fix: resolve bugs and improve CI/CD reliability

- writer.py: add try-finally for stdout wrapper (resource leak)
- cli.py: validate --max-depth >= 0
- tree.py: fix symlink check order, change UnicodeDecodeError to ERROR
- ci.yml: replace flake8 with ruff, remove duplicate test-coverage job
- cd.yml: remove always() race condition, quote git config, add version validation
- pyproject.toml: add version bounds, replace flake8 with ruff, add isort

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: nikolay-e

.github/workflows/cd.yml

@@ -46,6 +46,15 @@ jobs:
             exit 1
           fi
 
+      - name: Validate version format
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+)?$ ]]; then
+            echo "Error: Invalid version format '$VERSION'. Expected semver like 1.0.0 or 1.0.0-rc1"
+            exit 1
+          fi
+          echo "Version format valid: $VERSION"
+
       - name: Set version in version.py
         env:
           VERSION: ${{ github.event.inputs.version }}
@@ -66,8 +75,8 @@ jobs:
       - name: Commit version bump (locally only, no push yet)
         id: commit_version
         run: |
-          git config user.name github-actions[bot]
-          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add src/treemapper/version.py
           if ! git diff --staged --quiet; then
             git commit -m "Release version ${{ github.event.inputs.version }}"
@@ -282,7 +291,6 @@ jobs:
     name: Push Release and Create GitHub Release
     needs: [prepare-version, build-assets, publish-to-pypi]
     if: |
-      always() &&
       needs.prepare-version.result == 'success' &&
       needs.build-assets.result == 'success' &&
       (needs.publish-to-pypi.result == 'success' ||
@@ -313,8 +321,8 @@ jobs:
       - name: Push commit and tag to main
         working-directory: ./repo
         run: |
-          git config user.name github-actions[bot]
-          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
           # Push the version bump commit to main
           git push origin HEAD:main

.github/workflows/ci.yml

@@ -71,7 +71,7 @@ jobs:
 
       - name: Run Linters and Formatters Check
         run: |
-          flake8 src tests
+          ruff check src tests
           black --check src tests
 
       - name: Run Type Checker (Mypy)
@@ -116,17 +116,33 @@ jobs:
 
       - name: Run Tests with Coverage
         run: |
-          pytest -v --cov=src/treemapper --cov-report=xml
+          pytest -v --cov=src/treemapper --cov-report=xml --cov-report=term-missing --cov-branch --junitxml=test-results.xml
+
+      - name: Coverage report with threshold
+        if: runner.os == 'Linux' && matrix.python-version == '3.12'
+        run: |
+          coverage report --fail-under=80 --skip-covered --show-missing
 
       - name: Upload coverage reports to Codecov
-        if: runner.os == 'Linux' && matrix.python-version == '3.11'
+        if: runner.os == 'Linux' && matrix.python-version == '3.12'
         uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage.xml
+          flags: integration
           fail_ci_if_error: false
           verbose: true
 
+      - name: Upload coverage for SonarCloud
+        uses: actions/upload-artifact@v5
+        if: runner.os == 'Linux' && matrix.python-version == '3.12'
+        with:
+          name: coverage-report
+          path: |
+            coverage.xml
+            test-results.xml
+          retention-days: 1
+
   # ============================================================================
   # PyPy Compatibility Testing
   # ============================================================================
@@ -164,72 +180,6 @@ jobs:
         run: |
           pytest -v
 
-  # ============================================================================
-  # Test Coverage with Quality Gates
-  # Evidence: Branch coverage correlates with defect detection
-  # ============================================================================
-  test-coverage:
-    name: Test Coverage & Quality Gates
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ['3.10', '3.11', '3.12']
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      - name: Cache dependencies
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-cov-${{ hashFiles('**/pyproject.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-cov-
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -e .[dev]
-
-      - name: Run tests with branch coverage
-        run: |
-          pytest \
-            --cov=src/treemapper \
-            --cov-report=xml \
-            --cov-report=term-missing \
-            --cov-branch \
-            --junitxml=test-results.xml \
-            -v
-
-      - name: Coverage report with threshold
-        run: |
-          coverage report --fail-under=80 --skip-covered --show-missing
-
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./coverage.xml
-          flags: unittests
-          name: codecov-${{ matrix.python-version }}
-          fail_ci_if_error: false
-          verbose: true
-
-      - name: Upload coverage for SonarCloud
-        uses: actions/upload-artifact@v5
-        if: matrix.python-version == '3.12'
-        with:
-          name: coverage-report
-          path: |
-            coverage.xml
-            test-results.xml
-          retention-days: 1
-
   # ============================================================================
   # Mutation Testing (test effectiveness validation)
   # Evidence: Mutation score correlates with real fault detection
@@ -353,7 +303,7 @@ jobs:
   sonarcloud:
     name: SonarCloud Analysis
     runs-on: ubuntu-latest
-    needs: test-coverage
+    needs: test
     if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main'
 
     steps:
@@ -384,7 +334,6 @@ jobs:
           sonar.python.coverage.reportPaths=coverage.xml
           sonar.python.xunit.reportPath=test-results.xml
           sonar.python.version=3.9,3.10,3.11,3.12
-          sonar.exclusions=**/*_test.py,**/test_*.py
           EOF
 
