportPointerPath = '.agentready/report-latest.md';
if (!fs.existsSync(reportPointerPath)) {
console.log('No report found');
return;
}
const reportFile = fs.readFileSync(reportPointerPath, 'utf8').trim();
const reportPath = `.agentready/${reportFile}`;
if (!reportFile || !fs.existsSync(reportPath)) {
console.log('Resolved report file not found');
return;
}
const report = fs.readFileSync(reportPath, 'utf8');
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/agentready-assessment.yml around lines 48 - 56, The PR
comment currently posts the filename stored in reportPath instead of the
assessment body; change the code where the comment is assembled to use the file
contents read into the report variable (from fs.readFileSync(reportPath,
'utf8')) rather than reportPath. Locate the reportPath and report variables and
ensure the value passed to the PR comment/posting function is report (the string
from fs.readFileSync) so the actual assessment markdown is posted.

Comment on lines +51 to +53
- name: Run safety check
run: |
safety check --json || true
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Security scan is configured fail-open

Line 53 uses || true, so the workflow won’t fail on detected vulnerabilities. That defeats gating for dependency security.

Suggested fix
-      - name: Run safety check
-        run: |
-          safety check --json || true
+      - name: Run safety check
+        run: |
+          safety check --json
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Run safety check
run: |
safety check --json || true
- name: Run safety check
run: |
safety check --json
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/security.yml around lines 51 - 53, The security step named
"Run safety check" currently appends "|| true" to the command "safety check
--json || true", which masks non‑zero exits; remove the "|| true" so the step
fails when safety finds vulnerabilities (or alternatively set the job step
attribute to not continue-on-error), ensuring the workflow gates on dependency
security by letting "safety check --json" exit non‑zero on issues.

Comment on lines +25 to +37
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -e ".[dev]"

- name: Run black
run: |
black --check .

- name: Run isort
run: |
isort --check .

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
python - <<'PY'
from pathlib import Path
import tomllib

data = tomllib.loads(Path("pyproject.toml").read_text())
dev = data.get("project", {}).get("optional-dependencies", {}).get("dev", [])
print("dev dependencies:")
for dep in dev:
    print(" -", dep)

has_black = any(dep.split("[",1)[0].split("==",1)[0].split(">=",1)[0].strip() == "black" for dep in dev)
has_isort = any(dep.split("[",1)[0].split("==",1)[0].split(">=",1)[0].strip() == "isort" for dep in dev)
print(f"black declared: {has_black}")
print(f"isort declared: {has_isort}")
PY

Repository: eval-hub/eval-hub-sdk

Length of output: 241


🏁 Script executed:

cat -n .github/workflows/tests.yml | head -50

Repository: eval-hub/eval-hub-sdk

Length of output: 1480


🏁 Script executed:

# Check if pre-commit config exists and what hooks it defines
if [ -f ".pre-commit-config.yaml" ]; then
  cat .pre-commit-config.yaml
fi

Repository: eval-hub/eval-hub-sdk

Length of output: 914


black and isort must be added to dev dependencies.

The workflow runs both tools (lines 32 and 36), but they are not included in pyproject.toml dev extras. While .pre-commit-config.yaml defines them as hooks, they won't be installed in the CI environment without being in the dependencies. The workflow will fail at these steps.

Add black and isort to the dev optional dependencies in pyproject.toml, or alternatively install them directly in the workflow:

