[BUG] CI instability: ruff formatting + multiple test failures — request 1-day observation window

[SB2318]

Summary

Description

We are observing intermittent CI failures caused by formatting drift detected by ruff format --check.

Current Behavior

CI fails with output like:

Would reformat: app/nodes/root_cause_diagnosis/prompt_builder.py
1 file would be reformatted, 899 files already formatted

### Expected vs actual behavior

## Expected vs Actual

### Expected Behavior
- `ruff format --check` should pass in CI
- All files should already follow formatting rules before commit
- Test suite should run consistently without random failures
- CI should be stable and deterministic across runs
- Same codebase should produce same CI result across environments (local, CI, different OS runners)

---

### Actual Behavior
- CI fails due to formatting drift:
  ```bash
  Would reformat: app/nodes/root_cause_diagnosis/prompt_builder.py

### Steps to reproduce

## Steps to Reproduce

### 1. Trigger CI pipeline
- Push any commit or open a PR targeting `main`
- CI workflow starts automatically (GitHub Actions)

---

### 2. Run formatting check stage
CI executes:
```bash
python -m ruff format --check app/ tests/

### Can you reproduce it consistently?

Yes

### How often does it occur?

Every time

### Operating system

Windows

### Logs and error output

_No response_

### Additional context

_No response_

[SB2318]

@VaibhavUpreti, I am requesting a one-day observation from my side. Based on this issue, I will create further PR.

Regarding any suggestions and discussions, I am available.

[SB2318]

@VaibhavUpreti, I am requesting a one-day observation from my side. Based on this issue, I will create further PR.

Regarding any suggestions and discussions, I am available.

• Fixed CI formatting issues by aligning code with ruff format expectations
• Ensured all lint and format checks pass successfully in CI
• Stabilized CI pipeline by introducing safe vs full execution logic
• Skipped Kubernetes and AWS-dependent tests for forked PRs (no secrets environment)
• Prevented CI failures caused by missing external credentials
• Preserved full test execution for trusted environments (main branch / non-fork PRs)
• Improved overall CI reliability without altering core application behavior

I preferred targeting the main branch PR to validate CI behavior against real test conditions and ensure that test cases reflect the actual execution environment.

Instead of removing restrictions, I introduced a dual-mode testing strategy:

1. Safe Tests (without secrets)

   • Runs for forked PRs and untrusted environments
   • Skips AWS, Kubernetes, and external dependencies
   • Ensures stable CI for contributors

2. Full Tests (with secrets)

   • Runs in trusted environments (main branch / non-fork PRs)
   • Executes the complete test suite including AWS and Kubernetes flows

This approach maintains full test coverage where appropriate while preventing CI failures due to missing credentials in forked environments.

[SB2318]

But, don’t restrict main branch full tests.

[SB2318]

@VaibhavUpreti, I am requesting a one-day observation from my side. Based on this issue, I will create further PR.
Regarding any suggestions and discussions, I am available.

* Fixed CI formatting issues by aligning code with ruff format expectations * Ensured all lint and format checks pass successfully in CI * Stabilized CI pipeline by introducing safe vs full execution logic * Skipped Kubernetes and AWS-dependent tests for forked PRs (no secrets environment) * Prevented CI failures caused by missing external credentials * Preserved full test execution for trusted environments (main branch / non-fork PRs) * Improved overall CI reliability without altering core application behavior

I preferred targeting the main branch PR to validate CI behavior against real test conditions and ensure that test cases reflect the actual execution environment.

Instead of removing restrictions, I introduced a dual-mode testing strategy:

1. Safe Tests (without secrets)

   • Runs for forked PRs and untrusted environments
   • Skips AWS, Kubernetes, and external dependencies
   • Ensures stable CI for contributors

2. Full Tests (with secrets)

   • Runs in trusted environments (main branch / non-fork PRs)
   • Executes the complete test suite including AWS and Kubernetes flows

This approach maintains full test coverage where appropriate while preventing CI failures due to missing credentials in forked environments.

Again, the task is successful for my branch. I am creating a PR with fixes.