       - name: SonarCloud Scan

pyproject.toml

@@ -27,8 +27,8 @@ classifiers = [
     "Operating System :: OS Independent",
 ]
 dependencies = [
-    "pathspec>=0.9",
-    "pyyaml>=5.4",
+    "pathspec>=0.9,<1.0",
+    "pyyaml>=5.4,<7.0",
 ]
 
 [project.urls]
@@ -40,25 +40,26 @@ treemapper = "treemapper.treemapper:main"
 [project.optional-dependencies]
 dev = [
     # Testing
-    "pytest>=7.0",
-    "pytest-cov>=3.0",
-    "hypothesis>=6.0",
-    "mutmut>=2.0",
-    "coverage>=7.0",
+    "pytest>=7.0,<9.0",
+    "pytest-cov>=3.0,<6.0",
+    "hypothesis>=6.0,<7.0",
+    "mutmut>=2.0,<3.0",
+    "coverage>=7.0,<8.0",
     # Quality checks
-    "flake8>=5.0",
-    "black>=23.0.0",
-    "mypy>=1.0",
-    "radon>=6.0",
-    "import-linter>=2.0",
-    "pre-commit>=3.0",
-    "autoflake",
+    "ruff>=0.4,<1.0",
+    "black>=23.0.0,<26.0",
+    "isort>=5.12,<6.0",
+    "mypy>=1.0,<2.0",
+    "radon>=6.0,<7.0",
+    "import-linter>=2.0,<3.0",
+    "pre-commit>=3.0,<4.0",
+    "autoflake>=2.0,<3.0",
     # Type stubs
-    "types-PyYAML",
+    "types-PyYAML>=6.0,<7.0",
     # Build and release
-    "build>=0.10",
-    "twine>=4.0",
-    "pyinstaller>=5.0",
+    "build>=0.10,<2.0",
+    "twine>=4.0,<6.0",
+    "pyinstaller>=5.0,<7.0",
 ]
 
 [tool.setuptools.dynamic]

src/treemapper/cli.py

@@ -68,8 +68,11 @@ def parse_args() -> Tuple[Path, Optional[Path], Optional[Path], bool, int, str,
 
     args = parser.parse_args()
 
+    if args.max_depth is not None and args.max_depth < 0:
+        print(f"Error: --max-depth must be non-negative, got {args.max_depth}", file=sys.stderr)
+        sys.exit(1)
+
     try:
-        # The target directory to be read. This is correct as is.
         root_dir = Path(args.directory).resolve(strict=True)
         if not root_dir.is_dir():
             print(f"Error: The path '{root_dir}' is not a valid directory.", file=sys.stderr)

src/treemapper/tree.py

@@ -53,8 +53,8 @@ def build_tree(
             if should_ignore(relative_path_check, combined_spec):
                 continue
 
-            if not entry.exists() or entry.is_symlink():
-                logging.debug(f"Skipping '{relative_path_check}': not exists or is symlink")
+            if entry.is_symlink() or not entry.exists():
+                logging.debug(f"Skipping '{relative_path_check}': symlink or not exists")
                 continue
 
             node = create_node(entry, base_dir, combined_spec, output_file, max_depth, current_depth, no_content, max_file_bytes)
@@ -123,21 +123,18 @@ def create_node(
                     node_content = f"<binary file: {file_size} bytes>"
                     logging.debug(f"Detected binary file {entry.name}")
                 else:
-                    # Try to read the file directly and handle all possible errors
                     node_content = entry.read_text(encoding="utf-8")
-                    if isinstance(node_content, str):
-                        cleaned_content = node_content.replace("\x00", "")
-                        if cleaned_content != node_content:
-                            logging.warning(f"Removed NULL bytes from content of {entry.name}")
-                            node_content = cleaned_content
-                        # Ensure content always ends with a newline for consistency with old behavior
-                        if node_content and not node_content.endswith("\n"):
-                            node_content = node_content + "\n"
+                    cleaned_content = node_content.replace("\x00", "")
+                    if cleaned_content != node_content:
+                        logging.warning(f"Removed NULL bytes from content of {entry.name}")
+                        node_content = cleaned_content
+                    if node_content and not node_content.endswith("\n"):
+                        node_content = node_content + "\n"
             except PermissionError:
                 logging.error(f"Could not read {entry.name}: Permission denied")
                 node_content = "<unreadable content>\n"
             except UnicodeDecodeError:
-                logging.warning(f"Cannot decode {entry.name} as UTF-8. Marking as unreadable.")
+                logging.error(f"Cannot decode {entry.name} as UTF-8. Marking as unreadable.")
                 node_content = "<unreadable content: not utf-8>\n"
             except IOError as e_read:
                 logging.error(f"Could not read {entry.name}: {e_read}")

src/treemapper/writer.py

@@ -113,10 +113,12 @@ def write_tree_content(f: TextIO) -> None:
             buf = None
 
         if buf:
-            # Use TextIOWrapper to ensure UTF-8 encoding for stdout
             utf8_stdout = io.TextIOWrapper(buf, encoding="utf-8", newline="")
-            write_tree_content(utf8_stdout)
-            utf8_stdout.flush()
+            try:
+                write_tree_content(utf8_stdout)
+                utf8_stdout.flush()
+            finally:
+                utf8_stdout.detach()
         else:
             # Fallback: write directly to sys.stdout
             write_tree_content(sys.stdout)