Option 1: Add to pyproject.toml (preferred)
[project.optional-dependencies]
dev = [
  "pytest>=7.4.0",
  "pytest-asyncio>=0.23.0",
  "pytest-cov>=4.1.0",
  "ruff==0.1.6",
  "mypy==1.7.1",
  "pre-commit>=3.4.0",
+ "black>=24.1.0",
+ "isort>=5.13.0",
]
Option 2: Add to workflow (workflow-local)
pip install -e ".[dev]" black isort
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -e ".[dev]"
- name: Run black
run: |
black --check .
- name: Run isort
run: |
isort --check .
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -e ".[dev]" black isort
- name: Run black
run: |
black --check .
- name: Run isort
run: |
isort --check .
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/tests.yml around lines 25 - 37, The CI runs black and
isort but they are not installed by the dev extras, so either add "black" and
"isort" to the dev optional dependencies in pyproject.toml under the "dev"
extras (preferred) or modify the workflow step that installs dependencies to
explicitly pip install black and isort (e.g., ensure the Install dependencies
step installs black and isort after pip install -e ".[dev]"); update the
pyproject.toml "dev" extras entry or the Install dependencies step in
.github/workflows/tests.yml accordingly so the Run black and Run isort steps
succeed.

Comment on lines +42 to +44
- name: Run pytest
run: |
pytest --cov=src --cov-report=xml --cov-report=term
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
python - <<'PY'
from pathlib import Path
import tomllib

cfg = tomllib.loads(Path("pyproject.toml").read_text())
addopts = cfg.get("tool", {}).get("pytest", {}).get("ini_options", {}).get("addopts", [])
print("pytest addopts:")
for opt in addopts:
    print(" -", opt)

workflow = Path(".github/workflows/tests.yml").read_text().splitlines()
print("\nworkflow pytest command lines:")
for i, line in enumerate(workflow, 1):
    if "pytest" in line:
        print(f"{i}: {line}")
PY

Repository: eval-hub/eval-hub-sdk

Length of output: 343


Remove pytest-cov flags from workflow to avoid conflicting with pyproject.toml configuration.

Line 44 adds coverage flags that override the addopts defined in pyproject.toml:133-145. The --cov=src target differs from the configured --cov=src/evalhub, and --cov-report=term differs from the configured --cov-report=term-missing. Additionally, the configured --cov-report=html is omitted. Running pytest without these flags will use the consistent configuration from pyproject.toml.

Proposed fix
       - name: Run pytest
         run: |
-          pytest --cov=src --cov-report=xml --cov-report=term
+          pytest
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Run pytest
run: |
pytest --cov=src --cov-report=xml --cov-report=term
- name: Run pytest
run: |
pytest
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/tests.yml around lines 42 - 44, The workflow step named
"Run pytest" currently invokes pytest with explicit coverage flags that override
pyproject.toml; change the step so it runs plain "pytest" (remove "--cov=src
--cov-report=xml --cov-report=term") so pytest will pick up addopts from
pyproject.toml (which contains the intended --cov=src/evalhub,
--cov-report=term-missing, and --cov-report=html settings); update the command
in the "Run pytest" step to simply run pytest with no extra flags.

Comment on lines +46 to +50
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v4
if: matrix.python-version == '3.11' with:
files: ./coverage.xml
fail_ci_if_error: false
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
python -m pip install --quiet pyyaml
python - <<'PY'
from pathlib import Path
import yaml

p = Path(".github/workflows/tests.yml")
text = p.read_text()
try:
    yaml.safe_load(text)
    print("YAML parse: OK")
except Exception as e:
    print(f"YAML parse: FAIL -> {e}")
    raise

print("Matrix versions line:")
for i, line in enumerate(text.splitlines(), 1):
    if "python-version:" in line or "if: matrix.python-version" in line:
        print(f"{i}: {line}")
PY

Repository: eval-hub/eval-hub-sdk

Length of output: 2381


🏁 Script executed:

cat -n .github/workflows/tests.yml | sed -n '35,55p'

Repository: eval-hub/eval-hub-sdk

Length of output: 579


🏁 Script executed:

cat -n .github/workflows/tests.yml | sed -n '1,45p'

Repository: eval-hub/eval-hub-sdk

Length of output: 1249


Fix invalid YAML syntax and correct the Python version guard in the Codecov step.

Line 48 is syntactically invalid YAML with if: and with: on the same line. Additionally, the version guard checks '3.11' but the matrix defines only ['3.12', '3.13'].

Proposed fix
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v4
-if: matrix.python-version == '3.11'        with:
+        if: matrix.python-version == '3.12'
+        with:
           files: ./coverage.xml
           fail_ci_if_error: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v4
if: matrix.python-version == '3.11' with:
files: ./coverage.xml
fail_ci_if_error: false
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v4
if: matrix.python-version == '3.12'
with:
files: ./coverage.xml
fail_ci_if_error: false
🧰 Tools
🪛 actionlint (1.7.11)

[error] 48-48: could not parse as YAML: mapping values are not allowed in this context

(syntax-check)

🪛 YAMLlint (1.38.0)

[error] 48-48: syntax error: mapping values are not allowed here

(syntax)

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/tests.yml around lines 46 - 50, Fix the invalid YAML in
the "Upload coverage to Codecov" step by moving the if: guard onto its own line
(not on the same line as with:) and properly indenting it as a step-level key,
and correct the Python version check from '3.11' to a value that matches the
matrix (e.g., change matrix.python-version == '3.11' to matrix.python-version ==
'3.12' or another desired version); identify the step by its name "Upload
coverage to Codecov" and the action uses: codecov/codecov-action@v4 when
applying the changes.

Comment on lines +26 to +30
- repo: https://github.com/astral-sh/ruff-pre-commit
rev: v0.1.14
hooks:
- id: ruff
args: ["--fix"]
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Ruff pin in .pre-commit-config.yaml =="
rg -n -C2 'astral-sh/ruff-pre-commit|rev:\s*v?[0-9]+\.[0-9]+\.[0-9]+' .pre-commit-config.yaml

echo
echo "== Ruff pin and tool config in pyproject.toml =="
rg -n -C2 'ruff==|^\[tool\.ruff\]|target-version' pyproject.toml

Repository: eval-hub/eval-hub-sdk

Length of output: 1284


Align Ruff versions across pre-commit and project dependencies

.pre-commit-config.yaml (line 27) pins ruff-pre-commit to v0.1.14, while pyproject.toml pins ruff to 0.1.6. This mismatch can produce inconsistent lint results across local, CI, and development environments. Update pyproject.toml to match:

-    "ruff==0.1.6",  # Match ruff-pre-commit v0.1.6
+    "ruff==0.1.14",  # Match ruff-pre-commit v0.1.14
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.pre-commit-config.yaml around lines 26 - 30, The pre-commit config pins
ruff-pre-commit at rev: v0.1.14 while pyproject.toml lists ruff at 0.1.6,
causing inconsistent linting; update the ruff version in pyproject.toml to match
the pre-commit pin (change the ruff = "0.1.6" / tool.ruff version entry to
0.1.14 or otherwise align it with rev: v0.1.14) so local/CI/pre-commit use the
same ruff release.

Comment on lines +95 to +101
```
<type>(<scope>): <subject>

<body>

<footer>
```
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Add language identifiers to fenced code blocks (markdownlint MD040).

Line 95 and Line 113 use unlabeled fenced code blocks, which will trip markdown linting in stricter CI configs.

Proposed fix
-```
+```text
 <type>(<scope>): <subject>
 
 <body>
 
 <footer>

@@
- +text
feat(api): add user authentication endpoint

fix(parser): resolve crash when parsing empty files

docs(readme): update installation instructions

Also applies to: 113-119

🧰 Tools
🪛 markdownlint-cli2 (0.21.0)

[warning] 95-95: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@CONTRIBUTING.md` around lines 95 - 101, Two unlabeled fenced code blocks
containing the commit message template (the block with "<type>(<scope>):
<subject>" and the example block with "feat(api): add user authentication
endpoint ...") violate markdownlint MD040; fix both by adding a language
identifier (e.g., text) to each opening fence so they read "```text" instead of
"```" to silence the linter and preserve formatting for the template and
examples.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant